text: The Company has a designated IT Security Team to maintain its cybersecurity program and oversee third-party service providers that provide cybersecurity protection. The IT Security Team is tasked with the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and reports to our DevOPS/Security Manager. The team is comprised of personnel with a broad range of experience across the business and information technology industries, including our DevOPS/Security Manager, and employees in senior legal and administrative roles. The IT Security Team relies on the advice of the Manager DevOPS/Security related to the security of our data and any mitigation steps necessary.


text: Our DevOPS/Security Manager leads our cybersecurity program and is tasked with supporting our security functions of identifying, preventing, detecting, responding to, and recovering from cybersecurity threats and incidents. The DevOPS/Security Manager has 28 years of experience in IT networking, administration, and security related roles, including nine years at the Company. Prior to joining the Company, our DevOPS/Security Manager served for 15 years in a senior leadership role in the IT department of a large, publicly traded Fortune 500 company. The DevOPS/Security Manager reports directly to the Company's Chief Technology Officer, and provides quarterly updates to the Cybersecurity Subcommittee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: MSP Recovery, Inc.

ticker: MSPR

secItem: Item 1C


text: The identification of cybersecurity risks is a continuous and evolving assessment. As a data company, we are subject to cybersecurity risks. We have identified certain cybersecurity risks specific to our business, which are identified above in Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: The Company utilizes a hybrid platform consisting of a local and cloud environment. Our local environment connects to the cloud environment via an encrypted virtual private network ("VPN") connection. Our Site-to-Site connection consists of a firewall in our local environment which responds to a connection from a firewall in our cloud. Our networks have segregated subnets, and only allow designated staff access to our cloud environment, which is only accessible from one of our local office segments. All firewalls are configured with intrusion detection systems and intrusion prevention systems, strict firewall rules, denial of service, spoof protection, advanced threat protection, and zero-day protection. Our firewalls are configured to receive definition updates as they are released, and firmware updates are automatically installed when available. We secure our local network by not utilizing any wireless access points connected to any of our networks or firewalls, enabling port security on switches, following a principle of least privilege policy, and implementing Security Information & Event Management ("SIEM") to capture all network traffic & security events from both networking equipment, endpoints, and servers. We enforce a strict password policy with multi-factor authentication.


text: All computers and servers utilized by the Company are protected by endpoint protection, which provides real-time protection of local and network files, internet activity, and utilizes ransomware protection, application protection, malicious behavior protection, anti-malware scan interface protection, file integrity monitoring, and data loss prevention. Our endpoint protection software updates immediately upon definition releases. This endpoint has live protection and performs a deep system scan daily. Our endpoint protection products are managed by our IT Security Team via a dashboard that provides our team with immediate alerts, device isolation, and investigation features, and also contracted the use of a Managed Detection and Response ("MDR") service. The MDR service monitors our protected endpoints, servers, and network equipment at all times. This service also investigates, eliminates, and mitigates any critical alerts, while notifying our IT Security Team issues identified. All endpoints and servers are updated with security patches and application updates to our systems from a Patch Management system.


text: Our IT Security Team reviews security logs daily, and performs quarterly audits of device access, building access, outages, application access, and IT & Development tickets. We employ data loss prevention policies to enforce HIPAA rules and also use stringent encryption controls. In addition, a Vulnerability Scanning system performs vulnerability detection on a quarterly basis. An independent third-party company conducts annual penetration and vulnerability detection as well.


text: Our offices are physically secured with key card access controls for parking and floor access. In addition, security guards monitor building reception areas and parking garages, and receptionists are located in our lobbies to greet visitors. The Company engages assessors, consultants, auditors, or other third parties in connection with its cybersecurity processes.


text: The Company engages third party vendors in connection with our cybersecurity processes, including penetration and vulnerability scanning, auditing of our information security management program (ISMP); and a provider of products and services to secure users, networks, and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. In addition, the Company engaged national accounting and advisory services firms to audit the operating effectiveness of our security program, which incorporates cybersecurity in our processes. On an annual basis, the Company conducts a SOC 2 Type II audit and a HITRUST assessment.


text: SOC 2 Type II audits assess risks from interactions with the Company's systems, particularly information about system controls that the Company has designed, implemented, and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the SOC 2 trust services criteria.


text: A HITRUST assessment address the need for a continuously relevant cybersecurity assessment that incorporates best practices and leverages the latest threat intelligence to maintain applicability with information security risks and emerging cyber threats, such as ransomware and phishing. HITRUST assessments also provide a level of assurance that delivers full transparency, accuracy, consistency, and integrity.


