text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President, or SVP, Head of Finance and Investor Relations, Senior Vice President, General Counsel, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA

secItem: Item 1C


text: Andres Briseno, our SVP, Head of Finance and Investor Relations and, Douglas Snyder, our Senior Vice President, General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Mr. Briseno and Mr. Snyder have primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Briseno has served in a number of significant leadership roles at our company since 2016, including oversight of investor relations, business operations and corporate developments, and was appointed as SVP, Head of Finance and Investor Relations in 2023. Mr. Snyder has served in a number of significant leadership roles in various companies in the healthcare industry, and provided an oversight to legal and compliance teams with his broad legal background. Prior to joining our company, Mr. Snyder served in senior leadership and operations roles across healthcare field, including biotechnology, pharmaceuticals and the FDA. Further, our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company recognizes the critical importance of assessing, identifying and managing material risks associated with cybersecurity threats, as well as developing, implementing and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We focus significant resources on protecting our technology infrastructure and the personal information therein regarding applicants, our students, their families, our alumni and our employees. Our principal cybersecurity risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: The Board of Directors, as a whole, oversees the Company's risk management through both the Company's enterprise risk management program and the internal audit function. To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.


text: The Board has delegated oversight of the Company's management of cybersecurity risk to the Compliance and Risk Committee (the "Committee"). Directors with experience in cybersecurity are appointed to this Committee to assist in developing strategies and processes for protecting against, responding to, and remediating information security breaches. Those directors are Dennis Chookaszian, Patrick Gross and Leslie Thornton. The Committee reviews information security matters quarterly. In addition, the full Board regularly receives updates on cybersecurity matters from our Chief Information Officer, David C. Czeszewski, at each board meeting. The Chief Information Officer reports on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, an assessment of the information security program, and the emerging threat landscape. Mr. Czeszewski has a Bachelor of Arts degree in business and computer studies and a Master in Business Administration. He has worked in the technology field since 1986, joined the Company in 2001, and has been its Chief Information Officer since 2013.


text: The Company has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.


text: We have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.


text: We engage third-party experts to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. These third-party experts perform periodic cyber assessments, including security assessments using the CIS Controls cybersecurity framework. Our processes address cybersecurity threat risks associated with our use of these third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risks to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss, any of which could adversely affect our reputation, operations and ability to attract and retain students," and "Our primarily remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.


text: A core aspect of the Company's business relies on technology and software; as a result, the security of those technologies and software, as well as the protection of the confidential information entrusted to the Company by its customers, are key components of the Company's business and strategy. DFIN maintains many processes for identifying, assessing and managing material risks from cybersecurity threats. These processes are applied throughout the organization and are monitored, updated and assessed. DFIN has developed cybersecurity risk management processes that are integrated into the Company's overall risk management system and designed to be comprehensive. Risk management committees such as the Enterprise Risk Management Committee and the Ethics and Compliance Committee regularly review the Company's policies and procedures governing cybersecurity. These policies and procedures inform protocols that align cybersecurity risk assessment and mitigation to evolving risks and threat vectors that impact broader enterprise risk categories, promoting a comprehensive approach. These processes include the identification, assessment and management of material risks that are derived from cybersecurity threats.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, the National Institute of Technology Cybersecurity Framework ("NIST CSF") and Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly prescriptive and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the NIST CSF and engages a consultant to periodically assess the Company's NIST CSF profile and maturity. DFIN also obtains System and Organization Control ("SOC") Type 2 certification demonstrating control effectiveness across multiple American Institute of Certified Public Accountants (AICPA) Trust Service Principle domains.


