text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Audit Committee discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents. The Audit Committee provides regular reports to the full Board of Directors.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment and our primary transactional activity is done through partnerships with oil and gas operators and other investment managers. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment. We also engage a separate third-party vendor to provide staff IT security education, testing for social engineering vulnerabilities, and reporting on employee training.

secItem: Item 1C


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include:


text: Advanced, next-generation endpoint security software, detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident.


text: Privilege management software provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment.


text: The Company employs email security tools provided and managed by our Provider to protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.


text: The Company utilizes various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. The Company obtains System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.


text: The Company requires all devices used by employees to be protected with the security measures listed above. It is also Company policy that all devices be used by the employee only and any use by non-employees is prohibited.


text: To date, the Company has not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.


text: We do not employ a Chief Information Officer. The Audit Committee discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents. The Audit Committee provides regular reports to the full Board of Directors.


text: Due to the our size, our information technology ("IT") environment does not utilize overly complicated systems or processes. We do not sell products or conduct business in an online environment and our primary transactional activity is done through partnerships with oil and gas operators and other investment managers. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet our needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. We use multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment. We also engage a separate third-party vendor to provide staff IT security education, testing for social engineering vulnerabilities, and reporting on employee training.


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include: • Advanced, next-generation endpoint security software, which detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident. • Privilege management software, which provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment. • Email security tools provided and managed by our Provider, which protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.


text: We utilize various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. We obtain System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.


text: We require all devices used by employees to be protected with the security measures listed above. It is also our policy that all devices be used by the employee only and any use by non-employees is prohibited.


text: To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.


text: Safeguarding our information technology systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share with us is a critical concern for our business. As such, we have processes in place to assess, identify, and manage material cybersecurity threats and incidents. Key to these efforts is our cybersecurity risk management program (the "Cybersecurity Program"). We aim to incorporate industry best practices throughout our Cybersecurity Program. It is founded on the National Institute of Standards and Technology's (NIST) Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the International Organization for Standardization (ISO), and other applicable industry standards for protecting controlled unclassified information. The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks. The controls are tested and evaluated on a regular basis and include the following controls: network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks; evaluation and monitoring of detected security events; and documented incident response actions and procedures. In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.

companyName: ROGERS CORP

ticker: ROG


text: We regularly remind employees of the importance of handling and protecting customer and employee data, including through periodic security training to enhance employee awareness of how to detect and respond to cybersecurity incidents. We also conduct tabletop exercises to simulate response plans to various cybersecurity incidents. Our team of cybersecurity professionals then collaborate with relevant stakeholders within the Company to evaluate and adjust our detection and mitigation strategies.


text: We impose security requirements upon our suppliers, including maintaining an effective security management program, abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Our Chief Information Officer (CIO) is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Senior Manager of Information Security. Our CIO has more than 25+ years of information technology and cybersecurity experience, and has served in this role since 2021.


text: Our Board of Directors, primarily through the Audit Committee, oversees our enterprise risk management program, including cybersecurity risks. The enterprise risk management program is utilized in making decisions with respect to company priorities, resource allocation, and oversight structures. Our CIO delivers updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives. These updates consist of a report to the full Board of Directors and to the Audit Committee, and cover a wide range of topics, including evolving regulations and standards, vulnerability assessments, mitigation strategies, third-party and independent reviews, the evolving threat environment, technological and industry trends, and information security considerations arising with respect to the Company's peers and other third parties. Our CIO will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed. Furthermore, our CIO provides periodic updates to our senior management regarding cybersecurity risks, as well as interim updates during regular meetings with our leadership team.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect the company, see the risk factor titled "A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Safeguarding our information technology systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share with us is a critical concern for our business. As such, we have processes in place to assess, identify, and manage material cybersecurity threats and incidents. Key to these efforts is our cybersecurity risk management program (the "Cybersecurity Program"). We aim to incorporate industry best practices throughout our Cybersecurity Program. It is founded on the NIST's Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the ISO, and other applicable industry standards for protecting controlled unclassified information. The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks. The controls are tested and evaluated on a regular basis and include the following controls: network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks; evaluation and monitoring of detected security events; and documented incident response actions and procedures. In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.


