text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our ERM program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.


text: Our SDIS, who holds a graduate degree in cybersecurity and several industry leading cybersecurity certifications, is the management position responsible for our overall information security program including strategy, security engineering, cyber threat detection, and response. The information security team managed by our SDIS contains certified cybersecurity professionals with broad experience and expertise in cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance, among other areas. The information security team continually evaluates our cybersecurity posture, which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) industry standard, and makes on-going investments in our networks, in addition to performing regular testing of our environment.

companyName: Regional Management Corp.

ticker: RM

secItem: Item 1C


text: In addition, we engage third-party consultants to conduct evaluations of the operational effectiveness of our security controls. These consultants perform penetration testing on our cybersecurity practices and procedures on an annual basis.


text: Third-party risk is assessed as part of our information security program and includes risk-tiered criteria for due diligence. Contractually, data handling third parties are required to uphold all applicable rules, laws, and regulations in addition to, when applicable, notifying us of cybersecurity events that may negatively impact us or our data.


text: We also require all employees to perform annual cybersecurity training. We expect our employees to follow our company-wide policies and procedures relating to cybersecurity matters, which include policies related to IT security, remote access, multifactor authentication, use of the internet and social media, and handling of confidential information, among other items. Additionally, while we have insurance coverage in place designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for information about our cybersecurity risks.


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management is included within our overall enterprise risk management program.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: We have implemented a risk-based cybersecurity program to identify, assess, prioritize and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity and availability of our information and operational technology systems and data stored on those systems. In general, we seek to address cybersecurity risks through a risk-based, cross-functional approach that is focused on preserving the confidentiality, security and availability of our information and information systems, and to mitigate and respond effectively to cybersecurity incidents and threats. As appropriate, the Company engages external parties, including consultants, legal counsel and audit firms to enhance its cybersecurity oversight and assist with incident response. Our cybersecurity program includes:


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and endpoint detection and response systems, regular monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Security Policy and Requirements We have an Information Security Policy that details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources, including third parties we engage.


text: Roadmap and Risk Assessment We have a cybersecurity roadmap that provides a framework for prioritizing and managing our ongoing cybersecurity program. We conduct periodic risk assessments based on the National Institute of Standards and Technology ("NIST") cybersecurity framework to identify and assess our cybersecurity risks, vulnerabilities and information security maturity assessments to evaluate the maturity stage of the overall cybersecurity program. The results of these assessments are reported to the Audit Committee of the Board, and we adjust our cybersecurity roadmap, policies, processes and practices as necessary based on the information provided by these assessments as well as the monitoring, testing and auditing noted below.


text: We have an established incident response and recovery plan based on the NIST cybersecurity framework. The plan specifies the process for identifying, classifying, documenting and responding to cybersecurity incidents, including escalation protocols to ensure the involvement of our executive leadership, including our CEO, CFO, CIO and General Counsel so that decisions regarding the public disclosure and reporting of any incident can be made by executive management in a timely manner.


text: We use a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We also obtain assurances from outsourced service providers regarding the sufficiency of their security procedures and, where appropriate, assess the protections employed by these third parties.


text: Monitoring, Testing and Auditing We monitor the evolving cybersecurity landscape that could result in new or increased cybersecurity threats. We also engage in the periodic assessment and testing of our policies, standards, processes and practices. These efforts include audits, vulnerability and penetration testing, tabletop exercises, social engineering campaigns and other internal and external assessments. We evaluate the effectiveness of our information technology-related internal controls annually.


text: Education and Awareness The Company regularly conducts mandatory cybersecurity training for its employees, and all new hires are required to take cybersecurity training when they receive their Company computer. Failure to complete the training in a timely fashion results in their system access being suspended until completion. Management also regularly conducts "phishing" exercises to test the effectiveness of our training programs. The results of these exercises are reported to the Audit Committee. Employees also receive monthly newsletters highlighting cybersecurity developments as well as targeted email messages, as appropriate.


text: The Company maintains cybersecurity insurance coverage in an amount that management believes to be appropriate for the Company's risk profile.


text: Audit Committee Oversight Our Audit Committee oversees the Company's cybersecurity risks. Ms. Dvorak has a certificate in Cybersecurity Oversight from the National Association of Corporate Directors and Mr. Burton is a technology expert with experience in online fraud and cybersecurity. Both Ms. Dvorak and Mr. Burton are members of our Audit Committee.


text: Our Senior Vice President and Chief Information Officer and our Vice President, Global Cybersecurity, update the Audit Committee regularly regarding the status of ongoing cybersecurity initiatives and strategies and incident reports. They also present information to the Audit Committee regarding management's cybersecurity risk and maturity assessments, including changes to our cybersecurity roadmap as a result of these assessments. This briefing is also posted to the full Board, which also receives quarterly updates through the Audit Committee. In accordance with the Company's policies and incident response plans, based on the severity of the incident, the Audit Committee is notified and briefed. The Board and executive management participate in cybersecurity training and conduct tabletop exercises on a periodic basis.