text: In 2023, the Company engaged a HITRUST Authorized External Assessor and AICPA member firm `, which completed independent assessments of MSP Recovery's system. These independent assessments verified that we met the healthcare industry's highest standards in protecting healthcare information and mitigating this risk, including compliance with the HIPAA Security Rule. On October 13, 2023, HITRUST certified that the platforms, facilities, and supporting infrastructure of our organization meet the HITRUST CSF v11 Implemented, 1-year (i1) certification criteria. For our cloud computing services, we currently use Amazon Web Services ("AWS") which is also HITRUST certified. On June 14, 2024, an Independent Service Auditor provided MSP Recovery a report opining that our data recovery system's commitments and system requirements meet or exceed the stringent SOC 2 Type II applicable trust services criteria.


text: The Company has processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: The Company maintains specific policies and practices governing our third-party security risks, including our third-party assessment ("TPA") process. Under our TPA process, we gather information from certain third parties who contract with the Company and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, utilize encrypted secure file transfer protocols to exchange data. We require counterparties to enter into Business Associate Agreements and Non-Disclosure Agreements that, among other things, require them to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.


text: The Board has established a Cybersecurity Subcommittee of the Audit Committee responsible for the oversight of risks from cybersecurity threats.


text: On February 7, 2024, the Board established the Cybersecurity Subcommittee of the Audit Committee (the "Cybersecurity Subcommittee") to assist the Board in fulfilling its oversight responsibilities with respect to assessing and mitigating the Company's cybersecurity risks. The Company's management, under the guidance of the IT Security Team, is responsible for the preparation, presentation, and self-assessment of the Company's cybersecurity policies and practices. The Cybersecurity Subcommittee shall be comprised of at least one independent director, and is tasked with reviewing and providing high level guidance on cybersecurity-related issues of importance to the Company.


text: The IT Security Team reports to the Cybersecurity Subcommittee on a quarterly basis to inform the committee about and monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents, and is tasked with notifying the Cybersecurity Subcommittee of a cybersecurity incident upon discovery. The Cybersecurity Subcommittee held three meetings during the year ended December 31, 2024.


text: The Company recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, and violation of data privacy laws.

companyName: MOVADO GROUP INC

ticker: MOV


text: Identifying and assessing cybersecurity risk is integrated into the Company's overall risk management processes. Cybersecurity risks are identified and addressed through internal information technology security, governance, risk and compliance reviews, as well as periodic third-party assessments. To defend, detect and respond to cybersecurity incidents, the Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and disaster recovery plans. The Company also performs penetration testing to test security controls and monitors emerging laws and regulations related to data protection and information security. In addition, the Company performs third-party risk management (including gathering information via questionnaires and/or service organization controls (SOC) reports) to identify and mitigate risks from third parties such as vendors, suppliers and major customers that process the Company's employee, business or customer data.


text: The Company's cybersecurity incident response and breach management processes are intended to detect and analyze security incidents; to contain, eradicate and recover from such incidents; and to conduct a post-incident analysis to determine whether any changes to processes or security measures are merited. Such incident responses are overseen by a Breach Response Team consisting of leaders from the Company's Information Technology, Legal, Finance, Risk Management and Human Resources departments, with the assistance of external technical, legal and law enforcement support, as and when appropriate. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business and privacy impact, as well as the potential need for timely public disclosure.


text: From time to time the Breach Response Team conducts tabletop exercises to simulate responses to cybersecurity incidents, including the analysis of risks and the development of detection, mitigation and remediation strategies. The Breach Response Team also uses these exercises as an opportunity to discuss other topics related to cybersecurity, including notable developments in this area.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents or incurred any material expenses related to cybersecurity incidents. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company depends on its information systems to run its business and any significant breach of or disruption to those systems could materially disrupt the Company's business" and "If the Company were to experience a significant privacy breach, it could be subject to costly government enforcement actions and private litigation and suffer significant negative publicity which could materially and adversely affect the Company's results of operations," which are incorporated by reference into this Item 1C.


text: The Audit Committee of the Board of Directors has assumed responsibility for the oversight of management's strategies and processes for addressing risks from cybersecurity threats. The Audit Committee or the full Board receives quarterly updates regarding cybersecurity and data privacy matters from senior management, including leaders from the Information Technology and Legal teams. This generally includes briefings regarding existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), a cybersecurity maturity scorecard, status of key information security initiatives, and significant developments in data privacy regulations.