text: We regularly remind employees of the importance of handling and protecting customer and employee data, including through periodic security training to enhance employee awareness of how to detect and respond to cybersecurity incidents. We also conduct tabletop exercises to simulate response plans to various cybersecurity incidents. Our team of cybersecurity professionals then collaborate with relevant stakeholders within our Company to evaluate and adjust our detection and mitigation strategies.


text: Our CIDO is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Director of Information Security and Compliance.


text: Our Board of Directors, primarily through the Audit Committee, oversees our enterprise risk management program, including cybersecurity risks. The enterprise risk management program is utilized in making decisions with respect to our Company's priorities, resource allocation, and oversight structures. Our CIDO and/or Director of Information Security and Compliance deliver updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives. These updates consist of a report to the full Board of Directors and to the Audit Committee, and cover a wide range of topics, including evolving regulations and standards, vulnerability assessments, mitigation strategies, third-party and independent reviews, the evolving threat environment, technological and industry trends, and information security considerations arising with respect to our Company's peers and other third parties. Our CIDO and/or Director of Information Security and Compliance will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed. Furthermore, our CIDO and/or Director of Information Security and Compliance provide periodic updates to our senior management regarding cybersecurity risks, as well as interim updates during regular meetings with our leadership team.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect our Company, see the risk factor titled "A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. We describe how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations and financial condition, in the risk factor entitled " A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results" under Item 1A, Risk Factors, of this report.

companyName: ROYAL GOLD INC

ticker: RGLD


text: The Senior Vice President and Chief Financial Officer, with assistance from other members of management and contracted information technology and cybersecurity consultants (including consultants with decades of experience in information technology and cybersecurity roles), is responsible for managing our cybersecurity program, policies and strategy. Under its Charter, the Audit and Finance Committee ("AFC") of our Board of Directors is responsible for oversight of our cybersecurity program. Quarterly and annual reports are provided to our AFC and Board of Directors, respectively, on the cyber risks, threats and projects impacting our cybersecurity program. As part of our continuing effort to evaluate and enhance our cybersecurity program, including risks associated with using third-party service providers, we regularly evaluate the effectiveness of our cybersecurity policies and procedures and provide our employees with cybersecurity training on current and evolving cybersecurity threats.


text: Our cybersecurity program is designed to protect the integrity of our information and the proper functioning and availability of the information systems that help operate our business. We utilize the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) to inform our cybersecurity program and maintain International Organization for Standardization 27001 (ISO 27001) certification. We have created and implemented processes that assess, identify, respond to and manage cybersecurity threats and incidents, and we oversee these processes to minimize the occurrence and impact of any unauthorized access, disruption or use of our information or that of our customers. We have a robust set of information security policies related to encryption of data, anti-virus, firewalls, multi-factor authentication, training of employees, as well as incident response capabilities designed to proactively identify risks and mitigate attacks and unauthorized access attempts to our systems, amongst other measures.

companyName: RYDER SYSTEM INC

ticker: R


text: Our cybersecurity program is evaluated by both our management and board of directors. Our Chief Information Officer supervises our cybersecurity program, and our Chief Information Security Officer (CISO) manages its daily operation. Our CISO has over two decades of experience in the cybersecurity and risk management fields, including over 15 years of experience leading cybersecurity oversight, as well as various industry-recognized certifications, such as the Certified Information Systems Security Professional and Auditors certifications. The CISO provides quarterly reports to the audit committee of our board of directors, which is responsible for overseeing cybersecurity and information technology and notifying the board of directors of any significant risks or updates. These reports may include updates on our enterprise-wide cybersecurity strategy, policies, processes and standards, as well as potential cybersecurity or information technology risks and threats. Our cybersecurity program is also evaluated at least annually by external experts, and the results of those reviews are reported to our leadership team and the board of directors. Cybersecurity risk is also evaluated as an enterprise-wide risk via our enterprise risk management program, which is reviewed by our leadership team and the board of directors. All employees are required to complete semiannual cybersecurity trainings and have access to more frequent cybersecurity trainings through online simulations. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, to date, these incidents have not had a material impact on our financial condition or results of operations. In the event of a cybersecurity incident, we assess whether such incident had a material impact, and in certain cases, such assessment is reviewed by our leadership team, including the Chief Executive Officer, outside legal advisors and other third-party advisors. Refer to Item 1A. Risk Factors for further information regarding risk related to cybersecurity attacks and other breaches of our systems and information technology.


