text: Oversight and Governance The Company's Board of Directors is charged with overseeing and approving Union's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Union's Information Security Officer (ISO) provides periodic updates regarding cybersecurity risks and the cybersecurity program to the Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Company's Board of Directors on a regular basis. Consistent with this responsibility the Board has delegated primary oversight responsibility over the risk management framework and oversight of the cybersecurity program, including oversight of cybersecurity risk and cybersecurity risk management, to Union's IT Steering Committee.


text: Union's IT Steering Committee has representation from the following departments: information technology, information security, other department leaders and stakeholders, and Union's senior management team. This Committee receives regular updates on the state of Union's cybersecurity program, including any incidents, as well as approving information technology or information security related projects and proposals. These team members are also responsible for the resolution of any findings and implementation of recommendations from internal and external audits and examinations.

companyName: UNION BANKSHARES INC

ticker: UNB

secItem: Item 1C


text: Union's ISO is responsible for implementing and maintaining the cybersecurity program with support from Union's Information Security team. The Information Security team consists of Union's ISO, members of the risk and compliance department, security staff, and information technology members, all of whom collaboratively work together to manage cybersecurity risks. The ISO reports directly to Union's Senior Risk Officer.


text: The program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner.


text: Our Information Security team, led by our ISO, is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. The Information Security team works collaboratively across the Company to understand the potential impacts of a cybersecurity incident and prioritize mitigation and other measures based on, among other things, the materiality to our business. The Information Security team has established processes designed to monitor threats in the cybersecurity landscape which include interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending industry specific security conferences and trainings. The team regularly monitors our internal network and customer-facing network to identify any security issues. In addition, the Company augments the team's monitoring via the engagement of external vendors who provide continuous threat monitoring services of the Company's environment.


text: As part of our assessment of the risks to our Company, the Information Security team conducts annual cybersecurity risk assessments to evaluate the inherent risk of our applications and the strength of our controls, and identify the residual risk for each application. In addition, we conduct regular reviews and testing of critical network and application systems to monitor their security. We have adopted internal Company-wide Information Technology and Information Security policies which are reviewed and updated annually and approved by our Board of Directors. Our employees and the Board of Directors attend annual trainings that are designed to raise awareness about cybersecurity threats, reduce our vulnerability, and encourage consideration of cybersecurity threats across the Company. Additional trainings are required for employees in certain roles; these additional trainings are tailored to the employees' specific duties.


text: We regularly review and update our investments in information technology security to identify and protect critical assets, provide monitoring and alerts, and, as needed, engage third-party experts. To assess the effectiveness of our program, we have engaged consultants to conduct penetration testing and other vulnerability assessments. Additionally, our Internal Audit department and external auditors conduct assessments of different systems to provide the Audit Committee with information on our risk management processes, including cybersecurity risk management. We also test our defenses internally and conduct regular cybersecurity simulations and tabletop exercises with members of senior management present. These tests and assessments provide useful insights into the strengths and weaknesses of our cybersecurity framework.


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security team completes security reviews on the vendors. Contracts are also negotiated to ensure language is included to address cybersecurity risk limitation and remediation. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with department managers and application owners to review System and Organization Controls ("SOC") 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.


text: To date, such cybersecurity risks have not materially affected us. We do, from time to time, experience threats to our data and systems that have been halted by the policies and systems in place. For more information about the cybersecurity risks we face, see "Risk Factors - Operational Risks" in Part I, Item 1A of this Annual Report.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY Old National's enterprise risk management program is designed to identify, assess, and mitigate various financial, operational, regulatory, legal, and reputational risks. Cybersecurity is a critical component of that program, especially in light of the significant, persistent, and ever-evolving cybersecurity risks facing us and other financial institutions. For further discussion of such risks, see the section entitled "Risk Factors" in Item 1A of this Form 10-K under the heading "Operational Risks." Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes, including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: As a result, the Company has developed and maintains an Information Security Program ("ISP") and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program. The ISP establishes control requirements for addressing cybersecurity risks, defines stakeholder roles and responsibilities, and sets the foundation for the program's importance within the Company. We structure our ISP around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In alignment with recommendations from NIST and other relevant industry guidelines, the Company maintains a layered cybersecurity strategy based on prevention, detection, and response/mitigation. Internal and third-party contracted technical and procedural controls include, among others, the following types: preventative (including firewalls, end-point detection and response, data loss prevention, access controls, internal/external penetration testing); detective (such as security monitoring and event management); and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program that is integrated into an overall enterprise incident response/crisis management program).


text: We continually review and seek enhancements to our cybersecurity programs and processes. The ISP is periodically reviewed by internal Company stakeholders and modified to respond to changing cybersecurity threats and conditions. We regularly test our layered defenses by performing simulations and tabletop exercises (including at a management level) and drills at both a technical level (including through penetration tests) and by review of our information security policies, practices and procedures with third-party consultants. Our ISP team monitors alerts and meets with business managers to discuss threat levels, emerging threats or trends, and available mitigation or remediation approaches and tools. The team also regularly collects and communicates to management relevant data on cybersecurity threats and risks, including through monthly cybersecurity scorecards on the status of and potential risks to key initiatives and controls, and conducts an enterprise-wide cybersecurity risk assessment at least annually.


text: In addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates. We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.


text: The Company also maintains a Third-Party Risk Management ("TPRM") program designed to identify, assess, and manage enterprise risks, including cybersecurity risks, inherent in or potentially associated with the Company's external service providers and other third parties in its supply chain. TPRM leaders report into and operate under the supervision of our Corporate Risk Management department. The TPRM program seeks to build into the Company's business processes an appropriate level of cybersecurity due diligence prior to engagement of, and during the relationship lifecycle with, third parties. We generally seek security-related confirmations from our third-party suppliers, including as to their adherence to appropriate information handling and asset management requirements and their provision to us of notifications in the event of any known or suspected cybersecurity incidents.


text: While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe. For further discussion of such risks, see the section entitled "Risk Factors" in Item 1A of this Form 10-K under the heading "Operational Risks."


text: The Company's enterprise Information Security department is primarily responsible for monitoring and managing the Company's ISP, under the supervision of Old National's Chief Information Security Officer ("CISO"). The Information Security department's responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.


