text: Information security is integral to our information technology strategy, with accountability embedded at all organizational levels, including our operations, management and Board of Directors. Key elements include: • Managed Detection and Response ("MDR") & Security Operations Center ("SOC"): Our operations team employs MDR and a SOC for round-the-clock monitoring of cyber threats and vulnerabilities. • Vulnerability Management: We maintain technology solutions for cybersecurity prevention and defense, including outside firewalls, multi-factor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls. Continuous vulnerability scoring helps us address emerging risks objectively and proactively. • Incident Response: Security incidents are managed through established protocols, with escalations to senior management to assess materiality and disclosure requirements. Our information security team develops, implements and regularly tests incident response and information recovery plans designed to assess and respond to cybersecurity threats and incidents. • Board Oversight: The Audit Committee of our Board of Directors is responsible for the oversight of cybersecurity risks. It receives regular updates and presentations on our cybersecurity environment, including strategies, processes and policies, cybersecurity incidents, risks and threats, cybersecurity projects we have implemented and plan to implement and other cybersecurity developments and industry trends. These updates are led by our Chief Information Officer, a seasoned information technology professional with over 20 years of experience, supported by a dedicated security team. The chair of the Audit Committee reports to the full Board of Directors after each meeting. • Risk Management: Cybersecurity risks are either mitigated or documented in a risk register for non-material risks. Non-material risks are reviewed periodically to ensure continuous improvement and timely resolution. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: Use of Third Parties We collaborate with, and intend to continue to collaborate with, nationally recognized third-party experts for specialized security functions in rapidly evolving areas. This partnership approach enables us to leverage advanced expertise in threat identification, penetration testing, tabletop exercises, maturity assessments, training, awareness and incident response.

companyName: BELLRING BRANDS, INC.

ticker: BRBR

secItem: Item 1C


text: We routinely evaluate third-party certifications (such as SOC and Insurance Services Office reports) for applications within the scope of our financial audits, supplementing these with bridge letters and internal controls when necessary. Additionally, our security team uses advanced software to assess third-party security postures, providing maturity scores that inform risk management and foster continuous improvement throughout our partnerships.


text: Training and Preparedness The Company mandates ongoing cybersecurity training for all employees, covering a broad range of relevant topics. High-risk roles receive additional specialized training. We conduct regular phishing and social engineering simulations, with organization-wide reporting of results. Leadership teams also participate in annual tabletop exercises (simulated security incidents) to reinforce preparedness and refine our response plan. In addition, we maintain cybersecurity insurance to provide an added layer of protection and support in the event of a significant cybersecurity incident.


text: Effect of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material effect on our results of operations and financial condition. As described above under "Item 1A-Risk Factors - Technology failures, cybersecurity incidents and corruption of our data privacy protections could disrupt our operations and negatively impact our business," a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial and/or reputational damage, in addition to litigation or remediation costs or penalties.


text: Overview and Leadership Our enterprise risk management framework addresses cybersecurity risk along with other risks as part of our overall enterprise risk management process. We maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology to support our information technology systems and detect, identify, prevent, defend against and mitigate information technology and data security risks. Our cybersecurity program is aligned with the National Institute of Standards and Technology Cybersecurity Framework. This framework encompasses key processes, policies and controls to ensure protection, detection, identification, response and recovery capabilities across our organization.


text: Our information security program also addresses cybersecurity risks associated with our use of third-party service providers, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to our systems and data as well as the systems of third parties that could adversely affect our operations or business in the event of a cybersecurity incident affecting those third-party systems. We use systems and processes designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analyses regularly.


text: Cybersecurity, Risk Management and Strategy Sunnova allocates significant resources to preventing, identifying, and mitigating cybersecurity threats to our technology infrastructure and data.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: Managing Material Risks and Integrated Overall Risk Management A focused team of technology professionals works throughout the year to assess and monitor all matters of risk related to cybersecurity. This team is managed by our Chief Information Security Officer ("CISO"), who oversees cybersecurity processes and controls. We deploy a robust combination of security technologies as technical safeguards throughout our network and utilize a defense-in-depth security methodology to protect, detect and react to threats to our systems and data. We conduct cybersecurity maturity and posture assessments twice annually and adjust our efforts to adapt to the evolving industry and threat landscape. Cybersecurity risks are also assessed as part of our Annual Enterprise Risk Assessment. Our risk management strategy includes multiple programs that manage cybersecurity risk, including the following: • Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to prevent, detect and respond to cyberattacks • Our Incident Response Program outlines how we process incidents and events from identification to completion with clear definitions on roles, classifications, materiality guidelines and additional processes to support response efforts according to the NIST CSF. • An information security training program that requires all company employees and contractors with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with year-round awareness testing and re-training as necessary • Regular and robust testing of our systems and processes to assess our cybersecurity posture and resilience, which includes internal and external penetration testing performed by third-party vendors and tabletop incident response exercises • Coordinated engagements with the Department of Homeland Security and Cyber & Infrastructure Security Agency to ensure alignment with industry and government standards and leverage access to agency resources • Cybersecurity insurance coverage to mitigate the risk of cybersecurity incidents and review of this coverage annually Results of all assessments, events and test results inform cybersecurity program direction and activities taken throughout the year.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assist with assessing and mitigating cybersecurity threats to us. For example, we utilize a third-party managed security service provider who performs security operations center consulting and investigative duties as a backup to our in-house dedicated cybersecurity team.