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems, networks and information, and those of our third-party providers and customers, to date, these incidents have not had a material impact on our financial condition or results of operations. In the event of a cybersecurity incident, we assess whether such incident had a material impact, and in certain cases, such assessment is reviewed by our leadership team, including the Chief Executive Officer, outside legal advisors and other third-party advisors. Refer to Item 1A. Risk Factors for further information regarding risk related to cybersecurity incidents and other breaches of our systems and information technology.


text: The Company has implemented technologies and tools to evaluate its cybersecurity protections and maintain a cyber risk management strategy related to its technology infrastructure that includes monitoring emerging cybersecurity threats and assessing appropriate responsive measures.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Risk Identification The Company's Chief Information Security Officer ("CISO") and Cybersecurity team are actively engaged within the cybersecurity community in order to monitor emerging trends and developments and share best practices for identifying and mitigating cyber threats. For example, the Company participates in threat intelligence information-sharing networks, such as the Financial Services Information Sharing and Analysis Center (FS-ISAC). The Company also tracks industry and government intelligence sources for information about evolving cyber threats and deploys updates to its systems, as appropriate. The Company's Cybersecurity team monitors and investigates suspicious events.


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Company's Chief Technology and Operations Officer review and approve the cybersecurity assessment. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.


text: On an annual basis, under the direction of the Company's Chief Risk Officer, the Company's Technology, Cybersecurity and Business Resiliency groups also participate in the enterprise-wide Own Risk and Solvency Assessment ("ORSA"), which outlines identified risks and describes the controls in place across the Company to address those risks. The ORSA is reviewed with the Company's lead regulator, the State of Connecticut Department of Insurance, which in turn performs periodic financial examinations, including a technology control assessment.


text: In addition, the Company regularly self-assesses against its internal policies, using its internal risk assessment process and a variety of frameworks, such as the New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies, the Insurance Data Security Model Law as adopted and modified by various states and the Payment Card Industry Data Security Standard.


text: As the workforce, the work environment and the threat landscape continue to evolve, the Company seeks to evaluate related risks and implement appropriate controls.


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.


text: The Company uses technologies and tools, as appropriate, to enhance cybersecurity, such as multifactor authentication, encryption, firewalls, intrusion detection and prevention systems, endpoint detection and response, vulnerability scanning, penetration testing, patch management and identity and access management systems. These systems are designed, implemented and maintained with the goal of identifying, assessing and managing cybersecurity risks. In addition to its internal cybersecurity team, the Company uses internal and external auditors and, as appropriate, third-party consultants, service providers and assessors to review and test its processes.


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity related information through a number of different methods, including event-triggered awareness campaigns, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has a Security Incident Response Framework in place. The framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party risk assessments, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms.


text: To date, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—If we experience difficulties with technology, data and network security (including as a result of cyber attacks), outsourcing relationships or cloud-based technology, our ability to conduct our business could be negatively impacted."


text: The Risk Committee of the Board, consistent with its charter, reviews and discusses with management the strategies, processes and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The CISO typically provides quarterly updates regarding cybersecurity and cyber risk to executive management and the Risk Committee of the Company's Board of Directors.


text: The CISO leads the Company's cybersecurity department. The CISO reports to the Chief Technology and Operations Officer and is a member of the Enterprise Risk team and the Company's Disclosure Committee. The CISO has over 20 years of cybersecurity and information security risk compliance and threat analysis experience. Prior to joining the Company in 2023, the CISO served as Chief Security Officer for a national telecommunications service provider. Under the direction of the CISO, the Company's Cybersecurity department analyzes cybersecurity and resiliency risks to the Company's business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term strategies, which are executed through a collaborative effort within Technology, Cybersecurity and Business Resiliency and are communicated to the Risk Committee of the Board of Directors on a regular basis.