text: Old National has adopted an enterprise risk strategy, including for cybersecurity risks, premised on three lines of defense. While the Company expects the responsibilities described in the prior paragraph to be performed, monitored, and managed on a day-to-day basis by a "first line of defense" vested in the responsible business or function, the CISO and Information Security department representatives, as a key part of the Company's Enterprise Risk Management department, serve as a "second line of defense" on cybersecurity matters, providing guidance, oversight, separate monitoring, and testing confirmation or challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through our organizational structure, with the CISO and other Information Security department personnel reporting into the Company's Chief Risk Officer (the "CRO"). The Company's Internal Audit function provides a "third line of defense," in terms of periodically auditing overall program controls and effectiveness, using internal auditors with experience in auditing information technology matters. Our Chief Audit Executive and Ethics Officer supervises our Internal Audit department and reports to the Company's Chief Executive Officer, while also maintaining a direct reporting relationship with the Chair of the Audit Committee of the Company's Board of Directors.


text: Old National's Information Security Department includes information security professionals with a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certifications. The Company's CISO has extensive experience managing cybersecurity programs and assessing cybersecurity risks, with more than 30 years of experience in developing, managing, and testing information security and technology risk management programs. That includes over 13 years of experience in building and managing cybersecurity and technology risk programs for multi-national, Fortune 500 financial services firms, and over 10 years of experience building and managing information security consultancies specializing in cybersecurity program development and cybersecurity control testing. He is a frequent lecturer and author on information security and technology risk topics and maintains his Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) certifications through the Information Systems Audit and Control Association, Inc. (ISACA).


text: Cybersecurity risks and updates are reported and discussed on a regular basis within various Old National and Old National Bank management committees that have operational business or information technology oversight or day-to-day implementation, monitoring, and governance responsibility for information security matters. Those include Old National Bank-level committees such as the Information Security and Technology Risk Management Committee (the "ISTRM"), the Risk Executive Committee, the Security Technology Council and the Cyber Threat Management Council. The ISTRM has direct oversight of the ISP. It is chaired by the CISO and meets regularly (generally monthly and no less than ten times per year) to review the ISP and related cybersecurity matters as outlined in its charter. Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company's Information Security department. Coordination among these committees, and with other business management committees operating outside the auspice of the Company's Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards.


text: The Enterprise Risk Committee of the Company's Board of Directors (the "Risk Committee") is responsible for oversight of the Company's enterprise-wide risks as set forth in its charter. That includes oversight of management's actions designed to identify, assess, mitigate, and prevent or remediate material cybersecurity issues and risks, through the ISP and other activities. The CISO provides quarterly (or more frequent, as appropriate) reports to the Risk Committee and the Risk Executive Committee, along with periodic reporting to the full Board of Directors on the ISP, the ISTRM's activities, key enterprise cybersecurity initiatives, and other matters relating to the Company's cybersecurity profile and risks. The Risk Committee provides a report to the full Board of Directors at each regular Board meeting regarding the Risk Committee's risk oversight activities, including those relating to cybersecurity, and the Company maintains procedures for the CRO and/or CISO to escalate significant cybersecurity matters to the Risk Committee, Executive Committee, and/or the full Board of Directors, as appropriate.


text: As a result, the Company has developed and maintains an Information Security Program ("ISP") and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program. The ISP establishes control requirements for addressing cybersecurity risks, defines stakeholder roles and responsibilities, and sets the foundation for the program's importance within the Company. We structure our ISP around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In alignment with recommendations from NIST and other relevant industry guidelines, the Company maintains a layered cybersecurity strategy based on prevention, detection, and response/mitigation. Internal and third-party contracted technical and procedural controls include, among others, the following types: preventative (including firewalls, end-point detection and response, data loss prevention, access controls, internal/external penetration testing); detective (such as security monitoring and event management); and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program, which provides a documented framework for handling high-severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts. The Company administers phishing tests routinely and publishes articles and alerts on its intranet regarding common attack schemes for the employees' awareness. Information security training is also conducted annually as continuing education for all employees.


text: I n addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates. We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.


text: Cybersecurity risks and updates are reported and discussed on a regular basis within various Old National and Old National Bank management committees that have operational business or information technology oversight or day-to-day implementation, monitoring, and governance responsibility for information security matters. Those include Old National Bank-level committees such as the Information Security and Technology Risk Management Committee (the "ISTRM"), the Risk Executive Committee, the Security Technology Council and the Cyber Threat Management Council. The ISTRM has direct oversight of the ISP. It is chaired by the CISO and meets regularly (generally bi-monthly and no fewer than five times per year) to review the ISP and related cybersecurity matters as outlined in its charter. Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company's Information Security department. Coordination among these committees, and with other business management committees operating outside the auspice of the Company's Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards.


text: Notwithstanding the extensive approach we take to cybersecurity, the Company continues to face risks and accompanying threats that could have a material adverse effect on the enterprise. We work to manage these risks and threats on a daily basis. We continue to invest in our cybersecurity program, the resiliency of our networks, and work to enhance our internal controls.


text: We identify and address cybersecurity threats and risks related to our business using an interdisciplinary approach that includes assessments primarily by our management, IT team and legal department. To defend against, detect and respond to cybersecurity incidents, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes which includes, among other things: conducting proactive privacy and cybersecurity reviews of systems and applications, auditing applicable data policies, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and continuously improving controls and implementing appropriate changes. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our management performs an annual review of third-party service providers' SOC reports to verify appropriate controls are in place.

companyName: STAR OPERATING COMPANIES, INC.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to the risk factor titled "We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could materially harm our business." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.


text: Cybersecurity is an important part of our risk management processes and is an area of focus for our board of directors and management. Our board of directors, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by management. Our audit committee assists the board of directors with this responsibility by periodically reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of our management team, which is responsible for the assessment and management of cybersecurity risks.


text: In addition, we have retained an external consultant to serve as our internal audit function and to support our cybersecurity risk management and governance practices. Our consultant has substantial experience in cybersecurity risk management and information technology, including security, compliance, systems and programming and reports to our audit committee and our board of directors on any appropriate items.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to the risk factor titled "We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could materially harm our business." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.


text: We recognize the significant role of information security in safeguarding our valuable intellectual property along with the confidentiality, integrity and availability of the data of our customers, employees, and suppliers. We have implemented certain policies, procedures, and systems that are designed to identify and address material risks related to cybersecurity and cybersecurity incidents.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: We have a comprehensive enterprise risk management ("ERM") program, which is implemented by management and overseen by our Board of Directors ("Board").