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats.


text: DFIN maintains a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The program also includes evaluations of existing suppliers and third parties for ongoing risk. A supplier's classification rating determines the frequency with which it is evaluated. For example, those identified as critical suppliers are monitored on a quarterly basis, or more frequently if an event occurs that could elevate the risk, and assessed at a higher frequency than other suppliers. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that are determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Mitigating cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2024, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and reporting, data handling and provided targeted cybersecurity threat awareness and training to executives during 2024. The Company reviews its Incident Response plans and conducts tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.


text: No material cybersecurity incident has been identified nor materially affected the Company's business strategy, results of operations, or financial condition during the periods covered by the Annual Report. The Company's goal is to continually assess potential incidents, enhance protocols, expand cyber risk capabilities to mitigate future risks and safeguard DFIN's intellectual property, operations and client data.


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management, the Board or the Audit Committee, as appropriate. The Company's Chief Information Security Officer ("CISO") has approximately 30 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security Engineering, Security Architecture, Identity Services and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ numerous tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.


text: The Board maintains oversight of risk from cybersecurity threats and is regularly briefed regarding emerging cyber risks, mitigation strategies and incident response protocols directly from the CISO. The Board includes at least one cybersecurity subject matter expert. The CISO periodically engages with the Board in an executive session to provide updates related to threat landscapes, security initiatives and other cybersecurity awareness within DFIN. The Board participates in tabletop exercises to better understand the Company's incident response planning and the Company maintains processes and procedures so that material risks or events are escalated and addressed appropriately.


text: Protecting the security of our information systems is of significant importance to Flowers. We follow certain policies, protocols, and practices that address cybersecurity.

companyName: FLOWERS FOODS INC

ticker: FLO


text: We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes have been integrated into our enterprise risk management system. These processes also cover third-party service provider incidents that may impact the company.


text: Our cybersecurity program includes employee training and a computer security incident response plan (the "CSIRP") that provides controls and procedures designed to timely and accurately report material cybersecurity incidents. Employees receive regular security training, and we conduct periodic phishing testing to assess whether our employees require additional training. Additionally, we provide our employees with easy-to-use tools to report potential phishing emails. The CSIRP establishes an organizational framework and guidelines to assist the company in identifying, responding to, and recovering from computer security incidents both at the company and its third-party service providers in connection with incidents that may impact the company, including the security incident management team (the "SIM Team"), a legal team (the "Legal Team") and the computer security incident response team (the "CSIRT"). Each of the SIM Team, the Legal Team, and the CSIRT, often in consultation with the VP of Information Security, has a discrete set of responsibilities and obligations under the CSIRP. The CSIRT is a broad, cross-functional team of management stakeholders assigned with coordinating, developing, and managing the company's response to computer security incidents when activated.


text: Once the CSIRT has been activated, incidents are reported to a subcommittee of the company's disclosure committee, which consists of certain senior executives and leaders throughout the company and is charged with making disclosure determinations.


text: The CSIRP provides that, when activated, the CSIRT will lead all aspects of incident response, including the engagement of outside counsel and other third-party resources, such as an external incident response team, forensic resources, a crisis management or public relations firm, or notification service providers. For incidents where the CSIRP is not activated, either the SIM Team or the Legal Team, depending on the circumstances, is expected to lead and manage the incident response.


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. However, there is no guarantee that such coverage will be sufficient to address costs, liabilities and damages we may incur in connection with a cybersecurity incident or that such coverage will continue to be available on commercially reasonable terms or at all.


text: The company engages consultants and other third parties to identify and manage cybersecurity risks, including risks from third-party service providers that may impact the company.


text: No risks from cybersecurity threats, including as the result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, operational disruptions, be subject to litigation, civil or criminal investigations, regulatory intervention or incur costs related to remediation, payment of ransom or penalties, including as a result of unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.


text: The company's board of directors (the "Board" or "Board of Directors") oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity, and regularly reports its activities to the Board of Directors. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with the VP of Information Security and other members of management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.


text: At the management-level, the company's IT systems are overseen by our CIO, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who reports directly to the company's chief financial officer. The VP of Information Security has responsibility for information security strategy and operation. The VP of Information Security is responsible for managing and assessing material risks from cybersecurity threats. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.