text: Management Oversight At a management level, our cybersecurity program is led by our Vice President, Global Cybersecurity who oversees a team with extensive knowledge and expertise. He is a Certified Information Security Professional and has over 20 years of cybersecurity experience and reports to our Chief Information Officer, who reports to our Chief Executive Officer. Our Vice President, Global Cybersecurity also chairs our Cybersecurity Management Committee which consists of senior business and functional leaders, including our Chief Information Officer and General Counsel. The Cybersecurity Management Committee is intended to provide cross-functional support for cybersecurity risk management.


text: Cyber Risks, Threats and Incidents As a global company servicing customers in over 100 countries, we experience a variety of cybersecurity events and incidents. However, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; though there can be no assurance that a cybersecurity incident that could have a material impact on us will not occur in the future. For further details regarding the cybersecurity risks and uncertainties we face see "Part I, Item 1A. Risk Factors -Technology and Cybersecurity Risks" of this report.


text: Our business operations and strategy are highly dependent on our ability, and the ability of certain third parties, to access internal and external systems and data to perform necessary business functions. We are heavily reliant on data and information, including non-public information, as well as technology systems that process and store such data and information, the integrity and functionality of which are critical to our ability to grow our business, operate efficiently, and generate earnings. As discussed in further detail in "Risk Factors" in Part I – Item 1A, and like others in the financial services industry, we have from time to time experienced, and are likely to continue to experience, security events and data incidents, and while none of these events to date have had a material adverse effect on our business, no assurances can be made that such attacks or security events will not have a material adverse impact on our business, results of operations or financial condition in the future, due to impairments in our ability to conduct our business or harm to our relationships with our business partners and customers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We have an enterprise-wide cybersecurity program that provides governance, direction and executive support for assessing, identifying and managing cybersecurity risks. Our cybersecurity program aligns with leading industry frameworks including the National Institute of Standards and Technology Cyber Security Framework and Control Objectives for Information and Related Technologies. Our cybersecurity program is designed to identify relevant assets and associated risks, protect against, detect, respond to and recover from cybersecurity events, and employs a "defense in depth" strategy that uses multiple security measures to protect the confidentiality, integrity, and availability of our systems and information assets. We continually assess our cybersecurity and threat detection capabilities, including our proficiency in identifying emerging tactics, techniques, and procedures of threat actors, to enhance our ability to focus resources appropriately.


text: Our cybersecurity program incorporates ongoing risk management practices such as risk identification and the maintenance of a cyber risk register, threat intelligence tracking, identification and monitoring of key controls using key performance indicators, the performance of independent control effectiveness testing by internal audit, annual third-party risk assessments, external penetration testing, and cyber incident response exercises. Our cybersecurity program also incorporates processes intended to help anticipate emerging technology innovation, utilizing a security capability map as a resource in combination with our cyber risk and enterprise risk assessment processes, to inform and prioritize investment decision-making in connection with the cybersecurity program. Additionally, we collaborate with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices, including for industry best practices for cybersecurity programs and capabilities, incident response processes, legal and regulatory developments, and experiential guidance. Our cybersecurity risk management activities are integrated in our overall enterprise risk management processes, so that cyber risks are assessed in the context of other risks relevant to our overall enterprise risk profile, to inform the organization's decision-making and planning processes.


text: We have a third-party risk management program that assesses the inherent risks of third-party service providers and informs our due diligence and continuous monitoring of such parties. Through this process, our information security personnel, in collaboration with our vendor management operations, evaluate the information security and business continuity capabilities, risks and controls, of prospective and existing service providers.


text: We manage cybersecurity incidents pursuant to a documented incident response plan executed by an incident response team consisting of senior leaders and their team members who are integral to effective incident response management, including but not limited to representatives from information security, legal, compliance, risk management, communications, facilities, operations, marketing and distribution, finance, and human resources, as well as external, nationally recognized legal and forensics resources who are familiar with our operations and incident response team, and who routinely participate in our tabletop training. We employ a formal incident escalation process based on the nature of the incident and its risk severity, for alerting and engaging with executive leadership and members of our Audit Committee and Board of Directors. The incident response plan includes processes integrated with our business continuity and emergency response plans.