text: Our identification, assessment, and management of material risks from cybersecurity threats is integrated into the Company's overall ERM system and processes. Our ERM program is designed to leverage existing management processes to (i) identify critical enterprise risks, including both information security and cybersecurity risks, (ii) design and implement appropriate risk mitigation strategies, and (iii) assess the status of risks and mitigation plans.


text: A key component within our ERM framework is a robust information security risk management program, which includes: • risk assessments designed to help identify risks to our critical systems, information, services, and our broader global information systems environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to aid in assessing specific risks, providing benchmarking data, providing information regarding trends or recent regulatory changes applicable to our risk profile, or to test or otherwise assist with aspects of our security processes; • the periodic engagement of an independent third-party expert to evaluate our security capabilities; • mandatory annual cybersecurity awareness training of our employees, including incident response personnel and senior management, as well as conducting periodic tests with our user population to reinforce good information security practices; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including those impacting the Company's manufacturing sites; • processes to identify vulnerabilities, breach attempts and possible criminal activity by external parties; and • processes to assess the practices of our suppliers and third-party service providers relative to protecting the security of our information.


text: The Company holds ISO 27001-2022 certification for information security at our corporate headquarters. Our Chief Information Security Officer ("CISO"), who has over 30 years of experience in information security and technology leadership, has primary responsibility for (i) leading our global information security program, (ii) managing the cybersecurity risks identified as part of the ERM program, and (iii) developing, implementing, and enforcing security policies and maintaining information security systems.


text: Our global information security program, led by our CISO, includes dedicated teams specialized in (i) identity access management, (ii) data protection, (iii) incident response, (iv) vulnerability governance, (v) security operations and engineering (vi) governance, risk, and compliance, and (vii) insider risk and intelligence. The members of the information security team are responsible for managing, maintaining, and monitoring the systems and processes that prevent, detect, mitigate and remediate cybersecurity incidents, and for informing our CISO of status of such systems and processes, as well as any significant incidents.


text: Our Board is responsible for overseeing our strategy and approach to addressing information security risks, including managing and assessing risks from cybersecurity threats, both directly and through the audit committee. The audit committee is responsible for reviewing and monitoring the Company's cybersecurity and information security policies and its internal controls regarding cybersecurity and information security. In addition, the audit committee is responsible for regularly reporting to the Board on the substance of such reviews and, as necessary, recommending to the Board such actions as it deems appropriate. Our CISO reports on information security risks at least quarterly to the audit committee and at least annually to the Board.


text: We experience cybersecurity and other threats and incidents in the course of our operations. To date, we have not determined that such threats and incidents have materially and adversely affected the Company, including our business strategy, results of operations or financial condition. Furthermore, to date, we have not determined that such threats and incidents are reasonably likely to materially and adversely affect the Company, including our business strategy, results of operations or financial condition.


text: For additional information on certain risks associated with cybersecurity, please refer to "Our Business Relies on Technology, Data, Intellectual Property and Other Sensitive information That is Susceptible to Cybersecurity and Other Threats or Incidents" in Item 1A: Risk Factors.


text: Our global information security program, led by our CISO, includes dedicated teams specialized in (i) identity access management, (ii) incident response, (iii) vulnerability governance, (iv) security operations and engineering (v) governance, risk, and compliance, and (vi) insider risk and intelligence. The members of the information security team are responsible for managing, maintaining, and monitoring the systems and processes that prevent, detect, mitigate and remediate cybersecurity incidents, and for informing our CISO of status of such systems and processes, as well as any significant incidents.


text: Our Board is responsible for overseeing our strategy and approach to addressing information security risks, including managing and assessing risks from cybersecurity threats, both directly and through the audit committee. The audit committee is responsible for reviewing and monitoring the Company's cybersecurity and information security policies and its internal controls regarding cybersecurity and information security. In addition, the audit committee is responsible for regularly reporting to the Board on the substance of such reviews and, as necessary, recommending to the Board such actions as it deems appropriate. Our CISO reports on information security risks at least annually to the Board and quarterly to the audit committee or Board.


text: Lam Research Corporation 2025 10-K 25 For additional information on certain risks associated with cybersecurity, please refer to "Our Business Relies on Technology, Data, Intellectual Property and Other Sensitive information That is Susceptible to Cybersecurity and Other Threats or Incidents" in Item 1A: Risk Factors.


text: Managing cybersecurity risk within Cass is an ongoing, multifaceted process aimed at safeguarding digital assets and sensitive information. Led by the Company's Chief Information Security Officer ("CISO") and overseen by the Executive IT Council, the Company has a dedicated team of security professionals to implement the Company's information security processes.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: The Executive IT Council is comprised of the CEO, CFO, Chief information Officer ("CIO"), CISO, and all heads of business units that serve together to manage and oversee the Company's IT program as a whole. As part of this function and at the direction of the CISO, the Executive IT Council is charged with approving and providing oversight of the IT solutions that enhance the Company's security posture. As more fully described in "Governance" below, the CISO and CIO regularly report the Executive IT Council's findings to the Audit and Risk Committee of the Board, and to the full Board, in an effort to provide a collaborative and multi-point cybersecurity program.


text: The Company also relies on certain critical third party IT vendors that support processing, transmission, and storage of data, which has become more critical given the information security risks that are intensified through the Company's increased use of remote work arrangements. The Company has also engaged a third party to help monitor and analyze its system activities.


text: The Company's information security program is comprised of three primary components that guide the activities of employees and advisors tasked with managing the program: • Information Security Policy: The Company maintains an Information Security Policy that aligns with the National Institute of Standards and Technology and ISO 27001 cybersecurity guidelines and frameworks. This policy is reviewed at least annually by the Company's IT Security & Risk team, with updates approved by the Board of Directors. The Information Security Policy addresses the standards, design, scope, testing, and operation of the Company's cybersecurity program. All Company employees are trained both initially and on an annual basis on the information security requirements set by the policy. Employees whose work is more pertinent to cybersecurity management and risk, such as software development, receive additional and more specialized training. • Incident Management Policy: The Company's Incident Management Policy provides the structure and guidance for the Company's cyber incident response operations to ensure the quick detection of security events and vulnerabilities, as well as promote a rapid response to security incidents and mitigation measures. A dedicated security incident response team is tasked with addressing security incidents and driving the Company's response. • Cyber Risk Management Program: The Company performs a comprehensive risk assessment on an annual basis to identify and prioritize potential threats and vulnerabilities, then uses the results to implement and revise policies, assign responsibilities, and deploy security controls to address them on an ongoing, 24-7 basis.