text: The Company's cybersecurity risk management and strategy processes are overseen by leaders from the Information Technology team (specifically, the Company's chief technology officer, its chief information officer, and its senior manager for cybersecurity) who collectively have over 75 years of prior work experience in various information technology roles, including security, auditing, compliance, systems and programming, and whose credentials have included Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Security Professional certifications. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of the Company's incident response plan. Potentially significant cybersecurity incidents are reported to the Breach Response Team. If the Breach Response Team deems the incident material, it will promptly notify the Audit Committee or the full Board of Directors. The Audit Committee or Board receives updates regarding other incidents during management's regular quarterly cybersecurity updates. In addition, the Company's Internal Audit function, whose leader possesses a Certified Information System Auditor (CISA) certification, reviews certain cybersecurity controls in connection with its information technology audit procedures.


text: Our processes for assessing, identifying and managing material risks from cybersecurity threats are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which governs our cybersecurity oversight and management structure as well as our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: The Risk Committee of our board of directors is responsible for the oversight of our Cyber Risk Program. The Chief Legal Officer provides quarterly updates to the Risk committee regarding the status, findings and developments within the Cyber Risk Program. In addition, the Risk Committee receives updates and presentations from the Senior Vice President, Information Security and Compliance (SVP) at each Risk Committee meeting that cover, among other things, our cyber incidents and responses, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs. The Risk Committee then reports to the full board of directors at each regular meeting of the board of directors. Additionally, at least one member of our board of directors possesses cybersecurity risk oversight experience, which contributes to the board's ability to understand and evaluate cybersecurity-related matters.


text: Management's Assessment and Management of Cybersecurity Threats Members of the executive management team, along with others from senior management and others with varying areas of expertise, are engaged as part of our Cyber Risk Program: • Senior Vice President, Information Security and Compliance: Our SVP manages our Cyber Risk Program and reports directly to the Chief Legal Officer. He manages the day-to-day information security operation, oversees our security analysts and engineers and is a member of our Cybersecurity Subcommittee. He is trained in cybersecurity strategy, planning and execution and holds industry recognized security certification, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). Our SVP has extensive experience regarding cybersecurity matters and threats affecting business-to-business software and cloud service vendors such as E2open. • Chief Legal Officer: Our Chief Legal Officer, who also serves as our Acting Chief Risk Officer, supervises the SVP's management of our Cyber Risk Program and is the chair of our Cybersecurity Subcommittee of our Disclosure Committee. Our Chief Legal Officer has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims and loss mitigation. • Cybersecurity Subcommittee of the Disclosure Committee: We have created a Cybersecurity Subcommittee of our management Disclosure Committee which includes, the Chief Legal Officer, SVP and Chief Accounting Officer. The Cybersecurity Subcommittee meets to discuss and evaluate whether certain cybersecurity incidents require public disclosure and makes recommendations regarding disclosure to the Disclosure Committee. Additionally, the Chair of the Subcommittee shall convene a meeting when either: (a) she believes a reported incident or the occurrence of a series of related incidents, requires the analysis and discussion of the Subcommittee; or (b) when any member of the Subcommittee believes that such a discussion would be appropriate. Such meeting shall be convened within 48 hours of the incident, or sooner if reasonably practicable, to expediate a materiality determination for public company reporting purposes. This Cybersecurity Subcommittee is pivotal in ensuring timely disclosure of material information and complying with the SEC's final rules on cybersecurity risk governance adopted in late 2023. • Cyber Response Team: Pursuant to our Crisis Response Program, our Response Team, which comprises the Chief Legal Officer, Chief Financial Officer and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the Chief Legal Officer or Chief Financial Officer, on behalf of the Response Team, will report to or engage the Chief Executive Officer and the Chairman of the board of directors if and when an incident becomes a crisis or potential crisis.


text: • Other Roles: The Cyber Risk Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines.


text: Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks The principal objectives of our Cyber Risk Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property and other assets of E2open, and those of our clients, vendors, partners, employees and consumers that can be at risk due to cybersecurity threats to E2open.


text: We have incorporated industry recognized cybersecurity frameworks and standards into our Cyber Risk Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Risk Program.


text: Under our Cyber Risk Program, our SVP, and the cybersecurity staff, along with the Cyber Response Team, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in our various policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Risk Committee and board of directors informed. Pertinent policy and practice documents include, among others, our Crisis Response Plan, which describes the detailed processes and procedures that should be followed in the event of a cybersecurity incident.


text: As an important cybersecurity risk mitigant, E2open provides mandatory training to its new hires and existing employees on a regular basis, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.


text: Integration into Overall Risk Management System or Processes The Cyber Risk Program is integrated into our overall risk management systems and processes. Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools and protocols (automated and human); internal and external independent auditing; management committee review; defined lines of communications; employee training; engagement of outside advisors and experts; assessment and utilization of both commercial and self-insurance opportunities; client contract standardization where possible; legal review of vendor engagements and new products for regulatory compliance; and regular operations reviews with the Chief Executive Officer and Risk Committee. E2open utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats.