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and we have processes in place to oversee and manage these risks. We conduct thorough security assessments of these third parties engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Incidents As of December 31, 2023, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. As such, we have not allocated any material capital towards addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this period. The materiality of an incident is determined by a team convened for an incident, according to guidelines set forth in our incident response policy and process documentation. We believe we are adequately insured against losses related to possible information security breaches and we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.


text: Board Governance and Oversight We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.


text: Our CISO is responsible for the oversight, implementation and compliance of our cybersecurity program and mitigation of cyber-related risks. Our current CISO has more than 20 years of industry experience and over 5 years of experience with development, training and controls of effective enterprise cybersecurity programs. Our CISO's responsibilities include, but are not limited to, (a) reviewing our enterprise risk register and functional risk register, (b) maintaining adequate processes to manage the identified risks under our cybersecurity program, (c) analyzing logs of cybersecurity threats and vulnerabilities, (d) overseeing prevention, detection, mitigation and remediation efforts and (e) developing, maintaining and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports the implementation of our cybersecurity program and internal reporting, security and mitigation functions.


text: Board of Director Oversight Our Board has delegated oversight of risks from cybersecurity threats, as well as overall Enterprise Risk Management, to our audit committee. The audit committee reviews and evaluates the effectiveness of our cybersecurity frameworks, policies, programs, opportunities and risk profile, as well as our business continuity and disaster recovery efforts. Members of our audit committee have cybersecurity experience from their principal occupation or other professional experience. Members of information technology management, including our CISO, regularly report on our cybersecurity matters to both the audit committee of our Board and the full Board, as follows: • Management provides quarterly reports to the audit committee regarding our cybersecurity program and risks, and the audit committee in turn provides reports to the full Board as needed. All incidents with critical functional impact are escalated to the Board and audit committee. • Current information security concerns that arise during the year are escalated in real-time to leadership based on the process defined in our Incident Response Plan. All events and incidents are evaluated against our prioritization and informational impact matrices outlined the plan.


text: We recognize cyber threats are a permanent part of the overall risk landscape and cybersecurity threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority for us.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assist with assessing and mitigating cybersecurity threats to us. For example, we utilize multiple third-party managed security service providers who perform security operations center consulting and investigative duties as a backup to our in-house dedicated cybersecurity team.


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and we have processes in place to oversee and manage these risks. We conduct thorough security assessments of these third party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Incidents As of December 31, 2024, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. As such, we have not allocated any material capital towards addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this period. The materiality of an incident is determined by a team convened for an incident, according to guidelines set forth in our incident response policy and process documentation. We believe we are adequately insured against losses related to possible information security breaches and we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.


text: Our CISO is responsible for the oversight, implementation and compliance of our cybersecurity program and mitigation of cyber-related risks. Our current CISO has more than 20 years of industry experience and over 5 years of experience with development, training and controls of effective enterprise cybersecurity programs. Our CISO's responsibilities include, but are not limited to, (a) reviewing our enterprise risk register and functional risk register, (b) maintaining adequate processes to manage the identified risks under our cybersecurity program, (c) analyzing logs of cybersecurity threats and vulnerabilities, (d) overseeing prevention, detection, mitigation and remediation efforts and (e) developing, maintaining and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced software and business technology team at the employee level that supports the implementation of our cybersecurity program and internal reporting, security and mitigation functions.


text: Board of Director Oversight Our Board has delegated oversight of risks from cybersecurity threats, as well as overall Enterprise Risk Management, to our audit committee. The audit committee reviews and evaluates the effectiveness of our cybersecurity frameworks, policies, programs, opportunities and risk profile, as well as our business continuity and disaster recovery efforts. Members of our audit committee have cybersecurity experience from their principal occupation or other professional experience. Members of software and business technology management, including our CISO, regularly report on our cybersecurity matters to both the audit committee of our Board and the full Board, as follows: • Management provides quarterly reports to the audit committee regarding our cybersecurity program and risks, and the audit committee in turn provides reports to the full Board as needed. All incidents with critical functional impact are escalated to the Board and audit committee. • Current information security concerns that arise during the year are escalated in real-time to leadership based on the process defined in our Incident Response Plan. All events and incidents are evaluated against our prioritization and informational impact matrices outlined the plan.


text: We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors. Our internal Information Systems team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and cyber security software protection, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. • Incident Identification and Response: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. • Cybersecurity Training and Awareness: All employees and contractors are required to receive semi-annual cybersecurity awareness training. Employees also receive training in response to drills and simulated attacks. • Access Controls: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information. • Encryption and Data Protection: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: OneWater Marine Inc.

ticker: ONEW


text: We incorporate external expertise and reviews as part of our cybersecurity program. For example, we have engaged an independent cybersecurity advisor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: As of the date of this report, though the Company and its third-party service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition, results of operations or cash flows. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight and Management's Role Through the Company's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and information technology risks. The Board or Audit Committee regularly reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, the Company's Director of Information Systems is responsible for upward reporting of emerging cybersecurity incidents.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our cybersecurity leadership team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our cybersecurity leadership team is made up of highly experienced professionals with a background in information security, risk management, and incident response. This background includes leading and developing cyber security operations and incident response programs for business organizations, developing comprehensive cyber security strategies, and managing complex cybersecurity projects across various industries.


text: We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors. Our internal Information Systems team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and cyber security software protection, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. • Incident Identification and Response: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. • Cybersecurity Training and Awareness: All employees and contractors are required to complete semi-annual cybersecurity awareness training. We also conduct periodic drills and simulated attacks—including simulated phishing exercises and other social-engineering tests—to reinforce training, evaluate user response, and assess the effectiveness of our cybersecurity controls. Employees who do not successfully complete these exercises are required to undergo additional, targeted training to address identified gaps and strengthen overall security readiness. • Access Controls: We endeavor to limit users' access to no more than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information. • Encryption and Data Protection: We endeavor to use appropriate encryption methods to protect sensitive data. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: As of the date of this report, though the Company and its third-party service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition, results of operations or cash flows. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise of our information or operational technology systems.