text: Our Board of Directors monitors the major risks we face, including cybersecurity and operational risks, and reviews management's plans for mitigating or remediating such risks. The Board has designated the Audit Committee, which oversees controls for our major risk exposures, to have principal responsibility for monitoring management's cybersecurity risk management program and associated risks. The Audit Committee reviews management's overall approach to managing and mitigating our exposure to cybersecurity and privacy risks, and reviews information technology's program to monitor and assess information security and the related efforts associated with cybersecurity, considering, among other things, emerging cybersecurity developments and threats. Our Chief Information Security Officer ("CISO") and Chief Information and Innovation Officer ("CIIO") provide regular reports and update briefings on cybersecurity matters to the Audit Committee. The topics covered by these briefings routinely include a review of top cybersecurity threats and exploits, a review of the recurring internal risk assessments and annual cyber risk assessment performed by third parties, key updates to the cyber risk management program, cybersecurity risk-mitigating controls, strategic planning considerations, security and infrastructure investments, regulatory and compliance updates, and cybersecurity incident updates, among other topics.


text: Our CISO has primary responsibility for our cybersecurity program and the management and oversight of our information security department. Our CISO has nearly 25 years of experience in information technology, including 14 years of cybersecurity experience, all of which has been in the property and casualty insurance industry. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification. Our CISO reports directly to our CIIO, who reports directly to our Chief Executive Officer ("CEO"). The CISO and CIIO routinely inform and advise executive management of salient aspects of our cybersecurity program, and developments related to key risks, threats and data incidents, addressing in further detail the matters noted above that are reported to the Audit Committee. Members of the information security team participate in our Enterprise Risk Management Group consisting of senior leaders who meet regularly to assess new and emerging risks to the organization, including cybersecurity risks.


text: Berkshire recognizes that maintaining processes for identifying, assessing, and managing cybersecurity threats is important in dealing with its significant business risks. As such, Berkshire has implemented a framework for cybersecurity and cyber-related information management across Berkshire's diverse groups of businesses. The framework permits each Berkshire Business Group ("Business Group") to tailor solutions to identify, manage, and mitigate risks based on their own assessment of their unique cybersecurity risks in conjunction with each Business Group's overall risk management processes. At the same time, the framework helps enable consistent and appropriate compliance in reporting material cyber events and risks across Berkshire.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: Each Business Group's Chief Information Security Officer ("CISO") on at least an annual basis is to provide a report to the Business Group's senior management, regarding the state of their cybersecurity program and its material cyber risks. These reports are also shared with Berkshire's internal audit group to inform and enhance the overall company's risk management processes. In addition, each Business Group is required to maintain an incident reporting process to report significant cybersecurity events to Berkshire. Berkshire and its Business Groups engage and partner with a wide range of third parties to assess, audit, educate, implement, operate, protect, and remediate various cybersecurity related elements.


text: Berkshire and its Business Groups rely on third-party service providers for a variety of products and services to run their information systems. This dependence exposes Berkshire and the Business Groups, along with others who use these service providers, to the impact of a cyber-attack on their service providers. On occasion, a cyber-attack at a third party service provider could have a significant financial, operational or reputational impact to Berkshire. Berkshire and its Business Groups continuously monitor the risks associated with its service providers.


text: The Audit Committee of Berkshire's Board of Directors has responsibility for oversight of Berkshire's cybersecurity risk management program. The Audit Committee receives periodic reports regarding the number of and impact from cybersecurity incidents reported through Berkshire's cybersecurity incident reporting process. Additionally, the Audit Committee is updated on cybersecurity trends and related issues. Furthermore, the Audit Committee approves and receives updates on the workplan performed by Berkshire's internal audit group that focuses on information technology and cybersecurity risks. This includes audit procedures related to internal and external penetration testing, attack simulations, vulnerability assessments, cybersecurity program reviews and other audits designed to investigate specific risks. The frequency of these updates is determined by the Audit Committee in conjunction with Berkshire's senior management. In addition to the Audit Committee's oversight, the senior management of Berkshire's Businesses Groups are responsible for the day-to-day operations of protecting their businesses' information systems. Each Business Group is required to report significant cybersecurity events to Berkshire. Berkshire's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.


text: The Company's entire Board of Directors is engaged in risk management oversight, including the oversight of risks from cybersecurity threats. The Audit Committee assists the Board of Directors in its oversight of Domino's company-wide risk management and the process established to identify, assess, measure, monitor and manage risks, including major information security and cybersecurity risks, with input from the Company's internal committee dedicated to assessing and managing enterprise risk comprised of Company executives in addition to other senior leaders within the Company (the "Enterprise Risk Committee").