text: Engagement of Third Parties As part of our Cyber Risk Program, we engage outside independent auditors, consultants, and professional advisors. We use independent auditors to certify compliance with internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework. We also conduct reviews for compliance with data protection regulation such as Europe's GDPR and regulation of various U.S. states as the California Consumer Privacy Act (CCPA). We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.


text: Risks from Third Party Service Providers and Others Our cybersecurity team, under the oversight of the SVP, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations. Based on the results of these regular assessments (including assessments made before engaging a third party), we may decide to take action to address and mitigate certain risks or determine that the risk is not acceptable and terminate the relationship with the third party (or determine not to engage a third party).


text: Risks from Cybersecurity Threats—Likely Material Impact See the risk factor entitled Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition. in Item 1A, Risk Factors. To date, we have not identified any material cybersecurity threats or incidents that have materially affected our business strategy, results of operations or financial condition. However, we cannot guarantee that future incidents will not have a material impact.


text: The Company has adopted processes designed to assess, identify, and manage material risks from cybersecurity threats that are integrated into the Company's overall risk management system. The Company's cybersecurity risk management processes are managed by Tuearis Cyber ("Tuearis") an outside contractor with significant experience and expertise in designing and implementing cybersecurity programs for corporate entities such as the Company.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: During the year ended December 31, 2024, the Company did not experience any risks from cybersecurity threats that materially affected or were reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: The Company's Board of Directors, through its Audit Committee (the "Committee"), provides oversight of risks from cybersecurity threats by monitoring incident-based reports from Tuearis as to the existence and severity of such risks. When risks are identified, the Committee works with the Company's Chief Financial Officer to develop appropriate responses, based on the recommendations of Tuearis. The Company does not have an employee with specific expertise in cybersecurity risk management but relies on Tuearis to provide that expertise. All material cybersecurity risks, incidents, and responses are reported to the Committee as a routine matter.


text: The Company depends on the confidentiality, integrity and availability of information systems and data. We have systems and processes in place to assess, identify and manage cybersecurity incidents and those systems and processes are integrated into our overall risk management system.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: Internal and third-party risks are reviewed, monitored and managed by the Company's IT ISC2, SANS, CompTIA certified security partners and external expert consultants. The Company annually engages third-party experts to assess the effectiveness of system and network security. Periodically, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the National Institute of Standards and Technology Cybersecurity Framework. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.


text: The Company's security awareness program seeks to create a culture of shared responsibility for the security of sensitive data and systems. There is required annual security training and quarterly phishing campaigns for team members with access to Company email. Annually, members of the IT department are required to take IT specific training, and store employees take operations and security training. A third-party led social engineering campaign that targets Kirkland's employees is carried out on an annual basis. Key performance indicators and periodic testing of training materials ensure the program's effectiveness.


text: The Company's process for identifying and managing first and third-party risks from cybersecurity threats includes proactive threat hunting, continuous monitoring of the Company's systems and network for cybersecurity events, and regular testing of the Company's Security Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan. An external managed security services provider and an industry-leading security tool continuously monitors, detects, and responds to the Company's systems and network for cybersecurity threats. The Company's IT security partners evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. A third-party with extensive experience in incident response and forensics is on retainer to assist with incidents. The Incident Response Plan includes reporting and escalation procedures to inform the Company's executives, the Audit Committee, and full Board of Directors, as appropriate, to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Incident Response Plan and Disaster Recovery Plan include procedures for business recovery and are tested at least annually. The Company also maintains a cyber insurance policy that provides coverage for material IT security incidents.


text: No risks from cybersecurity threats have materially affected, nor has the Company identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Please see "Item 1A. Risk Factors — Risks Related to Technology and Data Security" for additional discussion of cybersecurity risks applicable to the Company.


text: Management Responsibilities Our cybersecurity program is managed by our Senior Director of Information Technology ("Technology Senior Director"). Our Technology Senior Director has 21 years of experience in information technology and cybersecurity, having been at the Company since 2003. The Technology Senior Director, along with the Company's IT security partners, is responsible for reducing cybersecurity risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events, responding quickly and building procedures to rapidly recover, if needed.


text: Board Responsibilities On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee quarterly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. The Company's Technology Senior Director briefs the Audit Committee quarterly on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: The Company is committed to, and recognizes the importance of, information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program uses processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: The Company employs a number of tools and services, such as network monitoring and vulnerability assessments to inform our risk identification and assessment processes. We also maintain an incident response plan that outlines processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate cybersecurity incidents while also complying with relevant legal obligations. Our employees receive cybersecurity awareness and sensitive information protection training on a regular basis, which we also periodically test for effectiveness through simulations, which may include simulated phishing emails and tabletop exercises. Additionally, the Company regularly makes assessments related to the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems the Company uses. We also maintain cybersecurity risk insurance.


text: Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management function, which includes members of our executive leadership team, serves as a second line of defense, bringing holistic risk oversight while serving as a partner to the business to help strategically manage risk. In particular, cybersecurity risks are monitored by a team composed of members of our executive team, who in turn provides updates to the Audit Committee of our Board of Directors, who is responsible for assisting the Board of Directors with oversight over cybersecurity risks.


text: Through the processes described above, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See Part I, Item IA. Risk Factors – "Risks Related to Our Information Technology and Security".