text: Board of Directors' Oversight and Management's Role Through the Company's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and information and operational technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and information and operational technology risks. The Board or Audit Committee regularly reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, the Company's Director of Information Systems is responsible for upward reporting of emerging cybersecurity incidents.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our Information Systems team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Systems team, including our Director of Information Systems, who has worked in the information systems field for over 15 years and has lead our Information Systems team for over 10 years. Our Director of Information Systems oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Information Systems team is made up of highly experienced professionals with a background in information security, risk management, and incident response. This background includes leading and developing cyber security operations and incident response programs for business organizations, developing comprehensive cyber security strategies, and managing complex cyber security projects across various industries.


text: We have dedicated substantial resources to prevent and manage cybersecurity risk. We have administrative, technical, and physical security measures in place, as well as policies and procedures to require third parties to whom we transfer data to implement and maintain appropriate security measures. We proactively employ multiple methods at different layers of our systems which are designed to defend against intrusion and attack and protect our data. We also consider the threats and challenges that we and other companies face as cybersecurity attacks grow in frequency and complexity.

companyName: Dynatrace, Inc.

ticker: DT


text: We have in the past been, and may in the future be, the target and victim of cybersecurity attacks. In general, security incidents have increased in sophistication and have become more prevalent across industries and may occur on our systems, or on the systems of third parties we use to host our solutions or SaaS solutions that we use in the operation of our business, or on those third party hosting platforms on which our customers' host their systems. Although we have taken significant measures to detect, effectively remediate, and prevent phishing and other attacks and security threats, we cannot be certain that our efforts will be effective to prevent and remediate all attacks and security threats. To date, we do not believe we have experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See the "Risk Factors" section of this Annual Report for more information on material cybersecurity risks that we face.


text: Cybersecurity risk management is integrated within our enterprise risk management ("ERM") program, which identifies, prioritizes as to likelihood and magnitude, and continuously monitors the various short-term and long-term risks that Dynatrace faces and how they are being addressed. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II, FedRAMP and StateRAMP.


text: We have an Information Security Office that is responsible for preventing, assessing, detecting, mitigating, and remediating cybersecurity risks. The Information Security Office, which is led by our Chief Information Security Officer ("CISO"), works cross-functionally with different business and corporate functions, as all Dynatrace employees are considered critical to our company's security. Our Information Security Office also partners with external organizations to maintain and enhance our cybersecurity systems and processes. Our Board of Directors and two of its committees are also involved in the oversight of our cybersecurity risk management. We discuss our CISO and the Board in more detail in the "Governance" section below.


text: Risk assessment and management - Our corporate and product security professionals assist in managing cybersecurity systems and in preventing, detecting, assessing, and resolving cybersecurity incidents. We build cybersecurity principles into our product development and system design, we have internal and external penetration testers who test our product platform and corporate systems, and we have a bug bounty program that can incentivize external security researchers who help us identify and fix bugs and vulnerabilities before they are exploited. Our internal audit team and our company's independent auditors periodically assess the effectiveness of certain of our cybersecurity-related controls. From time to time, we also engage external consultants and advisors to perform independent security testing and assessments and to assist with aspects of our cybersecurity program. We also utilize automated technology that alerts our security team of unusual activity in our corporate systems, product platform, and public-facing systems. As part of our processes, we require applicable internal approvals for changes to security-critical aspects of our product platform and services.


text: We assess the cyber risk of potential third-party service vendors, partners, and other service providers. We evaluate third parties before onboarding and periodically afterwards or if we detect a significant change in their cyber risk rating. We also perform security assessments on third-party code libraries before internal use.


text: Incident response planning - We have an incident response plan that sets forth a structured process and approach for how we assess, respond to, and remediate cybersecurity incidents. Under the plan, our CISO, the Information Security Office, and any incident response team that may be formed, work with our legal team, our privacy office, and any other applicable internal teams and external resources to address and communicate about incidents to key stakeholders, including the Board and its Cybersecurity Committee. We review and test the plan from time to time to enhance management and Board preparedness in the event of a potential cybersecurity incident and to identify areas of continuous improvement.


text: Training and education - We require employees and contractors to complete data protection and security awareness training in connection with onboarding and annually thereafter. These trainings cover a wide range of topics, including, but not limited to, ransomware, impersonation attacks, data handling and privacy, fraud, phishing, and identity theft. From time to time, we also require supplemental training depending on an individual's role or job responsibilities. Our CISO also periodically presents on cybersecurity matters at company-wide meetings and with individual business and corporate functions.


text: Our Board of Directors, as a whole and through its committees, has responsibility for the oversight of our risk management. The Board is responsible to satisfy itself that the risk management processes designed and implemented by management are adequate and functioning as designed.


text: The Board has a standalone Cybersecurity Committee that is responsible for managing oversight of our cybersecurity-related investments, programs, plans, controls, and policies. The Cybersecurity Committee also provides feedback on cybersecurity-related matters, including, but not limited to, strategies, objectives, capabilities, initiatives, and policies. The Cybersecurity Committee meets during the year with the CISO and other members of our executive leadership team. In between meetings, the CISO periodically provides the Cybersecurity Committee with a written report on cybersecurity matters.


text: The Board's Audit Committee oversees our ERM program, which includes cybersecurity risk management as a focus area. The full Board also receives periodic reports from management on the ERM program.


text: The Chairs of the Cybersecurity Committee and the Audit Committee periodically update the full Board on specific committee-level topics and discussions. This enables the Board and its committees to coordinate the risk oversight role, particularly with respect to risk interrelationships.


text: From time to time, the CISO and other members of our executive leadership team discuss cybersecurity-related matters with the full Board at its scheduled meetings. Outside of scheduled meetings, management also periodically notifies or updates the Cybersecurity Committee or the Board, as appropriate, regarding certain types of cybersecurity incidents and matters.