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Cybersecurity and related matters are a recurring topic at meetings of the Audit Committee and the Company's Executive Vice President and Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") provide the Audit Committee with an update on the Company's cybersecurity risk profile and strategy at multiple Audit Committee meetings each year. These updates include both qualitative and quantitative information on the effectiveness of the Company's cybersecurity controls.


text: At an operational level, the Company's cybersecurity strategy is shaped by its CISO who is ultimately responsible for implementing the Company's cybersecurity policies, procedures and strategy under the oversight of the Enterprise Risk Committee. The Company's CISO regularly provides updates to the Enterprise Risk Committee at relevant meetings and provides additional updates to the Company's Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and CTO on a regular basis in between the meetings of the Enterprise Risk Committee. Such updates are designed to ensure the Enterprise Risk Committee and Company executives remain informed about and are able to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's CISO has multiple decades of experience in the cybersecurity and information security fields with relevant experience supplemented by undergraduate and post-graduate degrees in information technology and security and completion of additional related executive education, along with holding several industry-recognized cybersecurity certifications. The Company's CTO supplements the expertise and experience of the CISO.


text: Under the oversight of the Enterprise Risk Committee, relevant information regarding the Company's cybersecurity profile and any cybersecurity threats or incidents is then communicated during the regular updates to the Audit Committee in a process designed to ensure the Board of Directors and Audit Committee maintains appropriate oversight of the Company's cybersecurity strategy and risk profile.


text: Cybersecurity is a key component of the Company's overall risk management system, and the Company believes it has implemented robust processes that are designed to effectively manage risks from cybersecurity threats. In addition to maintaining insurance coverage to address cyber incidents, the Company has also implemented processes, procedures and controls to help mitigate these risks. Domino's cybersecurity program is embedded into the Company's enterprise risk management framework from both a resource allocation and strategic initiative perspective and is supported by an extensive catalog of layered security controls that are designed to prevent and detect internal and external security threats and safeguard privacy and personal data of customers, team members, franchisees and other business partners. Domino's maintains this comprehensive information security program with a dedicated team that is responsible for directing, coordinating, planning and organizing information security activities throughout the Company and is led by the Company's CISO.


text: The Company leverages a combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Critical Security Controls as the scale against which to assess its information security program and invest in its ability to proactively defend against security risks within its environment. Domino's conducts annual risk assessments, both internally and through the use of third parties, to evaluate the effectiveness of its security controls and identify new threats and vulnerabilities and appropriate controls to mitigate risks and supplements these regular assessments with ongoing monitoring. Additionally, Domino's participates in ongoing and periodic assessments of its external platform and applications to include running a responsible disclosure program to ensure that vulnerabilities that are discovered can be reported and appropriately remediated. Domino's has been certified as compliant with the Payment Card Industry Data Security Standard ("PCI DSS") standards and has several dedicated teams of specialists within its information security department that routinely conduct internal and external vulnerability and penetration assessments in accordance with both PCI DSS and industry accepted practices. This team keeps the Company's management informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents and leads the Company's processes to oversee and identify risks from cybersecurity threats associated with the Company's use of its third-party service providers. The Company additionally has established and maintains a dedicated Security Operations Center (SOC) team that is responsible for quickly identifying and treating events that could pose risk to its technology environments and that has a documented incident response plan in place, which is periodically tested, reviewed and updated as appropriate. The Company trains its team members through annual cybersecurity awareness training, phishing simulations and periodic communications about timely cybersecurity topics and threats.


text: The Company, its vendors and service providers and their respective vendors and service providers face various security threats on a regular basis, including ongoing cybersecurity threats to and attacks on its and their information technology infrastructure that are intended to gain access to the Company's proprietary information, destroy or modify data or disable, degrade or sabotage systems. Cyber incident techniques change frequently, may not immediately be recognized and can originate from a wide variety of sources, including as part of the supply-chain of software and computer code that supports the software and systems on which the Company and such parties rely. There has been an increase in the frequency, sophistication and ingenuity of the data security threats the Company and these vendors and service providers face, with attacks ranging from those common to businesses generally to those that are more advanced and persistent.


text: While the Company does not believe that any risks from cybersecurity threats (as defined in Item 106 of Regulation S-K), including as a result of any previous cybersecurity incidents, have to-date materially affected the Company, including its business strategy, results of operations or financial condition, the occurrence of cybersecurity incidents, or a deficiency in cybersecurity, could negatively impact the Company's business by causing a disruption to its operations, a compromise or corruption of confidential information, or damage to the Company's employee and business relationships, any of which could have adverse effects on the Company's results of operations, financial condition and cash flow and harm its brand. The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by others, including by the Company's service providers. See "Risk Factors – The occurrence of cyber incidents, or a deficiency in cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of confidential information, or damage to our employee and business relationships, any of which could subject us to loss and harm our brand" for further information.


text: Cyber Risk Management and Strategy We have processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties, including a contracted information technology consultant who is dedicated to our organization, to enhance our cybersecurity oversight.

companyName: PepGen Inc.

ticker: PEPG


text: In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also require annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors-Risks Related to Employee Matters, Managing Growth and Other Operational Matters -Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, or trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results."


text: Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management and our contracted information technology consultant regarding cybersecurity matters. We have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Chief Financial Officer, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the Chief Financial Officer as well as to other executive management, including our General Counsel, on cyber matters, as appropriate.