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our information security program, including the Company's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and employee training. Role or project specific employee training, as well as other training, may also occur, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer ("CIO"), who is assisted by other members of our senior management team. The team engaged in the cybersecurity risk management process, including the CIO, has risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team also maintains expertise on cyber risk management through third party consultants, external training, and affiliations with relevant organizations.


text: Given the importance of information security to our customers, employees, suppliers and other partners, our Board and/or the Audit Committee receives reports as needed from our CIO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks.


text: We believe that cybersecurity is important to maintaining the trust of our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats which could adversely affect the confidentiality of our data and the integrity of our business operations and financial systems. Our cybersecurity program is based on best practices and guidelines of the National Institute of Standards and Technology Cybersecurity Framework. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risk.

companyName: ENNIS, INC.

ticker: EBF


text: Annual risk assessments and penetration testing are performed by independent third party consultants. These tests are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. The results of these tests are presented annually to the Board of Directors ("Board"), Audit Committee, and senior management for review to ensure compliance with cybersecurity standards.


text: During the fiscal year ended February 28, 2025, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.


text: Our Board of Directors, Audit Committee and senior management oversee risk management to ensure that the Company's policies and procedures are functioning as intended to protect the Company's information systems from cybersecurity threats. The Audit Committee performs an annual review and discussion of the Company's cybersecurity program, which includes planned actions in the event of a threat or recovery situation.


text: Our IT team is led by the Director of Information Technology and is responsible for regular assessment and management of cybersecurity risks. The Director of Information Technology has constant access to the Audit Committee to provide regular updates as necessary regarding any new developments.


text: We view cybersecurity as a shared responsibility of the Audit Committee and the IT team led by the Director of Information Technology, and we incorporate external resources and advisors as needed to conduct evaluations of our security controls through penetration testing, independent audits and consulting on best practices. The results of those tests are presented annually to the Board.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our Director of Cybersecurity, who reports to our Chief Information Officer, and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our Chief Information Officer leads our cybersecurity team and regularly reports to our Audit Committee.


text: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments, audits and cybersecurity threat intelligence.


text: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our Chief Information Officer based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threa ts. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by our Chief Information Officer and Director of Cybersecurity, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our Director of Cybersecurity has served in various roles in technology leadership and cybersecurity for over 20 years. Our Chief Information Officer has served in various roles in technology and business leadership for more than 40 years. Our Chief Executive Officer, Chief Financial Officer and Chief Information Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.


text: The Company continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Managing Material Risks and Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs, and industry-accepted standards, such as National Institute of Standards and Technology frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • maintaining a defined and practiced incident response plan; • maintaining cyber insurance coverage; • employing appropriate incident prevention and detection safeguards; • maintaining defined disaster recovery procedure and employing disaster recovery software, where appropriate; • educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external security support providers, including cybersecurity consultants, in evaluating, monitoring, and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.


text: Risks from Cybersecurity Incidents To our knowledge, the Company has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations, or financial standing.


text: The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 39 years of IT experience, 34 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.


text: Monitor Cybersecurity Incidents Our DIT is continually informed and updated on the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. Our DIT, supported by our DIS, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan, which details immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: The Audit Committee of the Company's Board is responsible for overseeing the Company's policies and practices related to cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • current cybersecurity threat landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learning from unique cybersecurity events, including those of other companies; and • compliance status and efforts with regulatory requirements and industry standards.


text: In addition, the CFO provides updates to the full Board upon request, and timely updates regarding unique developments such as regulatory updates or vulnerability developments, based on details provided by the DIT and DIS.


text: We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see "Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation" included as part of our risk factor disclosures in Part I, Item 1A of this report.


text: We have adopted and continue to maintain a cybersecurity risk management program that implements various controls, technology, and procedures for the evaluation, identification, and handling of significant cybersecurity risks that could impact the confidentiality, integrity, or availability of our information systems.