text: Management is responsible for assessing and managing our material cybersecurity risks, practices and policies on a day-to-day basis.


text: Our CISO, who reports to the Chief Financial Officer, leads the Information Security Office and our cybersecurity program. Our CISO has worked in information technology and cybersecurity roles for more than three decades and has led our program since 2018. As part of his role, our CISO is responsible for communicating and coordinating cybersecurity-related matters with the Board and the Cybersecurity Committee (as discussed above) and our executive leadership team. For example, our CISO collaborates with the Chief Technology Officer and the Chief Legal Officer on cybersecurity measures throughout the organization and the CISO works with the Chief Product Officer in connection with the introduction or updating of security features for the Dynatrace platform and our services.


text: The Information Security Office is comprised of professionals who collectively have significant experience in a wide range of cybersecurity matters, including threat assessment and detection, incident response, and risk management. The Information Security Office works with Dynatrace's other business and corporate functions and keeps the CISO informed and updated regarding key cybersecurity-related matters in accordance with our internal reporting processes.


text: We have dedicated substantial resources to prevent and manage cybersecurity risk. We have administrative, technical, and physical security measures in place, as well as policies and procedures to require third parties to whom we transfer data to implement and maintain appropriate security measures. We proactively employ multiple methods at different layers of our systems which are designed to defend against intrusions and attacks and protect our data. We also consider the threats and challenges that we and other companies face as cybersecurity attacks grow in frequency and complexity.


text: Risk assessment and management - Our corporate and product security professionals assist in managing cybersecurity systems and in preventing, detecting, assessing, and resolving cybersecurity incidents. We build cybersecurity principles into our product development and system design, we have internal and external penetration testers who test our product platform and corporate systems, and we have a bug bounty program that can incentivize external security researchers who help us identify and fix bugs and vulnerabilities before they are exploited. Our internal audit team and our company's independent auditors periodically assess the effectiveness of certain of our cybersecurity-related controls. From time to time, we also engage external consultants and advisors to perform independent security testing and assessments and to assist with aspects of our cybersecurity program. We also utilize automated technology that alerts our security team of unusual activity in our corporate systems, product platform, and public-facing systems as well as automated security vulnerability scanning for our code base. As part of our processes, we require applicable internal approvals for changes to security-critical aspects of our product platform and services.


text: We assess the cyber risk of potential third-party service vendors, partners, and other service providers. We evaluate third parties before onboarding and periodically afterwards or if we detect a significant change in their cyber risk rating. We also perform security assessments on third-party code libraries before internal use. We categorize third parties in tiers based on the services that they provide to our company, the information and data that they have access to, and our overall assessment of the significance and risk of their operations to Dynatrace. We focus more detailed reviews and more frequent assessments on third parties that are in our highest tier.


text: Incident response planning - We have an incident response plan that sets forth a structured process and approach for how we assess, respond to, recover from, and remediate cybersecurity incidents. Under the plan, our CISO, the Information Security Office, and any incident response team that may be formed, work with our legal team, our privacy office, and any other applicable internal teams and external resources to address and communicate about incidents to key stakeholders, including the Board and its Cybersecurity Committee. As part of our incident response processes, we maintain disaster recovery plans and we prepare for any required external disclosures or reporting related to cybersecurity incidents. We review and test our incident response plan from time to time through tabletop exercises and other scenario planning to enhance management and Board preparedness in the event of a potential cybersecurity incident and to identify areas of continuous improvement. We believe that our planning and related processes, reviews, and testing help minimize the potential impacts to our company from cybersecurity incidents and help us recover from them as quickly as possible.


text: Training and education - We require employees and contractors to complete data protection and security awareness training in connection with onboarding and annually thereafter. These trainings cover a wide range of topics, including, but not limited to, ransomware, impersonation attacks, data handling and privacy, fraud, phishing, and identity theft. We conduct phishing simulation tests during the year to educate, train, and assess our employees' ability to identify malicious emails and employees who do not follow our protocol are provided with additional follow-up training. From time to time, we also require supplemental training depending on an individual's role or job responsibilities. Our CISO also periodically presents on cybersecurity matters at company-wide meetings and with individual business and corporate functions.


text: The Information Security Office is comprised of professionals who collectively have significant experience in a wide range of cybersecurity matters, including threat assessment and detection, incident response and secure software development, and risk management. The Information Security Office works with Dynatrace's other business and corporate functions and keeps the CISO informed and updated regarding key cybersecurity-related matters in accordance with our internal reporting processes.


text: In a highly competitive, regulated industry, where we are responsible for managing and securing confidential information, such as clinical trial results, clinical subject data, patient support program information, collaboration data, trade secrets and other confidential, non-public information, such as company plans and strategies, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of such information. Accordingly, the foundation of our cybersecurity program consists of appropriate governance and controls designed to assess, identify, and manage cyber risks, and is considered to be an important part of the Company's broader enterprise risk management program.

companyName: SpringWorks Therapeutics, Inc.


text: Responsibility for cybersecurity risk management is driven by Company leadership who are responsible for communicating the requirements for vigilance and compliance throughout the organization. The cybersecurity program is led by our Vice President of Information Technology ("VP of IT"), who reports to the Chief Financial Officer and has over 25 years of experience building, implementing and managing information systems, including the development and deployment of risk mitigation strategies for such systems. The VP of IT is a member of and works in conjunction with other leaders of the Company's Cyber Governance Committee, which is responsible for oversight of the Company's cybersecurity program. The Cyber Governance Committee comprises cross-functional members of management, and in addition to the VP of IT, includes the Company's Chief Compliance Officer, Chief of Staff, and Chief Accounting Officer. Together, these individuals meet periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.