text: Using the policies and programs described above, Cass has implemented a multi-layered cybersecurity approach, including, deployment of advanced endpoint protection, threat intelligence, and anomaly detection tools, continuous monitoring of network traffic through intrusion detection and prevention systems, regular penetration testing and vulnerability assessments, and encryption of sensitive data at rest and in transit.


text: Cass is dependent on third-party vendors to support operations and business objectives. Recognizing the interconnected nature of the Company's business, Cass places emphasis on managing third-party cybersecurity risk by maintaining a Vendor Management Policy. This policy establishes guidelines for conducting due diligence on vendors' security practices, making ongoing risk assessments and conducting extensive control reviews of identified high-risk vendors.


text: Because the Company is a bank holding company, its information security program is regularly evaluated by banking examiners and regulators. In addition, the Company undergoes annual Service Organization Controls Type II audits to evaluate information security controls related to specific services offered by the Company.


text: While the Company continues to face a number of cybersecurity risks in connection with the business, Cass has not experienced any cyber incidents that materially affected business strategy, results of operations or financial condition over the past fiscal year. The Company commits to transparently communicating with stakeholders, including shareholders, regulatory bodies, and law enforcement agencies, as required. To mitigate financial risks associated with cybersecurity incidents, Cass maintains a comprehensive cyber insurance policy. This policy covers various costs, including legal expenses, investigation costs, business interruption, and potential liabilities.


text: As described above, the Company's cybersecurity program is led by the CISO, who ultimately reports to the Executive Vice President and CIO. The CISO is supported by an information security team, made up of two security analysts and one IT audit and compliance analyst. The security analysts monitor the Company's security solutions and security event logs and responds to incidents and events when they occur. The IT audit and compliance analyst tracks remediation efforts, manages the Company's third party risk program and works with internal and external auditors on all IT compliance activities. Members of the information security team hold cybersecurity certifications, such as a Certified Information Systems Security Professional ("CISSP") or Certified Information Security Manager certifications. The CIO oversees all IT departments within the Company, including security and risk, and is the primary liaison between IT and the Board of Directors.


text: Both the CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. The CIO has a bachelor's degree in Management Information Systems and an MBA from Oakland University, and was previously the Domain CIO at Comerica Bank. The CISO has a bachelor's degree in Computer Science from the University of Illinois, holds the CISSP, Certified in Risk and Information Systems Control and Certified Chief Information Security Officer certifications, and has been active in the management of the Company's security programs for more than a decade, serving in the CISO role since early 2023.


text: The CISO and CIO provide monthly updates to the Executive IT Council on security incidents, compliance and patching metrics, as well as security related industry updates that might affect the Company's business. The Executive IT Council approves all security related project expenditures and all members are a part of the Company's incident response team.


text: The Audit and Risk Committee, together with the full Board of Directors, actively oversees the Company's cybersecurity program. The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls, from the CIO on a quarterly basis, and more frequently when necessary. These reports include updates on the activities of the Executive IT Council. Changes to the Company's information security policies and programs are approved by the Audit and Risk Committee. This information is reported to the full Board of Directors which, together with the Audit and Risk Committee, evaluates and considers the effectiveness of the Company's risk management policies and controls relating to cybersecurity that are described in the section above.


text: The Company believes that by layering cybersecurity practices and risk management oversight in a way that involves various individuals, teams, and ultimately, the Board of Directors, it fosters a culture of accountability and helps enable Cass to prioritize the safety and security of its and its clients' data.


text: Using the policies and programs described above, Cass has implemented a multi-layered cybersecurity approach, including deployment of advanced endpoint protection, threat intelligence, and anomaly detection tools, continuous monitoring of network traffic through intrusion detection and prevention systems, regular penetration testing and vulnerability assessments, and encryption of sensitive data at rest and in transit.


text: The CISO and CIO provide monthly updates to the Executive IT Council on security incidents, compliance and patching metrics, as well as security related industry updates that might affect the Company's business. Real time updates are also provided to the Executive IT Council as needed. The Executive IT Council approves all security related project expenditures and all members are a part of the Company's incident response team.


text: The Audit and Risk Committee, together with the full Board of Directors, actively oversees the Company's cybersecurity program. The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls from the CIO on a quarterly basis, and more frequently when necessary. These reports include updates on the activities of the Executive IT Council. Changes to the Company's information security policies and programs are approved by the Audit and Risk Committee. This information is reported to the full Board of Directors which, together with the Audit and Risk Committee, evaluates and considers the effectiveness of the Company's risk management policies and controls relating to cybersecurity that are described in the section above.


text: Our board of directors oversees our risk management programs, strategies and processes. The board of directors also assigns certain oversight responsibilities to its committees and has assigned the audit committee to oversee our guidelines, policies and practices regarding risk assessment and risk management as they relate to cybersecurity.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Our cybersecurity team is led by our Senior Director of Cybersecurity who has over 15 years of direct cybersecurity experience that includes incident response, security operations and management. This team is responsible for implementing and maintaining corporate and platform-wide cybersecurity, data protection, and third-party risk practices in coordination with our security steering committee, whose members include, our Senior Director of Cybersecurity, professionals working in cybersecurity and product and technology security and representatives from finance, internal audit, compliance and legal. The security steering committee meets quarterly to review our risk profile, threat detection, and remediation strategies, as well as our overall cybersecurity posture and health.


text: Our audit committee, typically in joint session with the full board of directors, meets quarterly with our Senior Director of Cybersecurity and receives reports regarding our systems and data security. These cybersecurity reports to the audit committee include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, notable incidents, the status of projects to strengthen our information security systems, engagement of third parties (e.g., consultants and auditors) and third-party tools, and our employee-training programs.


text: We implement enterprise-wide information security policies and security awareness training to promote compliance and enhance security awareness and vigilance among our workforce. This training is distributed to all employees and includes interactive training on the acceptable use of technology, secure software development practices and phishing simulations.