text: Our practices include providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying advanced tools for detecting and analyzing anomalous network activities, and implementing robust containment and incident response procedures. We leverage threat intelligence from our security vendors, as well as from trusted sources such as CISA and the FBI, to enhance our defenses and stay ahead of emerging threats. Additionally, we are committed to staying aligned with the latest industry standards and actively participating in industry forums to exchange insights and proactively address evolving cybersecurity challenges.


text: A critical component of our cybersecurity strategy is the integration of a third-party Security Operations Center support, which monitors our global network environment on a 24/7/365 basis, and is designed to rapidly identify and respond to threats. This program monitors both internally detected and externally reported vulnerabilities that could impact our products, which are then evaluated for their cybersecurity implications according to Company protocols. We also utilize third-party service providers as part of our cybersecurity risk management program and maintain a framework for managing cybersecurity risks presented by our third-party Service Providers. This framework governs the third party's security management system and mandates that the program (i) adhere to certain information handling and asset management protocols and (ii) promptly notify us of any cybersecurity incidents that impact its systems.


text: Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy. This process involves an annual evaluation of the spectrum of risks facing the enterprise, including those related to cybersecurity. When elevated cybersecurity risks are detected, designated risk owners are tasked with formulating and overseeing the execution of targeted mitigation strategies.


text: We did not experience any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Adtran maintains a cybersecurity governance structure led by its Information Security Management "ISM" team, which oversees the Company's cybersecurity risk management efforts. The ISM team ensures that appropriate controls are in place to protect Adtran's corporate assets, ensuring their availability, confidentiality, and integrity. This risk management approach informs strategic decision-making, resource allocation, and oversight mechanisms. The governance of Adtran's cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.


text: The Company's cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran's information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company's security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.


text: Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.


text: Cybersecurity risk management is integrated into Adtran's Enterprise Risk Management "ERM" program, in order to provide for continuous oversight and executive engagement. The ERM program undergoes quarterly executive reviews and annual assessments by the Board of Directors, and the Board receives regular briefings on cybersecurity risks, regulatory compliance, and security program updates from management. Key policies include the Information Security Program, which establishes governance principles across facilities, employees, business partners, and customers; the Cybersecurity Framework, which ensures compliance with ISO 27001 and industry standards; employee handbooks outlining security best practices; and the Incident Response Plan, which includes a material impact assessment workflow to support timely regulatory disclosures.


text: For additional discussion of risks associated with cybersecurity, see "Risk Factors – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT risk register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • periodic tabletop exercises conducted by outside counsel to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Information Technology, Intellectual Property, and Data Security and Privacy."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of risk assessment and risk management, including cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and emerging threats; • progress on cybersecurity projects; • incident reports; • lessons learned from past events; and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Digital and Information Officer.


text: Our management team, including our Chief Digital and Information Officer and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have an information security team with varying backgrounds, years of experience and levels of information security certification.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools and third-party managed security services that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. Security awareness training is also a key component of our information security program and involves required training for our employees several times per year.

companyName: AGILYSYS INC

ticker: AGYS


text: We also evaluate the information security of potential partners and vendors as part of our vendor selection process and attempt to negotiate adequate protections from such third parties when we enter into contracts with them. Although our security program is designed to identify, prioritize, assess, mitigate and remediate third party risks, we rely on our partners and vendors to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards to mitigate such risks. We conduct regular reviews and tests of our information security program and also leverage tabletop exercises, penetration and vulnerability testing, and third-party red team exercises to evaluate the effectiveness of our information security program and improve our security measures.


text: We also engage an external auditor to conduct an annual Security and Organizational Controls 2 (SOC 2) examination of the security controls for systems storing customer data. The external auditor additionally conducts an annual payment card industry (PCI) data security standard review of our security controls that protect payment information.


text: Our systems periodically experience attacks intended to lead to interruptions and delays in our services and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, no cybersecurity incidents have had a material impact on our business, financial condition or results of operations, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us. Any significant disruption to our service or access to our systems could result in a loss of customer data and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a material adverse effect on our business, financial condition and results of operations. See "Risk Factors — Cyber-attacks involving our systems and data could expose us to liability or harm our reputation and have a material adverse effect on our business."


text: The Vice President and Chief Information Security Officer (CISO) leads the global information security organization responsible for overseeing our information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies, and is a Certified Information Security Professional and Information Systems Security Architecture Professional. Team members who support our information security program have relevant educational and industry experience, including having held similar positions at large technology companies. Given the nature of our business, management is highly focused on identifying and managing cybersecurity risks, and our CISO and information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.


text: The results of our SOC 2 and PCI assessments are annually reported to the Cybersecurity Risk Subcommittee. Both the Subcommittee and the Board receive regular reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. The Board also oversees our annual enterprise risk assessment, where we assess key risks within the company, including cyber security and technology risks.


text: Our information security and cybersecurity program is based on a cybersecurity framework that is designed to protect against operational risks related to cybersecurity.

companyName: CORVEL CORP

ticker: CRVL


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees our day-to-day security operations, and our Chief Information Officer ("CIO") oversees our secure development activities.


text: The Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a Cybersecurity Incident Response Plan which contains processes and procedures related to security incident handling.