text: Management tracks cybersecurity incidents through the process described above. Management regularly reports to the audit committee regarding policies and processes for assessing and managing risk associated with information technology and cybersecurity, as well as material cybersecurity incidents.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices, which are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards, are fully integrated into our overall risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

companyName: Enova International, Inc.

ticker: ENVA


text: Our cybersecurity risk management program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews the Company's cybersecurity risk management approach and interacts with various members of management. • Collaborative Approach. We use a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and have implemented procedures designed to promptly escalate certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including next-generation firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to support this, we highlight best practices with a dedicated Cybersecurity month. We communicate the evolving information security policies, standards, processes and practices with personnel throughout the year.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, internal assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; however, there can be no assurance that a cybersecurity incident that could have an adverse material impact on us will not occur in the future. See "Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents."


text: Board and Audit Committee Oversight The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer ("CTO"), IT Risk Management team leader ("Head of IT Risk") or other members of the IT Risk Management function.


text: Our Head of IT Risk, with the CTO's oversight, is primarily responsible for assessing, monitoring and managing material risks from cybersecurity threats and manages our IT Risk Management team. The Head of IT Risk is currently a Certified Information Systems Security Professional (CISSP), with a Master of Science in Digital Forensic Science and has 18 years of cybersecurity work experience. The members of our IT Risk Management team have an average of five years of cybersecurity work experience with degrees in information technology and computer engineering. The Head of IT Risk works closely with the CTO, including holding bi-weekly meetings, to discuss cybersecurity risks and any changes in our cybersecurity policies and practices. The CTO, Head of IT Risk and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: We conduct annual risk assessments and penetration tests to identify cybersecurity threats, including assessments and tests with the assistance of independent third-party cybersecurity consultants. We also conduct assessments in the event of a material change in our business practices that may affect key information systems that are vulnerable to such cybersecurity threats. These assessments and tests are designed to assist in the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following risk assessments and penetration tests, we work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards.


text: As part of our risk management system, we also periodically provide company-wide cybersecurity training to our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage with external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, as well as to monitor and test the effectiveness of our safeguards. The head of information technology (IT), supported by external cybersecurity consultants and the IT Department, implements our cybersecurity risk management system. The head of IT regularly reports on cybersecurity matters to the Chief Financial Officer.


text: We evaluate the security practices of certain third-party service providers to identify potential cybersecurity risks, including by reviewing documentation concerning their security measures. Where appropriate, including for third-party contracts under which our data will be stored, we contractually obligate providers to implement and maintain reasonable administrative, technical, and physical safeguards and other security measures designed to maintain the confidentiality, security and integrity of our data, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has ultimate responsibility for oversight of cybersecurity risks, but primary responsibility for cybersecurity risk oversight has been delegated to the audit committee.


text: Our Chief Financial Officer and head of IT, advised by external cybersecurity consultants, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our head of IT has over 25 years of experience in information technology roles and over 8 years of experience in security roles in the biotechnology industry. Our Chief Financial Officer has approximately 7 years of experience overseeing IT-related processes (including cybersecurity processes).


text: The processes by which our Chief Financial Officer and our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes regular updates from the head of IT to the Chief Financial Officer, as well as periodic reports, as needed, from the Chief Financial Officer and the head of IT to senior management.


text: Our Chief Financial Officer and head of IT provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, personal information, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").

companyName: Confluent, Inc.

ticker: CFLT


text: The Chief Information Security Officer, in coordination with our Chief Financial Officer, Chief Accounting Officer, certain members of the Company's legal team and certain third-party service providers ("Cybersecurity Risk Management Team"), is primarily responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. Through our Cybersecurity Risk Management Team, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example manual and automated tools, conducting scans of threat environment, use of external intelligence feeds, internal and third-party threat assessments and evaluating our industry's risk profile, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and conducting red/blue team testing and tabletop incident response exercises.