text: Members of the Cyber Governance Committee provide quarterly updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reports to the Company's executive leadership team about the cyber program, including information about the status of ongoing efforts to enhance cybersecurity effectiveness. The Board of Directors also receives cybersecurity awareness training.


text: Our cybersecurity risk management program is informed by industry standards, intended to address the fundamental principles of information security. Our program leverages the expertise of third-party information technology providers and solutions, and includes periodic simulated attacks, penetration testing, third-party risk evaluations, and threat monitoring to identify, assess, and mitigate cybersecurity risks a formalized incident response and notification plan that establishes an organizational framework and guidelines to assist us in identifying, responding to, and recovering from cybersecurity incidents.


text: The Company performs assessments of certain third-party vendors prior to establishing a business relationship as part of our efforts to evaluate whether such vendors demonstrate appropriate commitments related to data security, availability, and confidentiality. This process is designed to be calibrated to the identified risk level associated with each vendor.


text: We also educate with our employees to raise awareness of cybersecurity threats and best practices. As part of our onboarding process, we train all new employees on cybersecurity and maintain an annual retraining for all employees on cybersecurity standards and best practices, such as how to recognize and respond to phishing and social engineering schemes, which is supported by periodic phishing testing and training. We also have additional specific and regular training for our IT professionals.


text: Responsibility for cybersecurity risk management is driven by Company leadership who are responsible for communicating the requirements for vigilance and compliance throughout the organization. The cybersecurity program is led by our Vice President of Information Technology, or VP of IT, who reports to the Chief Financial Officer and has over 25 years of experience building, implementing and managing information systems, including the development and deployment of risk mitigation strategies for such systems. The VP of IT is a member of and works in conjunction with other leaders of the Company's Cyber Governance Committee, which is responsible for oversight of the Company's cybersecurity program. The Cyber Governance Committee comprises cross-functional members of management, and in addition to the VP of IT, includes the Company's Chief Compliance Officer, Chief of Staff, VP, Corporate Counsel, and Chief Accounting Officer. Together, these individuals meet periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. This includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers and maintaining a cyber incident response plan designed to assist us in identifying, responding to and recovering from cybersecurity incidents. We utilize third parties to assess the effectiveness of our cybersecurity program on a periodic basis. This includes cybersecurity assessors and cybersecurity experts to assist in the identification, verification, and validation of material risks from cybersecurity threats, as well as to support associated mitigation plans when necessary.

companyName: Beneficient

ticker: BENF


text: We have integrated these cybersecurity processes into our overall risk management framework, systems, and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct a regular cybersecurity risk assessment process through our Chief Technology Officer and dedicated information security team which reports to our management-level information technology steering committee, which is a subset of our management-level enterprise risk committee. These committees meet at least quarterly to discuss and evaluate risks that could be material to our business, including cybersecurity threats. This management-level enterprise risk committee is comprised of key leadership across the Company, including our Chief Executive Officer, Chief Financial Officer, Chief Underwriting Officer, President & Chief Fiduciary Officer, and General Counsel.


text: As part of our overall risk management system, our dedicated information security team monitors and tests our cybersecurity policies and procedures through methods such as periodic reviews, targeted assessments, and tabletop exercises. All personnel are made aware of our cybersecurity policies and procedures upon hire and through periodic refresher trainings. Such policies and procedures cover areas such as identity and access management, vendor management, data governance and protection, vulnerability management, incident response, and operational risk management. Our cybersecurity policies and procedures are also incorporated into our broader risk management framework such that all enterprise and operational risks are evaluated in a holistic manner.


text: We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations, or financial condition based on information known to us as of the date of this Annual Report on Form 10-K. Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape. For additional description of cybersecurity risks and potential related impacts on the Company, refer to the risk factor captioned "Any cybersecurity attack or other security breach of our technology systems, or those of third-party vendors we rely on, could subject us to significant liability and harm our business operations and reputation" in "Item 1A. Risk Factors."


text: Our management is responsible for the day-to-day oversight and management of our enterprise risks, including risks from cybersecurity threats. As described in "Risk Management and Strategy" above, primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Technology Officer and dedicated information security team, who develop, prioritize, and execute our cybersecurity strategy in partnership with relevant departments and business units. Our Chief Technology Officer, who has over 20 years of information technology experience including cybersecurity and information security, oversees our cybersecurity framework and reports to our management-level information technology steering subcommittee and management-level enterprise risk management committee. Our Chief Technology Officer is assisted in this oversight role by additional members of management.


text: Our Board, as a whole and as assisted by Board-level Enterprise Risk Committee, has responsibility for the oversight of our cybersecurity risk management framework. Consistent with this approach, our Board and Enterprise Risk Committee maintain oversight of cybersecurity matters through discussions with management, question and answer sessions, and reports from the management team, which generally occur on a quarterly basis and ad hoc as needed. Such reports include updates on any cybersecurity incidents and mitigation efforts. Our Board and our Enterprise Risk Committee also receive regular and ad hoc reports from our management-level enterprise risk committee on all enterprise risks, including risks from cybersecurity threats. Our Audit Committee provides additional oversight on our cybersecurity risk management framework, with an emphasis on public reporting obligations and the effects cybersecurity risks could have on our financial condition generally.


text: We conduct a regular cybersecurity risk assessment process through our Chief Technology Officer and dedicated information security team which reports to our management-level information technology steering committee, which is a subset of our management-level enterprise risk committee. These committees meet at least quarterly to discuss and evaluate risks that could be material to our business, including cybersecurity threats. This management-level enterprise risk committee is comprised of key leadership across the Company, including our Chief Executive Officer or Interim Chief Executive Officer, Chief Financial Officer, Chief Underwriting Officer, President and Chief Fiduciary Officer, and General Counsel.