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Chief Financial Officer of the Company's Technology group review and approve the cybersecurity assessment. The Company's Chief Technology and Operations Officer reviews and approves the list of emerging, strategic and transformative risks upon which the Enterprise Risk Management team's cybersecurity risk and control assessment processes are based. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance, Technology, and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.


text: To help manage risk from potential cybersecurity threats, as part of the annual Code of Business Conduct and Ethics training, all Company employees receive data protection and privacy training, which focuses on the need to appropriately protect and secure confidential Company information. Additionally, the Company provides annual security awareness training that covers a broad range of security topics. The Company also provides regular targeted training on topics such as artificial intelligence (AI) related risks, phishing and secure application development, among others. In addition to online training, employees are provided with cybersecurity information through a number of different methods, including awareness campaigns, gamified activities, recognition programs, security presentations, intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has a Security Incident Response Framework (Framework) in place. The Framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the Framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party service providers, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms. Additionally, our Procurement group has a framework to help identify and mitigate supplier risks, as well as enable management to make risk informed decisions.


text: Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and availability of the information that Seaboard collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Managing Material Cybersecurity Risks Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs assessments and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. These action plans are included on a multi-year roadmap that addresses priority, funding and implementation. These risks are evaluated on a quarterly basis according to Seaboard's cybersecurity reporting process.


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests; Seaboard engages independent third parties to perform some services such as a penetration test; Seaboard maintains end user and administrative user policies governing the use of company technology.


text: Overseeing Third-Party Cybersecurity Risk Seaboard's information security program includes a documented process to oversee, identify and mitigate cybersecurity risk associated with Seaboard's use of new third-party service providers. As part of this process, prior to onboarding a third-party service provider, designated information security personnel from each segment will work with the internal business sponsors to perform a cybersecurity risk assessment and determine the potential impact on Seaboard's systems, data and networks if an identified cybersecurity breach were to occur. Risk assessments are documented, and reports are shared with the Information Security Team and others responsible for accepting the risk tolerance and monitoring the risks going forward.


text: Risks from Cybersecurity Threats As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure.


text: Seaboard acknowledges the importance of effectively managing risks linked to cybersecurity threats. Seaboard has implemented oversight mechanisms to ensure effective governance in handling risks linked to cybersecurity threats because of the impact these threats can have on operational integrity and stakeholder confidence.


text: Cybersecurity Risk Management Personnel Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the "IS Director"). The IS Director, whose experience includes over seven years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.


text: Management's Role Managing Cybersecurity Risk and Board of Director Oversight The IS Director and the Information Security Team communicate guidance to all divisional information security personnel to ensure consistent execution of cybersecurity risk management activities. Updates on divisional cybersecurity risks, compliance and roadmap status are provided on at a least a quarterly basis to Seaboard's CEO and CFO for purposes of risk monitoring, updates to policies, allocation of resources, feedback on roadmap progress and discussions on threat remediation, among other topics.


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects to strengthen Seaboard's information security systems, assessments of Seaboard's security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan expenditures. Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receives prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.


text: Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders with the security of its data and information systems. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. These frameworks and standards serve as guides and references. Seaboard adapts them to its specific environment, needs and industries. They are not meant to imply that Seaboard meets, or fully complies with, any specific technical standards, specifications or requirements set forth within them. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and accessibility of the information that Seaboard collects and stores, supporting legal and regulatory compliance and preventing disruptions to business operations. Seaboard's information security program monitors the systems and networks Seaboard relies upon for threats, breaches, intrusions and potential other weaknesses; assesses the security of company-wide software, applications and systems; responds to cybersecurity incidents; and facilitates training for employees.


text: Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs various reviews and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. Risks are evaluated at least on a quarterly basis according to Seaboard's cybersecurity reporting process.