text: Depending on the particular environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: network security controls, system monitoring, incident detection and response, incident response policy, disaster recovery and business continuity plans, vulnerability management policy, penetration testing, encryption of data, data segregation controls, employee training, physical security cyber insurance, vendor risk management program, risk assessments, implementation of security standards/certifications, access controls, dedicated cybersecurity staff, and asset management, tracking and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, security management works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and reports to the audit committee of the board of directors, which reviews our overall risk management framework and programs.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, forensic investigators, dark web monitoring services, and professional service firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for each vendor, security questionnaires, audits, and review of security reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Information Security Officer, who oversees the Company's Trust and Security department, and the members of the Cybersecurity Risk Management Team. Our Trust and Security department has significant collective experience in relevant computer science and engineering disciplines and cybersecurity matters.


text: The Chief Information Security Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Security Officer is also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. Senior management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the management disclosure committee and to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the Chief Information Security Officer concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risks, and mitigation measures.


text: Governance and Responsibilities The Board recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management, or ERM. The Company seeks to mitigate cybersecurity risks through a cross-functional approach, including its Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by assessing, identifying, preventing, and managing risks from cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our Head of Information Technology (IT) oversees overall cybersecurity management, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic, but at least annually, reports to our Board or the Audit Committee of the Board of Directors, or the Audit Committee. The IT security team has over 40 years of combined technology experience, and over 20 years of experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure. The Company's Cybersecurity Committee is comprised of information technology, finance, legal, human resources, and data privacy employees, including the Head of IT. It meets regularly, but at least annually, to review and provide oversight of the Company's cybersecurity risks and data security programs, policies, and strategies. Pursuant to internal policies, the Head of IT will notify the Cybersecurity Committee of significant cybersecurity incidents and breaches. The Cybersecurity Committee reviews, analyzes, and responds to cybersecurity incidents and breaches. Additional responsibilities and risk mitigation strategies relate to business continuity and business resiliency capabilities.


text: The Company's Audit Committee has the responsibility to review and discuss with management the Company's guidelines, policies, and governance with respect to financial risk exposures and ERM, including with respect to cybersecurity, and to report to the Board annually. The Audit Committee is also responsible for overseeing the integrity and effectiveness of the Company's disclosure controls and procedures, which are designed to ensure that information related to cybersecurity risks and incidents is recorded, processed, summarized, and reported accurately and on a timely basis, to allow for timely decisions regarding disclosure of any such incidents. Our Audit Committee receives regular presentations and reports on cybersecurity risks from the executive management leadership team, which address recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee is also made aware of any potential material cybersecurity incident as well as ongoing updates regarding any such incident until it has been addressed by the executive management leadership team. On an annual basis, the Board discusses the Company's approach to cybersecurity risk management with the Audit Committee members and management (including members of the Cybersecurity Committee). Throughout the year, the Board and its committees engage with management to discuss a wide range of enterprise risks related to the Company's businesses, including cybersecurity, and they confirm the alignment of risk assessment and mitigation with business strategy.


text: The Company regularly assesses and tests its cybersecurity policies, standards, processes, and practices, including, but not limited to, audits, tabletop exercises, threat modeling, and penetration and vulnerability testing. The Company regularly engages outside advisors and experts to anticipate future threats and trends and to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Cybersecurity Committee, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Cybersecurity Technical Safeguards The Company invests in new information and cybersecurity services and technologies. Technical safeguards designed to protect the Company's information systems from cybersecurity threats include firewalls, continuous threat detection and response system(s), data leak prevention, enhanced email protection, antimalware functionality, and access controls, which are evaluated and improved through periodic assessments and cybersecurity threat intelligence.


text: Cybersecurity Incident Response and Recovery Planning The Company has established and maintains incident response and data recovery plans that address the Company's response to a cybersecurity incident, and plans are reviewed by the Cybersecurity Committee and members of the IT department.


text: The Company maintains a risk-based approach to identifying and overseeing risks from cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party system s.