text: We continue to make significant investments in our information technology systems pursuant to our operations. We believe that these investments, including additional technology changes to implement our strategic plan, are essential to enhance our overall customer experience, to support our compliance, internal controls and efficiency initiatives, to expand our capabilities to offer new products, and to provide scale for future growth.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: The Company is actively engaged in identifying and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. The Company has an enterprise-wide Information Security Program ("Security Program "), which is designed to protect the confidentiality, integrity and availability of customer non-public information. The Security Program was also designed to protect our operations and assets through a continuous and comprehensive cybersecurity detection, protection and prevention program. This program includes an information security governance structure and related policies and procedures, security controls, protocols governing data and systems, monitoring processes, and processes to ensure that the information security programs of third-party service providers are adequate. Our Security Program also continuously promotes cybersecurity awareness and culture across the organization.


text: The Company also has a business continuity/disaster recovery plan (the "BCP "), which it actively manages to prepare for any business continuity challenges it may face. Our BCP provides for the resiliency and recovery of our operations and services to our customers. The plan is supported and complemented by a robust business continuity governance framework, a life safety program as well as an enterprise-wide annual exercise and training to keep the program and strategies effective, scalable and understood by all employees. We believe both the Security Program and BCP adhere to industry best practices and are subject to periodic testing and independent audits.


text: Cybersecurity Risk In 2018, the United States Securities and Exchange Commission (the "SEC") published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal laws and regulations. If we fail to observe this regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments where our customers are located.


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us.


text: The risks from cybersecurity threats are monitored and managed by the Company's information systems team members who have relevant expertise with such potential threats, and who operate in collaboration with other Company functions. The Company's Audit Committee is responsible for overseeing cybersecurity risk and is informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.


text: We strive to protect the reputation of our Company by establishing, protecting and defending our data and information systems in a number of ways through a combination of processes, tools, and awareness-building. We aim to adhere to the best practices outlined in the National Institute of Standards and Technology and International Organization for Standardization frameworks, and our policies and procedures in managing personally identifiable information are in compliance with General Data Protection Regulation requirements.

companyName: Perella Weinberg Partners

ticker: PWP


text: As part of our processes for assessing, identifying and managing material risks from cybersecurity threats, we maintain an ongoing process to enhance security and optimize our IT systems, and regularly conduct security assessments and testing of our systems to verify our systems' integrity to protect them against being compromised from both internal and external sources. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner. These efforts include using monitoring tools and services to address the confidentiality, integrity, and availability of our assets and data. Regular internal and third-party reviews are performed on our processes and technologies to help validate the effectiveness of our privacy and data security controls. These safeguards include employing firewalls, intrusion prevention and detection systems, and access controls, which are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive data. We prioritize a robust due diligence program for key third-party service providers, utilizing a comprehensive due diligence questionnaire to evaluate potential risks before establishing formal partnerships. This in-depth approach applies to all vendors with access to our sensitive systems or data. Ongoing assessments are customized based on each provider's risk profile, with heightened scrutiny applied to new engagements and high-risk relationships. Existing vendors are subject to periodic reevaluations according to a predetermined schedule, with increased frequency for those deemed higher risk.


text: Information technology risks and controls are regularly assessed as part of our overall self-assessment program, which includes working with a third party organization who regularly tests controls. Observations and outcomes from these self-assessments help drive our internal risk management decision making. Our management and compliance and information technology professionals, including our Chief Information Officer ("CIO"), are responsible for the maintenance and enforcement of our cybersecurity and information security policies and procedures. In addition members of the cybersecurity and information security teams maintain CISSP industry certifications. In addition, we have organizational charts in place to communicate key areas of authority, responsibility, and lines of reporting to personnel related to the design, implementation, operation, maintenance, and monitoring of our cybersecurity environment.


text: We also have a security incident response plan, with defined roles and responsibilities that are intended to address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency and have strategies, policies, and procedures in place that are designed to protect employee, business, and client data in the event of an emergency or natural disaster. In addition to identifying information security risks, we have established robust controls to seek to reduce or mitigate such risks. Cybersecurity training for employees is conducted regularly and we maintain system logs of user activities, exceptions, and security events for a period consistent with industry best practices, unless otherwise required by law, regulation or contractual obligation. We employ rigorous measures to appropriately handle and protect sensitive and confidential data, particularly in light of increased use of remote access technology. We take precautionary measures to minimize, to the extent possible, the use of personally identifiable information and the electronic or courier-based transmission of sensitive and confidential data, relying instead on approved and secured digital data transfer services, which are designed to provide tightly controlled and selective access to such information. We have mechanisms in place to help ensure that our data is secured when at-rest or in-transit, and industry standard encryption is used to the maximum extent possible. We also take steps to help ensure our ability to restore data in the event of data failure, corruption, accidental deletion, or malicious tampering.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Our business is subject to various cybersecurity and other operational risks" in Part I, Item 1A. "Risk Factors" for an additional description of cybersecurity risks and potential related impacts on the Company.


text: Our audit committee of the board of directors is responsible for overseeing the guidelines and policies governing the process by which the Company assesses and manages our exposure to risk, including cybersecurity risk, as well as any major litigation, regulatory, financial and reputational risk exposures and the steps management has taken to monitor and control such exposures. This oversight is achieved through a combination of periodic management reports, focused briefings on emerging cyber threats and vulnerabilities, updates on implemented mitigation strategies and periodic reviews of incident response plans.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our dedicated Information Security Team is responsible for identifying, assessing, detecting, and responding to any threats and vulnerabilities. The team routinely collects and processes information from a variety of sources, including from media reporting, commercial threat intelligence providers (FSARC, FS-ISAC), the Federal Bureau of Investigation and other government and law enforcement agencies. The team provides ongoing global mitigation of known cybersecurity threats to help ensure that our data and systems are protected.