text: Our business depends on our continued ability to collect and safeguard vast amounts of personal and sensitive business information, including, among other types of data, protected health information (PHI), employee information, credit card information, insurance information, proprietary and confidential information about our business, financial information, trade secrets, intellectual property, and the sensitive and confidential information from the third parties with whom we work. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and hardware and software, to safeguard and prevent unauthorized access to this critical data (collectively Information Systems and Data).

companyName: Tempus AI, Inc.

ticker: TEM


text: Our Chief Technology Officer, or CTO, and our Chief Information Security Officer, or CISO, together with our Enterprise Risk Management Committee help identify, assess, and manage the Company's cybersecurity threats and risks. Working with a cross-functional team, these individuals and our Enterprise Risk Management Committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, using external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Our Information Security program has six broad components: Controls & Compliance; Security Operations; Cloud Security; Identity and Access Management; Application Security; and Data Governance. Within each program component, and depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining a vulnerability management policy and disaster recovery/business continuity plans, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, a vendor risk management program, a dedicated cybersecurity staff/officer, active monitoring, detection, prevention, mitigation, and remediation strategies to ensure we are adequately safeguarding and protecting our critical information, routinely conducting audits, vulnerability scans, penetration tests, social engineering simulations, security awareness training, and threat intelligence assessments to ensure that our systems, policies, and procedures are operating as intended. We also engage with a range of external experts to help us evaluate and attest to our risk management systems, including maintaining a certification pursuant to ISO 27001 and conducting periodic third-party audits to maintain our certification.


text: In addition, we maintain a detailed Incident Response Plan to assist in responding to potential cybersecurity threats. Our Incident Response Plan addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies to prevent future incidents. Our Information Security and Privacy Teams conduct tabletop exercises twice per year to ensure preparedness for information security, including cybersecurity incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing and social engineering simulations. We also maintain cybersecurity insurance coverage.


text: Our Privacy program is designed to support and enhance our Cybersecurity program. We perform an annual HIPAA Security Risk Assessment, among other things, to help identify remediation priorities and to ensure we have implemented best practices in storing and safeguarding PHI.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Enterprise Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We frequently collaborate with other third-party service providers to conduct regular audits, threat assessments, and consultation on cybersecurity strategy, enhancements, and best practices. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and cloud infrastructure providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, review of the vendor's written security program, review of security assessments, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K, including "Cyber-based attacks, security breaches, loss of data and other disruptions in relation to our information systems and computer networks could compromise sensitive information related to our business, prevent us from accessing it and expose us to substantial liability, which could adversely affect our business and reputation."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes as well as our Information Security program are implemented and maintained by certain Company management, including our CTO and our CISO, who have 25 years of experience in cybersecurity and IT Operations respectively. Our CTO and CISO collaborate with a cross-functional team of seasoned professionals responsible for maintaining, improving, and promoting our Information Security program. In addition to the oversight by our Technology and Security leaders, representatives from our Information Technology, Legal, Privacy, Finance, Regulatory, Quality, and Compliance teams are integral to the successful implementation of our overall Information Security program.


text: The CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO and CTO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's Incident Response Plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Our CISO reports to the full Board of Directors quarterly, or more frequently as needed. These reports generally address each of the six components of our Information Security program, including the Company's progress on initiatives we have prioritized for the quarter. Our Audit Committee has general oversight responsibility for our data security practices, and we believe the Committee has the requisite skills and visibility into the risk profile of our Company to fulfill this responsibility effectively. Our CTO, CISO, or other members of our Enterprise Risk Management Committee report to the Audit Committee quarterly or on an as-needed basis.


text: Senior members of our management are responsible for assisting our CTO and CISO in managing cybersecurity risk. We maintain a cross-functional Enterprise Risk Management Committee, which meets monthly to identify, assess, mitigate, and remediate risks impacting the Company, including cybersecurity risks. Members of this committee include our CISO, CTO, Chief Financial Officer, Chief Privacy Officer, General Counsel, Chief Commercial Officer, Chief Scientific Officer, Chief Medical Officer, Chief Legal Officer, and the heads of our Regulatory and Quality teams. The Enterprise Risk Management Committee informs members of the Audit Committee regarding the overall enterprise risks identified by management, progress on remediation efforts identified in the prior quarter, and risk mitigation priorities for the forthcoming quarter.


text: As a global technology company, and the provider of electronic trading platforms and solutions for fixed-income and other securities, we view cybersecurity as fundamental to our business. Accordingly, we aim to appropriately secure all of our business operations, including information that we generate in the performance of our services, and data provided to us by third parties, including clients, vendors, business partners and employees.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and manage the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security and cybersecurity team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization ("ISO") and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains policies and procedures relating to our data collection, use and processing activities, as well as mechanisms for monitoring our data systems and usage. We do not have individual retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws in the countries in which we operate, including the GDPR, the U.K. Data Protection regime and the California Consumer Privacy Act (the "CCPA"). • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats in order to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use and storage of data.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported, as appropriate, to the Risk Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company, including our business strategy, results of operations, or financial condition, in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."