text: We use various internal organizational cybersecurity and privacy safeguards, controls and procedures for the discovery, identification, classification, assessment, and management of cybersecurity incidents and material risks associated with our corporate business systems, our product and service offerings, and third-party supplier relationships. Incident response plans and procedures are in place for the detection and response to cybersecurity incidents and events that may adversely affect the confidentiality, integrity or availability of our corporate business systems, our product and service offerings and third-party supplier dependencies. Our incident response plan includes a materiality assessment framework used for escalation protocols, navigation of materiality assessment determinations and procedures for post determination actions. Our incident response team includes our Senior Director of Cybersecurity, representatives from legal and delegates from our product engineering teams and corporate information technology teams. The incident response team will engage third-party incident management experts, including outside legal counsel, as necessary. Our Senior Director of Cybersecurity will provide updates to the internal audit team and our senior management team regarding any such incident until it has been addressed.


text: Our cybersecurity team implements various security processes, standard operating procedures and tools that aid in the prevention, detection, investigation, response and remediation of vulnerabilities and risks. These include, but are not limited to, endpoint and cloud threat detection and response systems, network application and API security services, cloud security posture management solutions, enterprise data loss prevention ("DLP") and governance services, cloud-native security scanners and source code analysis tooling. The cybersecurity team is responsible for the continuous monitoring, reporting and response to threats and vulnerabilities discovered through the deployment and operation of these tools. If any deficiencies relating to our internal controls over financial reporting are discovered, the Senior Director of Cybersecurity is required to report them to our internal audit team.


text: As part of our risk management process, our cybersecurity team conducts routine vulnerability and application security assessments, penetration testing, security and compliance audits, and ongoing risk assessments. We also engage third-party independent auditors to attest to the implementation and operational effectiveness of security controls implemented within our product and service environments in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC") as well as financial systems in scope for Sarbanes-Oxley information technology general controls. Additionally, our internal audit team conducts regularly scheduled audits of our IT and business systems. The results of these reviews are reported to senior management and the audit committee as part of the quarterly reporting process discussed above.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by PAR's Information Security & Privacy team, is designed to identify, assess and manage risks from cybersecurity threats, and it provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework that has been established by our internal audit team.


text: Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), and implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents, and it informs members of senior management and the audit committee of our board of directors of material cybersecurity threats and incidents.


text: PAR's cybersecurity risk management program leverages industry-recognized security frameworks, including the U.S. National Institute of Standards and Technology (NIST) and the CIS Critical Security Controls. We also engage third-party independent auditors to attest to the implementation and operational effectiveness of security controls implemented within our product and service environments in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC") as well as financial systems in scope for Sarbanes-Oxley information technology general controls. Our internal audit team conducts regularly scheduled audits of our IT and business systems. The results of these audits are reported to senior management and the audit committee as part of the quarterly reporting process discussed above.


text: We require our vendors to comply with our privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We implement enterprise-wide information security policies and security awareness training to promote compliance and enhance security awareness and vigilance among our workforce. This training is distributed to all employees and includes interactive training on the acceptable use of technology, secure software development practices and phishing simulations.


text: Based on the information available as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business, strategy, results of operations or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that PAR will not be materially affected by cybersecurity risks in the future. Additional information on cybersecurity risks we face is discussed in "Item 1A. Risk Factors" which should be read in conjunction with the foregoing information.


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee, which is responsible for overseeing that management has processes in place designed to identify and evaluate cybersecurity risks and that management has implemented processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to provide that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.


text: Our cyber risk assessment program is managed by our Information Security & Privacy team, which is led by our Vice President of Information Security & Privacy, who has over twenty-three (23) years of experience in the cybersecurity and technology industry. The Vice President of Information Security & Privacy reports to our Chief Financial Officer. The Vice President of Information Security & Privacy oversees multiple teams that are operationally responsible for PAR's cybersecurity, including IT Security, Cloud Security, and Development, Security & Operations, each of which provides regular updates to the Vice President of Information Security & Privacy regarding threat intelligence, cyber incidents, and cyber risk mitigation strategies as part of their responsibilities. The Vice President of Information Security & Privacy works closely with the Vice President of IT, who is responsible for PAR's information technology and digital transformation strategy, and with the Chief Technology Officer (CTO), who is responsible for software engineering across most of PAR's SaaS products. Together, the three individuals have a complementing set of responsibilities to align, implement and govern cybersecurity policies, standards and technolo gy controls throughout PAR.


text: Our audit committee, typically in joint session with our board of directors, meets quarterly with the Vice President of Information Security & Privacy, the Vice President of Information Technology, and/or the CTO who provide updates to it on, among other things, cybersecurity threat landscape, risk assessments, mitigation plans, notable incidents, the status of projects to strengthen our information security systems, engagement of third parties (e.g., consultants and auditors) and third-party tools, and our employee-training programs.


text: Risk Management and Strategy Cybersecurity (cyber) risk is differentiated from information technology risk by threat interactions that yield high impact consequences and ever-increasing probability. While standard security operations address most day-to-day incidents, cyber risk includes motivated threat actors who often use advanced tools, techniques and processes to evade detection or inflict maximum damage to an organization's information assets. Cyber threats and attacks adapt and evolve rapidly, so First Financial works to continuously enhance controls and processes to protect its networks, applications, and data from attack, damage or unauthorized access. Critical components to the Company's cyber risk control structure include corporate governance, threat intelligence, security operations, security awareness training and patch management programs. Cyber risk mitigation includes effectively identifying, protecting against, detecting, responding to and recovering from cyber threats.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: The Company's cybersecurity program is overseen by its Chief Information Security and Privacy Officer (the "CISO"). The Company's CISO has over 20 years' experience in the information security industry, including a previous CISO position at a large global conglomerate based internationally, and as head of product security for a US-based large global conglomerate. The Company's CISO also has previous financial services experiences as head of cyber defense for a large regional bank. The CISO meets quarterly with and chairs the Cyber ERM Committee, which consists of representatives from the officer of enterprise security, information technology, risk, compliance, and other internal stakeholders, and presents quarterly to the Enterprise Risk Management Committee ("ERMC"), which includes executive and senior leadership of the Company, and the Risk and Compliance Committee of the Board of Directors ("Board Risk Committee"). The management of risk from cybersecurity threats is one of the risks that is continuously assessed, monitored and managed by the Company under the Company's ERM framework which is described more fully in the Company's Annual Report to Shareholders. The CISO maintains a scorecard which monitors and measures various cyber risks, including: a. Operational capability, including cyber defense, vulnerability management, and third-party risk management. b. Risk assessments, including GLBA assessments and attack simulations. c. Program maturity, including MITRE and the Federal Financial Institutions Examination's Council's maturity framework. d. Internal and External Audit, including external assessments, internal audit results, and regulator exam results.