text: As part of our processes for assessing, identifying and managing material risks from cybersecurity threats, we maintain a process to enhance security and optimize our IT systems, and regularly conduct security assessments and testing of our systems to verify our systems' integrity to protect them against being compromised from both internal and external sources. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner. These efforts include using monitoring tools and services to address the confidentiality, integrity, and availability of our assets and data. Regular internal and third-party reviews are performed on our processes and technologies to help validate the effectiveness of our privacy and data security controls. These safeguards include employing firewalls, intrusion prevention and detection systems, and access controls, which are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive data. We prioritize a robust due diligence program for key third-party service providers, utilizing a comprehensive due diligence questionnaire to evaluate potential risks before establishing formal partnerships. This in-depth approach applies to all vendors with access to our sensitive systems or data. Our assessments are customized based on each provider's risk profile, with heightened scrutiny applied to new engagements and high-risk relationships. Existing vendors are subject to periodic reevaluations according to a predetermined schedule, with increased frequency for those deemed higher risk.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our dedicated Information Security Team is responsible for identifying, assessing, detecting, and responding to any threats and vulnerabilities. The team routinely collects and processes information from a variety of sources, including from media reporting, commercial threat intelligence providers (FSARC, FS-ISAC), the Federal Bureau of Investigation and other government and law enforcement agencies. The team provides global mitigation of known cybersecurity threats to help ensure that our data and systems are protected.


text: As part of our overall Enterprise Risk Management strategy, we maintain a robust Information Technology and Security Management Program ("ITSM") which includes processes to assess, identify, monitor and manage cybersecurity risks. The program includes provisions for annual cybersecurity risk assessments, ongoing monitoring and testing, as well as annual training for employees, executives, and Board Members. We use the Federal Financial Institutions Examination Council's ("FFIEC") cybersecurity assessment tool to identify risks and ascertain cybersecurity preparedness and the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework to benchmark our internal policies and procedures against best practices. We engage consultants and auditors to assist in the completion of our annual risk assessment and review of controls related to the ITSM.

companyName: Provident Bancorp, Inc. /MD/


text: The Company also maintains a robust Vendor Risk Management program to manage risks related to third-party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments with respect to the appropriate safeguarding of sensitive information.


text: To date, there have been no cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, the Bank, our business strategy, results of operations, or financial condition.


text: The Board of Directors is responsible for overseeing the development, approval, implementation and maintenance of the ITSM, including overseeing the program's execution in accordance with the overall strategic goals of the Bank. The Board conducts oversight, in part, through the use of committees. The Risk Management Committee ("RMC") of the Board of Directors is charged with monitoring and reviewing risk assessments, assurance, testing, and training as well as overseeing the correction of identified deficiencies as they relate to the ITSM. The Company's Information Security team, with input from the Information Technology and Risk departments, is responsible for incident management, disaster recovery, business continuity and cybersecurity programs and policies. The Bank's Incident Response Manual and Cyber Incident Policy outline how potential cybersecurity threats or incidents are communicated to the RMC. The RMC is responsible for determining if cybersecurity incidents or threats should be escalated to the Board of Directors. The information security team and the RMC work together to mitigate cybersecurity threats or incidents.


text: The information security officer ("ISO") is responsible for cybersecurity under the ITSM and is a licensed Certified Internal Auditor, who has experience with the Massachusetts Division of Banks specializing in information technology examinations. The ISO reports directly to the VP, Operational Risk who was a former Chief Information Security Officer ("CISO") for the United States segment of a multi-national bank. The Chief Operating Officer, who is a member of the executive team and RMC, is a former CISO and holds both a Certified Fraud Examiner and Certified Information Security Manager certification. The Chair of the RMC of the Board also has multiple certifications in information and cybersecurity, including a Certified Information Systems Security Professional certification.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, or otherwise material to our business, including customer and client Personally Identifiable Information ("Information Systems and Data").

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Our security team, managed by our Chief Technology Officer ("CTO") and Senior Director, Information Security, helps identify, assess and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk acceptance register. Our security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools; conducting vulnerability scans; penetration tests conducted internally and by third parties; leveraging threat intelligence feeds; reports and services that identify cybersecurity threats; and working with third parties who conduct threat assessments of our platform and APIs.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response plans; vulnerability management plan; disaster recovery and business continuity plans; segregating and encrypting certain of our data; maintaining network security and access controls; asset management, tracking, and disposal; monitoring certain of our systems and network; penetration testing and tabletop exercises; cybersecurity insurance; having dedicated cybersecurity staff; and training our employees about certain cybersecurity risks and threats.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) the security team works with certain members of our senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provides periodic reports to the technology and audit committees of our board of directors, which evaluate our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, threat intelligence service providers, cybersecurity software providers, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as cloud data hosting services. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers, which may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. The program includes contractually obligating certain third-party service providers with access to Information Systems and Data to implement and maintain cybersecurity practices consistent with applicable legal requirements.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including (i) Real or perceived errors, failures, or bugs in our platform could adversely affect our operating results and growth prospects, (ii) Any security incident, including a distributed denial of service attack, ransomware attack, security breach or unauthorized data access could impair or incapacitate our information technology systems and delay or interrupt service to our clients and consumers, harm our reputation, or subject us to significant liability, and (iii) We are subject to industry standards, governmental laws, regulations and other legal obligations, particularly related to privacy, data protection and information security, and any actual or perceived failure to comply with such obligations could harm our business.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee and technology committee of our board of directors are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Technology Officer (CTO) and our Senior Director, Information Security. Our CTO has over 15 years of experience in engineering and development, including in leadership roles. Our Senior Director, Information Security has over 20 years of experience in information security, including similar roles leading Information Security teams at Ticketmaster, Sony Pictures, and Warner Bros.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our Senior Director, Information Security manages preparing for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management plans are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CTO, General Counsel and CEO. Our CTO, General Counsel and CEO work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management plans include reporting to the Audit Committee (who may consult with our technology committee) for certain cybersecurity incidents.