text: The Board's Oversight of Cybersecurity Risk The Board recognizes the critical importance of maintaining the trust and confidence of our clients, business partners and employees. The Board is actively involved in oversight of the Company's ERRF, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Board is responsible for overseeing the Company's risk management processes over the short-, medium- and long-term by staying informed of the Company's material risks and evaluating whether management has reasonable controls in place to address such material risks. As part of its oversight responsibilities, the Board dedicates meaningful time and attention to oversight of cybersecurity risk. The Board is not responsible, however, for defining or managing the Company's various risks. See "Management's Involvement in Cybersecurity Risk Oversight" below.


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional updates as needed, on cybersecurity matters. Such updates address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, external threat intelligence, technological trends and cybersecurity considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Steering Committee, which includes our CEO, CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.


text: The CISO holds undergraduate and masters' degrees in computer science and cybersecurity, respectively, and has served in various senior roles in information technology and information security for over 20 years, including previously serving as the Chief Information Security Officer of a major global asset manager. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). The CIO holds undergraduate and masters' degrees in computer science and has served in various roles in information technology for over 30 years. The Company's CRO holds an undergraduate degree and has over 30 years of experience managing risks, including risks arising from cybersecurity threats.


text: The Company is ISO/IEC 27001:2013 certified, which is a global standard that specifies the requirements for establishing, implementing, maintaining, and continually improving information security management systems. Additionally, we have received an independent examination regarding our compliance with SOC 2 Type 1 and Type 2.


text: To effectively identify, assess and manage risks from cybersecurity threats, the Company maintains a cybersecurity and cyber risk management program which is comprised of the Company-wide cybersecurity strategy and its supporting policies, processes and architecture. This program is part of the Company's enterprise risk management program.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Risk Management Strategy The Director of Information Technology, who reports to the Chief Financial Officer, has extensive information technology ("IT") and cybersecurity knowledge and skills gained from over 15 years of relevant work experience at the Company, and is responsible for leading the Company's cybersecurity and cyber risk management program which includes certain cybersecurity processes covering the Company's corporate systems. These processes include, among other items, the Company's information technology and risk management departments' use of an internal set of applications and control activities to actively monitor potential threats to its corporate IT environment and regularly conduct internal testing to identify potential vulnerabilities to the Company's corporate information technology infrastructure and systems. These activities include, but are not limited to, continuous monitoring of network and infrastructure vulnerabilities, automated patching and software updates, redundancy and back-up systems, and incident response planning and handling. The Company's employees are required to report cybersecurity events, including suspicious activity or emails, to the Company's information technology department. Should a cybersecurity event occur within its corporate systems, the Company is positioned to coordinate a swift response to mitigate impacts to its information technology infrastructure and systems. The Company has in place an incident response plan which provides guidance for leadership and employees to swiftly evaluate and respond to cybersecurity incidents. The Company also carries cybersecurity insurance to further mitigate certain potential losses from a cybersecurity incident affecting its corporate IT equipment and systems.


text: The Company's cybersecurity processes also include self-assessments using industry benchmarks as well as input from external industry consultants and ongoing communication with third-party business partners to identify cybersecurity incidents and threats that could potentially impact the Company. The Company has relationships with a number of third-party business partners to assist with cybersecurity incident containment and recovery efforts and assesses the processes and tools used by its third-party business partners to manage their cybersecurity risks. The Company uses a risk-based approach with respect to its use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of network connectivity or of data accessed, processed, or stored by such third-party service provider.


text: The Company's corporate IT systems are not used to process business transactions with its guests and those systems currently have no connectivity to hotel and/or third-party management and brand technology platforms. The Company's information technology and risk management departments regularly engage with its third-party management companies and brands to understand and benchmark their execution and alignment with applicable policies and industry practices for data protection and cybersecurity.


text: The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging cyber threat landscape. The Audit Committee also receives updates on cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to promptly report incidents to the Chief Financial Officer in accordance with the Company's incident response plan. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. While the Company is not aware of any cybersecurity incidents that have materially affected its business as of December 31, 2024, there can be no guarantee that the Company will not be the subject of future attacks, threats or incidents, that may have a material impact on its business strategy, results of operations or financial condition. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees the Company's cybersecurity risk profile, including risks from cybersecurity threats, and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company, and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Company's CIO has been and continues to be responsible for Global IT, including overseeing cybersecurity and its digital strategy. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at Rogers Corporation, a global high tech manufacturing company, as well as other global manufacturing companies.