text: The Company uses a variety of tools to monitor and mitigate cybersecurity risks, including employee training, phishing simulators, incident response tabletops, cybersecurity insurance and business continuity planning for the protection of the Company's assets. Additionally, the Company's cybersecurity function is audited on an annual basis by a third party using the MITRE ATTACK framework.


text: The Company maintains an ad hoc committee comprised of senior management with responsibility for third party (vendor) risk management, including the CISO, the Chief Risk Officer, the Chief Compliance Officer, representatives from vendor management, and enterprise risk management associates. The ad hoc committee reviews diligence regarding vendors, including cyber diligence, and monitors any incidents or cybersecurity threats involving those third parties. Cyber diligence of critical vendors (vendors which store or interact with customers' personally identifiable information) includes an annual review of the technology and data interfaces with the vendor, an annual review of the vendor's cyber security controls, and monthly monitoring of the vendor's outward-facing security posture.


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition.


text: First Financial's board of directors is responsible for overseeing the Company's cybersecurity risk management objectives and risk tolerance as part of its oversight of the Company's compliance and risk management activities. Specific oversight of the cybersecurity function is delegated to the Board Risk Committee. The Chair of the Board Risk Committee has extensive cybersecurity experience, including both experience as a chief information security officer of a publicly traded financial institution and as an outside cybersecurity consultant. The committee chairperson maintains CISSP and CRISC certifications. Through the Board Risk Committee, the Board's oversight responsibilities include: a.establishing and guiding the Company's cybersecurity risk tolerance, including the determination of the aggregate risk appetite and identifying the senior managers who have the responsibility for managing risk; b.ensuring that the Company implements sound fundamental principles that facilitate the identification, measurement, monitoring and control of risk;


text: c.ensuring that adequate resources are dedicated to cybersecurity risk management; and d.confirming that awareness of cybersecurity risk management activities is evident throughout the organization.


text: The Company has developed and documented an incident response plan that includes various levels of escalation in the event of a cyber incident. All incidents begin with information security and information technology associates, with escalation to a crisis management team comprised of the CISO, the Chief Risk Officer and certain designated members of executive management in the event the situation is severe. The crisis management team communicates with the full executive team and the Board of Directors in case of more severe incidents. More complete reporting is then provided to the ERMC and the Board Risk Committee during regularly scheduled quarterly meetings.


text: Risk Management and Strategy Cybersecurity (cyber) risk is differentiated from information technology risk by threat interactions that yield high impact consequences and ever-increasing probability. While standard security operations address most day-to-day incidents, cyber risk includes motivated threat actors who often use advanced tools, techniques and processes to evade detection or inflict maximum damage to an organization's information assets. Cyber threats and attacks adapt and evolve rapidly, and the Company works to continuously enhance controls and processes to protect its networks, applications, and data from attack, damage, or unauthorized access. Critical components to the Company's cyber risk control structure include corporate governance, access management, threat intelligence, security operations, security awareness training, and vulnerability management programs. Cyber risk mitigation includes effectively identifying, protecting against, detecting, responding to, and recovering from cyber threats.


text: The Company's cybersecurity program is overseen by its Chief Information Security and Privacy Officer (the "CISO"). The Company's CISO has over 25 years of experience in information security and technology governance, risk, and compliance, including a previous CISO position at a large regional bank. The Company's CISO has also held leadership roles in enterprise risk management and internal audit for large financial service organizations, as well as at a global audit, assurance, and advisory firm. The CISO meets quarterly with and chairs the Cyber ERM Committee, which consists of representatives from the officer of enterprise security, information technology, risk, compliance, and other internal stakeholders, and presents quarterly to the Enterprise Risk Management Committee ("ERMC"), which includes executive and senior leadership of the Company, and the Risk and Compliance Committee of the Board of Directors ("Board Risk Committee"). The management of risk from cybersecurity threats is one of the risks that is continuously assessed, monitored and managed by the Company under the Company's ERM framework which is described more fully in the Company's Annual Report to Shareholders. The CISO maintains a scorecard which monitors and measures various cyber risks, including: a. Operational capability, including cyber defense, vulnerability management, and third-party risk management. b. Risk assessments, including GLBA assessments and attack simulations. c. Program maturity, including the NIST Cybersecurity Framework (CSF) and the Federal Financial Institutions Examination's Council's (FFIEC) maturity framework. d. Internal and External Audit, including external assessments, internal audit results, and regulator exam results.


text: The Company uses a variety of tools to monitor and mitigate cybersecurity risks, including employee training, simulated phishing exercises, incident response tabletops, cybersecurity insurance, and business continuity planning for the protection of the Company's assets. Additionally, the Company's cybersecurity function is audited on an annual basis by internal audit and external regulatory examiners.


text: The Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, which have materially affected the Company, including its business strategy, results of operations, or financial condition.


text: The Company recognizes the importance of being able to assess, effectively respond to and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of its information systems, data or network resources.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: As part of its overall enterprise risk management framework, the Company maintains both a Cyber Incident Evaluation Committee ("CIEC") and an Incident Response Plan ("IRP"). The Company's CIEC is managed by its Chief Information Officer (the "CIO") whose team (the Incident Response Team, or "IRT") is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific cybersecurity incident. These objectives are designed to maximize the effectiveness of the Company's response through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.


text: If a cybersecurity threat or incident is identified, the IRT will communicate the cybersecurity threat or incident and any damages to the CIEC. The CIEC will assess the materiality of the cybersecurity threat or incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule and make a recommendation to the Board. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's brands and information technology, accounting, finance, legal and human resources, as well as external third-party partners, where appropriate, to assess, identify and manage potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing its cybersecurity management systems and IRP. These partnerships enable the Company to leverage specialized knowledge and insights, to assist in updating its cybersecurity strategies and processes to align with industry best practices. The Company's collaboration with these third parties includes consultation and review of security enhancements.