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests.


text: Seaboard engages independent third parties to perform some services such as penetration testing and monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment and investigation by Seaboard's Information Security Team. Seaboard maintains end user and administrative user policies governing the use of company technology. Seaboard conducts risk assessments of certain of its third-party service providers with attention to cybersecurity risks.


text: As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure. Cybersecurity risks that may materially impact Seaboard are discussed in more detail in Item 1A "Risk Factors," under the heading "Operational Risks," which should be read in conjunction with this Item 1C.


text: Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the " IS Directo r"). The IS Director, whose experience includes over eight years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.


text: The IS Director and the Information Security Team communicate guidance, including various alerts to monitor and assess threats, to information security personnel in all segments to ensure consistent execution of cybersecurity risk management activities. Updates on segment-level cybersecurity risks, compliance and implementation status are provided on at least a quarterly basis to Seaboard's Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") for purposes of risk monitoring, updates to policies, allocation of resources, progress on action plans and discussions on other topics as necessary.


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects supporting Seaboard's information security systems, assessments of Seaboard's information security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan improvement expenditures.


text: Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receive prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to "Risk Factors" for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:

companyName: SPX Technologies, Inc.

ticker: SPXC


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.


text: Risk Assessment and Technical Safeguards On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and complete our security questionnaires at the time of onboarding. On a recurring basis, our third-party service providers are required to update their responses to our security questionnaires and, where available, additional information such as System and Organization Controls ("SOC") SOC 1 or SOC 2 reports are provided.


text: Board and Management Oversight Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to " Risk Factors " for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents, including assessing the severity of a cyber incident, which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.


text: As part of our overall enterprise risk management strategy, our cybersecurity processes seek to help the Company prevent or mitigate potential cybersecurity incidents, and to detect and remediate them quickly when they occur. To achieve this, the Company uses a broad selection of security tools and methodologies to assess, identify and manage material risks from cybersecurity threats.

companyName: SEMTECH CORP

ticker: SMTC


text: Key aspects of our cybersecurity risk management and threat mitigation strategy include: • Maintaining our ISO/IEC 27001:2022 certification and using it along with other common security frameworks to help assess, identify, and manage material risks from cybersecurity; • Utilizing dedicated IT Security Operations and Product Security teams focused on monitoring, enforcing and improving cybersecurity throughout the enterprise; • Engaging and training internal stakeholders from representative aspects of the business (product and functional teams) on our Incident Response and Reporting plan on a quarterly basis; • Maintaining and regularly testing our disaster recovery and business continuity plans; and • Creating information security awareness among our employees and partners through the use of phishing exercises and regular cyber-awareness articles & newsletter campaigns.


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to continue the vendor's engagement based on their cybersecurity risk profile.


text: As part of our processes, we also engage third parties and industry experts to conduct audits and other assessments of our cybersecurity system. These assessments include vulnerability assessments, penetration testing and table-top exercises. The results of these reviews help to identify areas for continued focus, improvement and/or compliance. We also regularly evaluate our cybersecurity position against benchmarks of our peers and industry leaders, and expect our strategy and management approach to change as the general cybersecurity landscape evolves.


text: Consistent with our overall risk management governance structure, the Vice President of IT Security is responsible for the day-to-day management of cybersecurity risk, while our Board and its Audit Committee play an active, ongoing oversight role.


text: The Audit Committee or the full Board receive quarterly cybersecurity updates, which are prepared by our Vice President of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.


text: The Vice President of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the Vice President of IT Security provides regular updates about cybersecurity incidents to the Audit Committee, the Chief Operating Officer and other members of the executive management team.


text: Our Vice President of IT Security has held IT security and leadership roles at the Company for over 23 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. For additional information on our cybersecurity risks, see "Item 1A. Risk Factors – We rely on certain critical information systems for the operation of our business and a disruption in our information systems, including those related to cybersecurity, could adversely affect our business operations."