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as the Audit Committee, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Audit Committee at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. Our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, which includes disaster recovery, are designed to deliver resilience and comply with several regulatory requirements including DFARS/NIST 800-171 controls. For our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal or destroy data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an IT steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, CISO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.


text: As of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents since the ransomware incident in the fourth quarter of fiscal 2019 described under "Our operations are subject to cyberattacks that could have a material adverse effect on our business" in Part I, Item 1A of this Report, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks, and there can be no guarantees that such attacks will not occur in the future.


text: Saia maintains cybersecurity processes, technologies and controls to help us assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of Saia's overall enterprise risk management process. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats.

companyName: SAIA INC

ticker: SAIA


text: We regularly perform evaluations of our information security program and our information technology infrastructure, including through the use of tools and services for network and endpoint monitoring, vulnerability assessments and penetration testing, among other things. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have an incident response program to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Saia contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We consider cybersecurity matters when selecting and overseeing our third party service providers and we administer a standardized information gathering questionnaire to evaluate cybersecurity risk in third parties. We seek to require third parties who could pose significant cybersecurity risk to us to be contractually responsible for the risk and to agree to cybersecurity assessments in connection with new vendor engagements and annually thereafter.


text: Saia has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation. The annual cybersecurity training consists of threat avoidance when working remote, proper password construction techniques, identifying and reporting suspicious activity, social engineering and insider threats. Additionally, we have implemented a regular phishing assessment that provides feedback and additional training as needed to enhance the annual training program. Our information technology professionals also receive additional training related to their position.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" and "We use AI in our business, and its use could result in reputational harm, competitive harm, cybersecurity risks and legal liability, which could have a material adverse effect on our results of operations" in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Saia's Director of Information Security and Compliance, who reports to the Executive Vice President and Chief Information Officer, has primary oversight of our cybersecurity risk management and strategy processes. The Director of Information Security and Compliance has served in information security roles since 2001 and led the information security function for a large health care system prior to joining Saia. He has a Bachelor of Science degree in Information Technology with a Concentration in Information Assurance and Security.


text: The Director of Information Security and Compliance assesses our cybersecurity readiness through internal assessment tools as well as third-party control testing, vulnerability assessments and evaluation against industry standards. We maintain compliance structures that are designed to elevate issues relating to cybersecurity to our Director of Information Security and Compliance and to our Executive Vice President and Chief Information Officer.


text: The Board of Directors has oversight responsibility for Saia's strategic and operational risks. Although the Board has delegated oversight responsibility for certain risks to its committees, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board regularly receives reports from the Executive Vice President and Chief Information Officer concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: Our business and industry has become increasingly dependent upon digital technologies, including information and operational systems and related infrastructure as well as cloud applications and services, to process and record financial and operating data; analyze seismic, drilling, completion and production information; manage production equipment; conduct reservoir modeling and reserves estimation; communicate with employees and business associates; perform compliance reporting and many other activities. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has an Insider Threat and Data Loss Prevention program that is designed to protect the confidentiality, integrity and availability of such data, and we maintain processes designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: CONTINENTAL RESOURCES, INC


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors. Our CISO has received certifications relating to information security, security leadership, and forensics from the Global Information Assurance organization.


text: The Cybersecurity Team monitors the cybersecurity environment for threats and indicators of compromise. It also considers the risks attendant to the Company's business operations and strategy and develops solutions and mitigation measures for the risks identified, including risks arising in connection with third-party interactions and the integration of newly acquired assets. In addition, the Company invests in Security Awareness training to help promote employee awareness of cybersecurity.


text: The Company's internal cybersecurity efforts are supported by a team of outside consultants, assessors, and third-party vendors who assist with identifying and monitoring risks and indications of compromise.


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engage s a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.


text: The Cybersecurity Team engages third-party vendors to assist with managing endpoint security, managing the Company's security operations center, providing threat detection and response capabilities, monitoring certain operational technology and control system environments, and providing threat detection and vulnerability identification and remediation services. Additionally, the Company is a member of the Oil and Natural Gas Information and Analysis Center. This center provides the Company with information regarding threats to the oil and gas industry and threats reported by other industry participants. Finally, the Cybersecurity Team periodically engages with the cybersecurity-related guidance of other third parties such as law enforcement, industry trade groups and vendors.


text: The Cybersecurity Team reviews the integrity of services provided by vendors engaged to support the Company's cybersecurity efforts using the same methods as are used to evaluate the services provided by other vendors engaged to support the Company's regular business operations.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; and the Director of Corporate Security. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.


text: In addition, the CISO periodically briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.