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, of financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and there can be no assurance that our cybersecurity risk management program and processes, including our IRP, and other preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information, will be fully implemented, complied with or successful in protecting against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors—Risks Related to our Business and Industry—A cybersecurity breach could adversely affect our ability to conduct our business, harm our reputation, expose us to significant liability or otherwise damage our financial results."


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program. The Board receives regular reports from the CIEC on our cybersecurity risks. In addition, CIEC updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from IRT on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: The CIEC is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIEC's expertise includes a combined 20 plus years of experience in managing security technologies; designing and implementing security strategies; and risk management and incident response across various industries. Our CIEC supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our information assets and communication networks and mitigate risks to our assets, data, employees and customers. Our cybersecurity risk management program includes a cybersecurity incident response plan which is regularly updated to include structured processes encompassing preparation, identification, notification, containment, analysis, eradication, recovery and follow up.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: We have designed and assessed our program based on the Center for Internet Security Critical Security Controls (CIS Controls) and Safeguards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • responsibility for inventory and control of enterprise and software assets, technical and administrative controls and testing of our controls and security measures; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including monitoring and alerting; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks and reviews our cybersecurity program on at least an annual basis, or more frequently as necessary or advisable. In addition, the Audit Committee is informed, as necessary, regarding material cybersecurity incidents, as well as incidents with lesser impact potential.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives an annual briefing from our Chief Information Officer, or CIO, on our cybersecurity program, including risks and priorities.


text: Our cybersecurity program is led by our CIO, who has over 30 years of experience in information technology. Our CIO leads a credentialed and experienced Information Security team who has primary responsibility for our overall cybersecurity risk management program and who supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Enterprise Risk Leadership Team, including our Executive Vice President & Chief Operating Officer, the Chief Financial Officer and the General Counsel, is responsible for assessing and managing our material enterprise risks, including risks from cybersecurity threats.


text: Our Information Security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The increased use of, and dependence on, information management systems in order to engage with customers and conduct business necessarily creates cyber risk. Despite the significant resources and security measures used by the Corporation, the incentives for threat actors to obtain financial payment information and customer non-public information, or to conduct ransomware will continue to exist. Cyber breach statistics over the past several years evidence the targeting of numerous banking institutions and credit bureaus. Phishing attempts have also significantly increased and political conflict also presents cyber threats by nation states.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Operational risk is inherent in the Corporation's activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events. The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank. The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite. To govern, monitor and control operational risk, the Corporation maintains an Enterprise Risk Management ("ERM") Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk. These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees. The ERM Program includes managing material risks from cybersecurity threats.


text: Use of third-party software and services also exposes the Corporation to cybersecurity risk as numerous service providers host critical data or have direct contact with our bank customers. Although the Corporation adheres to industry standard practices in conducting thorough due diligence of vendors and contract management, should a vendor experience a breach the bank could still suffer reputational harm, and potentially financial losses. Expanded use of cloud-based technologies and providing our customers more internet-based product offerings to continue to remain competitive will serve to increase these potential risks. The Corporation's third party risk management program helps to mitigate risks posed by reliance on third and fourth parties. Governance of third parties includes a due diligence and risk assessment prior to contract execution, with oversight completed based on a frequency defined by the third parties risk profile.


text: The Corporation received written notice during 2023 that certain of its customer data was potentially included in the global incident involving Progress Software Corporation ("MOVEit Transfer"). The incident did not involve the Bank's internal network or IT systems, but was rather related to a third party prominent financial institution vendor that utilized MOVEit Transfer in its service offering to the Bank. Based on the investigation, the Bank's customers who use online and mobile banking could have had personal information copied through the cyberattack. The vendor confirmed that it implemented the recommended patches released by Progress Software Corporation for the platform. The Bank worked with the vendor to determine the potentially impacted customers and the extent of information potentially exposed and the Bank notified potentially affected customers appropriately. The incident did not impact the ongoing operations of the Bank and the Bank's cyber insurance is expected to cover many of the costs related to the incident. The MOVEit Transfer incident is the only cybersecurity incident that materially affected the Corporation during the 2023 fiscal year.


text: To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. Policies over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal and external parties. Findings are actioned on throughout the year and reported to various committees. The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center. PART I: ITEM 1A., ITEM 1B., AND ITEM 1C.


text: The Corporation's Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation's risks from cybersecurity threats. The CISO is an active Certified Information Security Systems Professional and has been with the organization for 17 years with over 20 years of experience in technology infrastructure and security.


text: The Information Security Department conducts cyber incident tabletop exercises on an ongoing basis. These exercises vary by topic, but may include internal incident response teams, executive management, and third parties that provide services across forensic, legal, and public relations capabilities. The purpose of these tabletops is to simulate a cyber event and work through the event using our Incident Response Plan. This allows our incident response team to become familiar with the logistics of the plan, as well as provide feedback to improve the process and plan. External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker participate in these exercises.


text: Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The Corporation uses multiple assessors, consultants, auditors and other third parties in the fulfillment of the information security program. These third parties participate in testing and validation processes, as well as the execution of certain program-related controls. The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board's Risk and Credit Policy Committee of the Board on a quarterly basis. At the Information Security Committee, security-related policies and standards are reviewed and recommended for approval, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented.


text: The Corporation's Board of Directors has delegated primary responsibility for oversight of cybersecurity risk to its Risk and Credit Policy Committee, with its Audit Committee also considering cyber risk as part of financial oversight. The Information Security Department provides an annual update to the Risk and Credit Policy Committee of the Board on the state of the Information Security Program. This cybersecurity "deep dive" includes review of key security incidents and review of the Information Security Policy, Information Security Program, the Incident Response Plan, and the Acceptable Use Policy. The Board is then presented with the update by the Chair of the Risk and Credit Policy Committee.


text: The Board considers cybersecurity risks in business strategy by getting updates on the Bank's cybersecurity risk assessment. It assesses the experience of management personnel responsible for preventing, mitigating, detecting and remediating any cyber incidents, including the Chief Information Security Officer.