text: The Company evaluates our third-party vendors and service providers to ensure appropriate oversight and to identify any risks from cybersecurity threats associated with the use of their tools or services. To that end, as part of the onboarding process, our internal IT Security Operations team: • Collects and evaluates self-certification information about each vendor's cybersecurity program and external certifications; • Reviews independent security reports that inform us about each vendor's security posture and historical incidents; and • Provides a timely evaluation of whether to move forward with the vendor's engagement based on their cybersecurity risk profile.


text: Consistent with our overall risk management governance structure, the Vice President of IT Infrastructure and Security ("VP of IT Security") is responsible for the day-to-day management of cybersecurity risk, while our Board of Directors and its Audit Committee play an active, ongoing oversight role.


text: The Audit Committee or the full Board of Directors receive quarterly cybersecurity updates, which are prepared by our VP of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.


text: The VP of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the VP of IT Security informs executive management regarding cybersecurity risks and incidents and provides regular updates about cybersecurity incidents to the Board, the Chief Operating Officer and other members of the executive management team as well as to the Audit Committee and the Board of Directors, as appropriate.


text: Our VP of IT Security has held IT security and leadership roles at the Company for over 24 years and maintains a wide range of industry certifications including Certified Information Systems Security Professional.


text: We recognize the necessity of a flexible and dynamic cybersecurity risk management strategy to defend against threats in a fast-changing digital world. For this purpose, we have invested in building a cybersecurity infrastructure to protect our information systems and secure our data from cyberattacks. Our information security program features risk management strategies, security awareness training, security operations, incident response, security governance, third-party risk management, IT security risk management, security architecture, and vulnerability management.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: 20 Service Corporation International Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, and data breaches. Our program is regularly assessed using the NIST Cybersecurity Framework, and information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.


text: Engage External Experts on Risk Management To effectively target emerging cybersecurity threats, our information security program engages with a diverse group of third-party external experts, including cybersecurity assessors, consultants, and auditors for cybersecurity risk management. Our partnerships with these third party professionals feature regular audits, assessments, and simulated testing.


text: Oversee Third-Party Risk Risk assessments are conducted when we onboard new services and new vendors, including third-party vendors, applications, and other technology services, when there are significant changes to IT or security architecture, and when systems handle sensitive data. Third-party risks are documented as part of a risk management process that follows an industry standard framework with a goal of remediation or mitigation.


text: Cybersecurity Threat Risks We have not experienced a cybersecurity incident or data breach that has had a material impact on our operations or financial standing.


text: The Board of Directors recognizes that an encompassing, effective cybersecurity risk management strategy is essential to sustaining business operations and investor confidence. Our management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: Certain members of the Board of Directors have experience conducting oversight of cybersecurity risk management across different industries, including technology and finance. The Audit Committee is the primary committee responsible for overseeing the company's cybersecurity risks with the Board receiving updates on at least an annual basis.


text: The Assistant Vice President, Information Technology Security reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a regular basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes. The Audit Committee actively participates in cybersecurity-related business decisions.


text: Risk Management Expertise With over 22 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager (CISM) and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.


text: Monitoring Cybersecurity Incidents The AVP, IT Security manages the information security program responsible for the regular monitoring of our information systems for cybersecurity risks. The monitoring process is led by an experienced team of information security professionals. Advanced security software preemptively detects threats and regular system scans are conducted to identify potential vulnerabilities. The AVP, IT Security regularly receives updates about potential cybersecurity threats and remains informed about the latest threat detection software technologies and new risk management solutions. In the event of a cybersecurity incident, the AVP, IT Security is supported by the cyber security incident response team and the crisis response team. The cyber security incident response plan guides the AVP, IT Security and includes immediate actions to escalate an incident based on its seriousness, to mitigate the impact, and to enact long-term strategies for remediation and prevention of future incidents.


text: Reporting Cybersecurity Risk The AVP, IT Security is responsible for informing executive management of cybersecurity risks and incidents. The AVP, IT Security presents quarterly briefings to the Cyber Security and Data Governance Executive Steering Committee on all issues related to cybersecurity risks and incidents. The Cyber Security and Data Governance Executive Steering Committee includes members from the senior leadership team, such as the Chief Operating Officer, the Senior Vice President of Operations Services and the General Counsel. Our highest levels of management are actively aware and involved in shaping the company's cybersecurity position and analyzing potential risks. Any cybersecurity incident or data breach that is determined to be material will be reported to the Audit Committee and the Board of Directors.