text: The Company has developed a Cybersecurity Incident Response Plan (the "Response Plan"), which is based upon NASA's mission control incident response procedures to address and manage certain cybersecurity incidents. If an incident meets certain criteria, the incident response plan is invoked by the CISO and General Counsel. Once the plan is invoked, an impact assessment is conducted and a remediation plan is developed, if needed. The plan also sets forth procedures for monitoring incidents and post-incident follow-up so that any lessons learned can be discussed. Where appropriate, the post-incident follow up identifies measures that can be implemented to aid with future incident prevention and detection. Under the Response Plan any incident-related information is communicated using the channels outlined in the Response Plan.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, the Company does not believe any prior cybersecurity threat or incident has materially affected or are reasonably likely to materially affect the Company, including its business operations or prospects. However, the Company acknowledges that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For additional information about the risks to our business associated with cybersecurity incidents, please see "A cybersecurity incident could result in information theft, data corruption, operational disruption, and/or financial loss" under Part I, Item IA. Risk Factors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Aimco OP L.P.


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. These and other risks related to cybersecurity matters are described in more detail in Item 1A. Risk Factors.


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our CIO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 25 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.


text: The Company has systems and processes for identification, assessment, and management of material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company's multi-faceted approach includes deploying applications and control activities to actively monitor and mitigate potential threats to the Company's IT environment.

companyName: TREX CO INC

ticker: TREX


text: These activities include, but are not limited to, engaging an external third-party to monitor information systems security events, conducting annual security training of employees, testing employees via periodic phishing campaigns, conducting system vulnerability scanning, utilizing a patching program to remediate critical patches, and utilizing an external third-party to perform testing to identify gaps in the Company's security program. The Company also performs third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. Additionally, for providers of software-as-a-service and other services that hold Company data, the Company reviews and assesses industry standard certifications such as System and Organization Controls (SOC) 1 or SOC 2 reports and cybersecurity preparedness questionnaires. Mitigation of risk efforts are coordinated by the Company's Director of Information Security, utilizing internal resources and third-party providers.


text: The Company has not had any cybersecurity risks that have materially affected the Company, including its business strategy, results of operations, or financial condition. Cybersecurity risks are disclosed in Part I Item 1A. Risk Factors, incorporated herein by reference.


text: Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are overseen by our Vice President and Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Director of Information Security, a direct report to the Vice President and Chief Information Officer. Our Vice President and Chief Information Officer has 27 years of technology leadership experience and a Doctor of Business Administration. Our Director of Information Security has 27 years of experience in infrastructure and security operations and a degree in Information Technology Management. Our Director of Information Security is the chair of the Company's Information Security Committee. The activities of the Information Security Committee are reviewed by the Executive Information Security Oversight Committee, which is comprised of members of our senior leadership team including our Vice President and Chief Information Officer, Senior Vice President, Chief Financial Officer, Senior Vice President, Chief Legal Officer and Secretary and Senior Vice President, Chief Human Resources Officer. The Executive Information Security Oversight Committee facilitates notification to the Audit Committee of emerging cybersecurity risks, and threats, the status of projects to strengthen the Company's information security systems, and updates on any cybersecurity incidents.


text: The Audit Committee of the Board of Directors oversees cybersecurity related risks. Members of the Audit Committee receive the above referenced notifications and updates on a quarterly basis from the Company's Chief Information Officer as the designated representative of the Executive Information Security Oversight Committee.


text: Additionally, the Company has a written Information Security Policy and a Cybersecurity Incident Response Plan that provides the above-referenced processes by which such committees are informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and material risks from cybersecurity threats.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, patient data, and data related to our clinical trials ("Information Systems and Data").

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Company's information security function and third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk assessment process. The Company's information security function and third-party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: • automated tools; • subscribing to reports and services that identify cybersecurity threats; • analyzing reports of threats and actors; • conducting scans of the threat environment; • evaluating our and our industry's risk profile; • evaluating threats reported to us; • conducting audits; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments to identify vulnerabilities; and • using external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our incident response plan; • incident detection and response processes; • a disaster recovery/business continuity plan; • encryption of certain data; • network security controls; • access controls; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • outsourced cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's information security function works with management, including our Chief Operating Officer ("COO") to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: • our external IT service provider; • professional services firms, including legal counsel; • cybersecurity consultants; • managed cybersecurity service providers; and • penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence involves different levels of assessment designed to help identify cybersecurity risks associated with a provider. For example, we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our COO.


text: The COO is responsible for managing our information security function and overseeing our third-party information technology service providers. The COO is also responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our outsourced Chief Technology Officer, who has over 20 years in executive-level IT and cybersecurity roles, is responsible for developing and implementing our technology environment and cybersecurity framework, helping the Company prepare for cybersecurity incidents, approving and implementing certain cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the COO and Chief Financial Officer ("CFO"). The COO and CFO work with the other members of the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company will report to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic updates from the CFO and finance department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various updates, summaries or presentations related to cybersecurity threats, risk and mitigation.