text: In 2022, the Board appointed Jason Sondhi to its Board of Directors. Mr. Sondhi has experience managing companies who provide endpoint detection and incident response, vulnerability scans, security information and event management, security employee training and vCISO services. Mr. Sondhi's cybersecurity expertise assists the Board in overseeing management's cybersecurity related efforts. PART I: ITEM 2., ITEM 3. AND ITEM 4.


text: Operational risk is inherent in the Corporation's activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events. The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank. The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite. To govern, monitor and control operational risk, the Corporation maintains an ERM Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk. These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees. The ERM Program includes managing material risks from cybersecurity threats.


text: To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. Policies over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal and external parties. Findings are actioned on throughout the year and reported to various committees. The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center.


text: The Corporation's Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation's risks from cybersecurity threats. The CISO is an active Certified Information Security Systems Professional and has been with the organization for 18 years with over 21 years of experience in technology infrastructure and security.


text: Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The Corporation's Information Security Committee consists of members with diverse experience, including the Corporation's leaders from information security, enterprise risk management, legal, bank protection, internal audit and various business units. The Corporation's information security professionals have a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certificates. The Corporation uses multiple assessors, consultants, auditors and other third parties in the fulfillment of the information security program. These third parties participate in testing and validation processes, as well as the execution of certain program-related controls. The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board's Risk and Credit Policy Committee of the Board on a quarterly basis. At the Information Security Committee, security-related policies and standards are reviewed and recommended for approval, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our Chief Information Security Officer ("CISO") provides quarterly reports to the Risk Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.


text: Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly and summaries of key issues discussed and actions taken are provided to the Risk Committee.


text: We structure our information security program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our CISO, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.


text: We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.


text: We have established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain information security risk insurance coverage.


text: We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.


text: Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly, and summaries of key issues discussed and actions taken are provided to the Risk Committee.


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware of any significant cybersecurity breach or attack that had a material impact on our business or operating results to date.


text: We manage our cybersecurity risk as an integral part of our enterprise risk management programs. Accordingly, you should review the disclosure in this Item 1C in conjunction with the disclosure in the Risk Management section of this Report.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Information Security Program PNC's approach to cyber risk management, oversight, and reporting is based on a well-structured information security program. The program is responsible for protecting information assets to achieve business objectives in a secure manner and designed to keep customers' information and their funds safe and available. Program capabilities are built against industry guidance and a security framework to identify risks to sensitive information, protect that information and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents.


text: PNC's information security program is designed to ensure that PNC follows industry guidance and security frameworks for data protection, system development security, identity and access management, incident management, threat and vulnerability management, security operations management and third- and fourth-party security. Our program is continuously enhanced by threat intelligence, new regulations, industry guidance and disruptive new technologies. The program includes, among other things, annual security and privacy training for all PNC employees, phishing exercises, and informative articles and communications to raise employee awareness.


text: PNC actively monitors and responds to the overall cybersecurity threat landscape via active capabilities to share information and leverage intelligence, monitoring, and response capabilities across the security industry, which include cybersecurity threats, physical threats and fraud. PNC's intelligence and analysis capabilities collaborate to analyze events and trends for possible response.


text: We have not experienced any material cybersecurity threats that have impacted PNC's business strategy, results of operations, or financial condition to date. Notwithstanding our well-established approach regarding cybersecurity, we may not be successful in preventing or mitigating the impact of a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. See Item 1A Risk Factors of this Report for a discussion of cybersecurity risks.


text: Board Governance and Risk Oversight PNC's Board of Directors maintains governance and oversight of the risks posed by cybersecurity threats through the Board-level Technology and Risk Committees.


text: The Technology Committee meets no less than quarterly, and its purpose is to (i) assist the Board with the oversight of technology strategy and significant technology initiatives and programs, including those that can position the use of technology to drive strategic advantages and (ii) fulfill oversight responsibilities with respect to technology risk, information management, and security risks (including cyber security, cyber fraud, and physical security risks), and the adequacy of PNC's business recovery, resiliency and contingency plans and test results.


text: The Technology Committee is informed of cyber threats and risks through multiple mechanisms. PNC's Chief Information Security Officer presents quarterly to the Technology Committee on such topics as threat intelligence and assessment reports, incident and event reporting from other institutions, governance and regulatory exam statuses, and the status of other key program deliverables, among other content.


text: The Risk Committee meets no less than quarterly and provides oversight of PNC's ERM framework. Cybersecurity risk is integrated into PNC's overall ERM framework, and is represented as the Information Security domain, alongside seven other operational risk domains. See the Risk Management section of this Report for more details on our ERM framework.


text: PNC's inherent information security risks, the maturity and completeness of the control environment, and measurements against our risk appetite are presented quarterly to the Technology Committee by the firm's Chief Technology Risk Officer. Overall risks across the Enterprise Risk Framework are then reported quarterly to the Risk Committee by the Chief Risk Officer.


text: Communication to the Board occurs more frequently than quarterly, when dictated by incident and event management policies and procedures based on the criticality and urgency of the communication.


text: Role of Management Management is directly involved in assessing and managing PNC's risks from cybersecurity threats. PNC uses a three-lines-of-defense model where cybersecurity risk is managed and assessed by the first line of defense, led by the Chief Information Security Officer and the Director of Technology and Security Risk Management, and the second line of defense which is led by the Chief Technology Risk Officer, who reports to the Chief Risk Officer. The first and second lines of defense are examined internally by our third line of defense, Internal Audit. The lines of defense model ensures appropriate oversight within the management structure. See the Risk Governance and Oversight section of Risk Management for more details on each of our lines of defense. In addition to the three lines of internal defense, PNC engages external consultants to assess and inform the program, as needed.


text: The Chief Information Security Officer's organization includes managers who have led cybersecurity programs in other industries such as robotics and artificial intelligence, consulting, telecommunications, healthcare, and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO, Microsoft and F5, and industry certifications including but not limited to: Certified Information Systems Security Professional issued by the International Information System Security Certification Consortium; the Cybersecurity and Infrastructure Security Agency and Certified Information Security Manager issued by the Information Systems Audit and Control Association; and the Certificate of Cloud Security Knowledge issued by the Cloud Security Association.


text: Cyber Risks Related to Third Parties Risks from cybersecurity threats associated with its use of third-party service providers are addressed as part of the information security risk and third-party risk domains, and their management is integrated into the ERM Framework.