text: Our technology committee receives periodic reports from the CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors, our Audit Committee and our technology committees also have access to certain reports or presentations related to cybersecurity threats, risk and mitigation.


text: Our security team, managed by our Chief Technology Officer ("CTO") who works with a team of security professionals to help identify, assess and manage our cybersecurity threats and risks. Our security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools; conducting vulnerability scans; penetration tests conducted internally and by third parties; leveraging threat intelligence feeds; reports and services that identify cybersecurity threats; and working with third parties who conduct threat assessments of our platform and APIs.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data. We use third-party service providers to assist us from time to time with the identification, assessment, and management of material cybersecurity risks. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers, as well as other third-party suppliers and business partners, which may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our CTO and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provide periodic reports to the technology and audit committees of our board of directors, which evaluate our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee and technology committee of our board of directors are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our security team, led by our CTO. Our CTO has over 14 years of experience in engineering and development, including leadership roles. Other members of our security team collectively have over 50 years of experience in information security.


text: Our cybersecurity incident response and vulnerability management plans are designed to escalate certain cybersecurity incidents to members of leadership depending on the circumstances. In these situations, members of our leadership team work with our incident response team to help us evaluate, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management plans include reporting to the Audit Committee (who may consult with our technology committee) for certain cybersecurity incidents.


text: Our technology committee receives periodic reports from our security team concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Momentus Inc.

ticker: MNTS


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT controls, governance, risk and compliance reviews.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Data breaches or incidents involving our technology could damage our business, reputation and brand and substantially harm our business and results of operations." in Item 1A, "Risk Factors" of Part I of this report.


text: Our Audit Committee is responsible for overseeing cybersecurity risks and updates our Board of Directors on cybersecurity matters as needed. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified as promptly as practicable of significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of the company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Management is responsible for the day-to-day management of risks we face, while our board of directors, as a whole and through committees, has responsibility for the oversight of risk management. Our Security Committee oversees the management of risks from cybersecurity threats. As required, the full board reviews our major risk exposures, their potential impact on us, and the steps we take to manage them. Our Chief Security Officer (CSO) is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The CSO provides regular cybersecurity updates to the Chairman of the Board. Our Cyber Risk Advisory Committee oversees matters regarding the Company's Information Technology strategy, priorities, and governance, including cybersecurity threats and risk assessments.


text: We face significant and persistent cybersecurity risks due to: the scope of geographies, networks and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our Clients; and our use of third-party products, services and components.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing Clients with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our trading partners, our Clients, and our service providers and contractors can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Refer to Item 1A. Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks.


text: Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity and availability of this highly sensitive information seriously and invest significant time, effort and resources into protecting such information. Our cybersecurity strategy was designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, conducting continuous internal penetration tests, and leveraging multi-factor authentication to help effectively protect sensitive information and appropriate access rights. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to preserve the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews through the use of third party vendors who specialize in this subject matter. We have engaged our independent, internal audit team that reports directly to the Chair of the Audit Committee of our board of directors to audit our adherence to our cybersecurity policies. These audits help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: The Technology & Cyber Risk Committee of our board of directors (the "TCRC") is responsible for overseeing and reviewing our cybersecurity program and cybersecurity risk exposure and the steps taken to monitor and mitigate such exposure. The TCRC updates the full board of directors on cybersecurity matters periodically.


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, BRP & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: Our information security team for UCTS is led by our President of Digital Strategy & Innovation ("PDSI"), who also serves as our CISO for UCTS. Our PDSI/CISO reports to our President, BRP & CEO, Underwriting, Capacity and Technology Operations. Our PDSI/CISO has served in the role since 2022 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Crum & Forster, QBE North America, QBE FIRST, N.E.W. Customer Service Companies, Inc. and Wipro Technologies. Our PDSI/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our PDSI/CISO also attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: In addition, our management team has established an internal Cyber Steering Committee (the "Cyber SteerCo"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing us, including cybersecurity risks. Each of the CDIO/CISO and PDSI/CISO sit on the Cyber SteerCo along with the our General Counsel and former CISO.


text: Management is made aware of current and evolving cybersecurity risks through the Cyber SteerCo reporting. Furthermore, in the event of a material or potentially material cybersecurity event, senior members of management are promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.


text: We face significant and persistent cybersecurity risks due to: the scope of geographies, networks and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our clients; and our use of third-party products, services and components.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing clients with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our trading partners, our clients, and our service providers and contractors can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Refer to Item 1A. Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks.


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, conducting continuous internal penetration tests, and leveraging multi-factor authentication to help effectively protect sensitive information and appropriate access rights. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to preserve the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews through the use of third-party vendors who specialize in this subject matter. We have engaged our independent, internal audit team that reports directly to the Chair of the Audit Committee of our board of directors to audit our adherence to our cybersecurity policies. These audits help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, The Baldwin Group & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, Continuous Threat Exposure Management ("CTEM"), and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: Our information security team for UCTS is led by our Chief Technology Officer—UCTS ("CTO"), who also serves as our CISO for UCTS. Our CTO/CISO reports to our President, The Baldwin Group & CEO, Underwriting, Capacity and Technology Operations. Our CTO/CISO has served in the role since 2022 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams across various sectors, including financial services and travel management. Our CTO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CTO/CISO also attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.