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including through third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.


text: We also have vendor assessment processes to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our agreements with third parties may include various compliance requirements, data protection terms, audit or monitoring rights, and notification requirements in the event the third party experiences its own cybersecurity event.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our information security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees and is supplemented with periodic social engineering tests.


text: We engage consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. In the last three fiscal years, we have not experienced any material cybersecurity incidents or costs.


text: As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer, is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our Chief Execuctive Officer, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.


text: Our cybersecurity and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. Such leaders in our organization hold industry recognized certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Global Information Assurance Certification (GIAC).


text: Viasat Cybersecurity Risk Management, Strategy and Governance Disclosure Viasat builds, maintains, and operates satellite and telecommunications systems, infrastructure and services used by both government and commercial customers across the globe. We recognize the importance of building a resilient cybersecurity program focused on reducing cybersecurity risk to our customers, partners and our own organization. Our Cybersecurity Engineering organization, at the direction of the Board of Directors, has developed and implemented a cybersecurity risk management and technical assistance program intended to protect the confidentiality, integrity and availability of the services provided and the information stored, processed or transmitted by our critical systems and infrastructure, while assisting staff to develop, operate and maintain secure products and services.

companyName: VIASAT INC

ticker: VSAT


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our executive management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. As part of the acquisition and continuing integration of Inmarsat, the legacy Inmarsat cybersecurity team joined the Viasat Security Engineering organization. The engineering and operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known as the "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our identification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.


text: Integration efforts continue between legacy Viasat and Inmarsat's cybersecurity departments. Viasat is actively merging policies, processes, and operations security practices and operational footprints ensuring we have appropriate security tools and solutions that align with our business objectives and security requirements. The combined Viasat and Inmarsat cybersecurity organizations report to Viasat's CISO and remain focused on the overall Viasat and Inmarsat satellite service network and corporate integration activities.


text: Functionally, our cybersecurity team performs internal and external risk assessments and testing on both internally and externally developed systems, as well as certain third-party and supply chain partner ecosystems based on our assessment of their respective operational criticality and risk profile. Depending on the risks presented, this may include some combination of manual and automation-driven testing methods and supply chain risk management activities such as hardware and software assurance assessments, anti-counterfeit measures, and the use of trusted suppliers. Compliance with security policies, procedures, and standards are assessed, and depending on the potential risks posed to us, third-party assessments may be performed, including penetration tests, red team engagements, gap assessments, and compliance certification assessments. We also conduct several 3rd party compliance and audit assessments, including PCI DSS Tier 1 Merchant and Service Provider, ISO 27001, UK Cyber Essentials Plus, and DFARS 252.204-7012 High Assurance assessments.


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers (ISACs), including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC).


text: Our cybersecurity engineering teams have personnel dedicated to detection engineering activities that leverage threat intel gathered to mitigate the impact of security events. Security detection and operations teams are responsible for detection activities including 7x24 staffed Cybersecurity Operations Centers responsible for monitoring our service provider networks and internal corporate and development environments. Various automated tools are used for detection and remediation, with support from experienced detection and response analysts and engineers.


text: When security events do occur, we employ a security incident response process that is designed to contain, eradicate, and recover operations as quickly as possible, while preserving forensic evidence for further analysis and potential attribution. We leverage multiple third parties for incident response and forensic support on retainer as necessary to assist during the incident response and remediation phases. We also maintain cybersecurity insurance in the event of cybersecurity related damages or data loss as a result of a cybersecurity incident or unauthorized data disclosure.


text: During fiscal year 2025, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our Reputation and Business Could Be Materially Harmed as a Result of Data Breaches, Data Theft, Unauthorized Access or Hacking" in Part I, Item 1A of this report.