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, data breaches, and emerging risks associated with artificial intelligence. Our program is regularly assessed using the NIST Cybersecurity Framework, and mandatory information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.


text: The Assistant Vice President, Information Technology Security, who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a quarterly basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes.


text: Risk Management Expertise With over 23 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.


text: Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal data protection program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), who has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal vulnerability assessments as well as third-party penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: In connection with the design, implementation and testing of our cybersecurity program, we also work, as appropriate, with our accountants, independent assessors, legal counsel and other consultants.


text: We have an incident reporting and escalation process that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Company's senior leadership, which based on the circumstances, may include executive officers and representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") of significant or material cybersecurity incidents, as appropriate.


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee of the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs an annual review and assessment of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO reports to the Audit Committee with a comprehensive report addressing a broad range of topics, including significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO has primary responsibility for managing our cybersecurity program and efforts. Our internal audit team is responsible for the testing and audit of our information-technology internal controls.


text: We believe our information technology team to be well-qualified in this area. These qualifications include professional experience in the field and recent participation in IT and cybersecurity programs organized by leading institutions with expertise in the field.


text: While we, our customers and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost customer revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, customer dissatisfaction, and loss of investor confidence.


text: We maintain a cybersecurity program that is aligned with our business and focused on managing risks to our Company. As described below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into our overall risk management program and governance structure.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: We use various controls, technologies, and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology (NIST). These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops, and other exercises.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess, and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third party advisors.


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including the review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats, and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems, and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.


text: We use various controls, technologies and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0. These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence and general and role-based training. We also maintain third-party management processes to identify and manage the cybersecurity risks associated with third-party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third-party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops and other exercises.


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third-party advisors.


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors, or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems, and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.


text: We have processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a data protection team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including data storage and restoration and disaster recovery plans; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: As reported on Forms 8-K filed January 6, 2023 and February 10, 2023, the Company became aware of unauthorized access to the Company's systems on December 30, 2022. The Company's domestic operations were impacted by the Cyber Incident, which resulted in production delays and delayed shipments due to information access limitations. The Company immediately initiated response protocols and an investigation, engaging cyber security experts to assist with the assessment of the incident and to help determine what data was impacted. The Company has since completed data recovery and restoration from the cyber incident. See Note 12 — Commitments and Contingencies of the Notes to Consolidated Financial Statements.


text: Except for the above incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and maintains oversight of risk assessment and risk management, including cybersecurity and other information technology risks. In addition, our Board of Directors oversees management's implementation of our cybersecurity risk management program.


text: The Board of Directors receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board of Directors, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and best practices for mitigating emerging threats; • progress on cybersecurity projects; • incident reports; • updates from past event(s); and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team, including external consultants, with varying backgrounds and experience and levels of information security certification.


text: Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We recognize the importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both our management and our Board of Directors.

companyName: SMITH A O CORP

ticker: AOS


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and a cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks and as part of its oversight, the Audit Committee receives reports from management on information systems and security at each meeting, including metrics and controls, and other items from time to time such as risk assessments, security software, and incident response plans.


text: We have also established a committee of our executive leadership team to consider cybersecurity risk, mitigation strategies, and to consider trends and developments in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO and our Board.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program in a similar fashion to other legal, compliance, strategic, operational, and financial risk areas. Our program is guided by cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), although we also look to other standards to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes: • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors – Business, Operational, and Strategic Risks."


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Operating Officer (COO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually, or real-time if a material event occurs. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks. As part of its oversight, the Audit Committee receives regular reports from management on information systems and security, including metrics and controls at each meeting, and other items at least annually including risk assessments, security software, incident response plans, and key updates to the cybersecurity program and its effectiveness.


text: We have also established a committee of our executive leadership team to consider cybersecurity risks and to consider mitigation strategies in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO, Audit Committee and our Board.