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibility and has delegated responsibility for oversight of this risk to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. The Audit Committee oversees our enterprise risk assessment process, and cybersecurity represents an important component of our overall approach to risk assessment. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Champion Homes, Inc.

ticker: SKY


text: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Chief Technology Officer, and other members of management.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.


text: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Audit Committee receives regular presentations and reports from our Chief Technology Officer on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: The Chief Technology Officer, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: Our cybersecurity program is designed to safeguard our information systems and protect confidentiality, integrity, and availability of those information systems and the information residing therein. Our cybersecurity risk management program is integrated with our broader enterprise risk management programs under the oversight of our Chief Administrative Officer ("CAO") and the Enterprise Risk Management Committee. The CAO reports to the CEO and is responsible for our overall information and data security strategy, cybersecurity risk policies and procedures, as well as evaluating and managing any material risks from cyber threats. Our Chief Information Security Officer ("CISO") reports directly to our CAO and leads our cybersecurity and compliance department.

companyName: TRIUMPH GROUP INC


text: The cybersecurity and compliance department, in conjunction with our Computer Security Incident Response Team ("CSIRT"), designs, implements, and executes continuous monitoring processes for our information systems. Our monitoring programs include the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CSIRT is responsible for the detection and assessment of cybersecurity threats and incidents in accordance with a formal risk assessment matrix established in cooperation with our Cybersecurity Disclosure Committee. This risk assessment matrix establishes a framework for notification of an incident to the Cybersecurity Disclosure Committee and, if appropriate, the Audit Committee or Board of Directors. The CISO also partners with internal functions such as finance, legal, and internal audit, as well as third-party consultants who perform risk-based assessments against the National Institute of Standards and Technology ("NIST") 800-171 Rev2 and Cybersecurity Maturity Model Certification with recommendations, in designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategy, helping ensure such programs and strategy align with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee or Board of Directors.


text: In the event of a cybersecurity incident, the CSIRT has an Incident Response Plan that outlines the steps that are designed to help ensure regulatory requirements are met and cyber vulnerabilities, if any, are addressed. We periodically conduct "tabletop" exercises to simulate cybersecurity incidents and help ensure that we are prepared to respond to such incidents in accordance with our internal policies and programs, as well as applicable laws and regulations. In addition, tabletop exercises allow us to identify areas for potential improvement and maturation of our Incident Response Plan, or other aspects of our cybersecurity risk management program. These exercises have included participation by members of our Cybersecurity Disclosure Committee, including our CAO and Chief Financial Officer.


text: We have established a supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to assess and evolve our oversight processes to mature how we manage cybersecurity risks associated with the products and services we procure. We generally require our suppliers to adopt security practices based on industry-recognized standards.


text: We have experienced, and may experience in the future, either directly or through our supply chain or other channels, cybersecurity incidents. To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about risks associated with cybersecurity, refer to "Our business could be negatively affected by cyber or other security threats or other disruptions" in Item 1A. Risk Factors.


text: Our Board of Directors has overall responsibility for risk oversight and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee reports on its activities, findings, and other matters to the full Board of Directors quarterly, or more frequently as events or circumstances may require. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The CAO and CISO present an update to the Audit Committee on our cybersecurity risks and risk management strategies and processes at each regularly scheduled, quarterly meeting. These presentations include assessments on the threat landscape; emerging risks, threats, or vulnerabilities; updates on our risk management activities, including investments in risk mitigation and governance; compliance with laws and regulations; internal controls; and updates on incidents.


text: At the management level, we have established two committees that are directly involved in managing and responding to cybersecurity risks and incidents: the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee. The Enterprise Risk Management Committee is responsible for assessing enterprise risk and overseeing our enterprise risk management programs, including the cybersecurity risk management programs described above. The Cybersecurity Disclosure Committee is a subcommittee of our Disclosure Committee and is responsible for assessing the materiality of identified cybersecurity incidents resulting from our monitoring programs described above and informing the Chair of the Audit Committee, the Audit Committee, or the Board of Directors, as appropriate. The CISO has responsibility for notifying the CAO and the Cybersecurity Disclosure Committee of potentially material cybersecurity incidents based on an established policy and risk assessment matrix that incorporates an evaluation of quantitative and qualitative factors such as potential impact on results of operations and financial condition, compliance with laws and regulations, and impact on key stakeholders such as employees and business partners. The CISO has over fifteen years of cybersecurity risk management experience and has served the Company for over twenty years in various roles involving managing information technology, security and compliance functions, including developing key enterprise capabilities such as security engineering and strategies on information security risk management.


text: The CAO and Chief Financial Officer are members of both the Enterprise Risk Management Committee and the Cybersecurity Disclosure Committee and are supported by our information security, compliance, contracts, treasury, investor relations, operations, and supply chain organizations so that identified issues can be addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.


text: As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations. Informa PLC's chief information security officer ("CISO") and Security team have implemented a similar framework and we collaborate on best practices, improvements, and risk assessments. Some Informa TechTarget systems are currently managed within the Informa PLC environments and overseen by the Informa PLC framework. The teams collaborate regularly and share any relevant findings.

companyName: TechTarget, Inc.

ticker: TTGT