text: Education and Awareness The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Current Cybersecurity Risk Posture To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see "Item 1A. Risk Factors - Our business and operations would suffer in the event of system failures."


text: In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. This comprehensive approach to protecting the Registrants' assets, employees, and data - including customer information - utilizes a defense-in-depth approach, which enables the Registrants to continually evaluate enterprise-wide cyber and physical security risks. The Registrants' defense-in-depth methodology is based on leading cybersecurity frameworks, including: • U.S. Department of Energy's Cybersecurity Capability Maturity Model standard, • National Institute of Standards and Technology Cybersecurity Framework, and, particularly for the bulk electric system, • North American Electric Reliability Corporation's Critical Infrastructure Protection Standards.

companyName: OGE ENERGY CORP.

ticker: OGE


text: In addition, the Registrants' cybersecurity team regularly coordinates with industry peers, the Edison Electric Institute, and state and federal agencies to improve threat intelligence, situational awareness, and security practices.


text: The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.


text: Cybersecurity risks are integrated into the Registrants' Enterprise Risk Management process. The Enterprise Risk Management process engages internal stakeholders, helps identify key internal and external business risks, including cybersecurity risks, and then supports evaluations of those risks, providing consistent assessment. Key risks are then assessed using a methodology that includes a quantification of potential financial and operational impacts. Priority cybersecurity risks are assigned internal risk owners which report to the Vice President of Technology, Data and Security, who is responsible for the Registrants' Enterprise Security including, among other responsibilities, developing and updating risk management plans.


text: The Enterprise Security team utilizes third-party consultants to regularly conduct a review of the Registrants' cybersecurity program that includes assessing their (i) ability to detect and respond to malicious behavior, (ii) configuration of security tools and (iii) security roadmap, training and staffing plans. The Enterprise Security team also utilizes multiple sources of threat intelligence information from real time feeds that come from government, industry and private sources to help stay abreast of emerging threats that could impact the Registrants.


text: The Registrants have third-party vendor risk management processes to oversee and identify risks from cybersecurity threats associated with their use of third-party service providers. Enterprise Security works cross-functionally across the companies to review new vendors and their proposed solutions as they are engaged by the Registrants. The Enterprise Security team's monitoring and assessment of third-party cybersecurity practices is continuous and ongoing throughout the Registrants' relationship with the third party. Based on this process, the Enterprise Security team may require specific security controls on the third-party application, system, hardware or software being deployed. Enterprise Security monitors vendors for disclosed vulnerabilities and change in scores from external risk scoring agencies.


text: The Registrants and their third-party vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems, or confidential data, or to disrupt operations. None of these attempts has individually or in aggregate resulted in a security incident with a material impact on the Registrants financial condition or results of operations. Although prior incidents have not materially affected the Registrants, any future incidents related to the Registrants' information systems due to theft, ransomware, viruses, increased use of artificial intelligence technologies, denial of service, hacking, acts of war or terrorism, or inappropriate release of certain types of information, including confidential customer information or system operating information, could have a materially adverse impact on the Registrants, and affect their business strategy, results of operations or its financial condition. See "Item 1A. Risk Factors" for further discussion.


text: The Board of Directors is responsible for reviewing and overseeing the long-term strategic plans and principal issues facing the Registrants and includes the oversight of the major risk exposures and the risk management activities of the Registrants. As part of its risk oversight role, the Board delegates specific roles to its committees to help ensure risks, mitigations and opportunities are appropriately monitored and managed. The Audit Committee has overall oversight responsibility over the Registrants' major financial risks, while the Nominating, Corporate Governance and Stewardship Committee oversees the Registrants' cybersecurity risk exposure and management. These Committees and the full Board of Directors are updated regularly by the Vice President of Technology, Data and Security and the Director of Enterprise Security on cybersecurity risks and related matters, including results from audits and assessments of the Registrants' cybersecurity practices and systems, as well as the results of their incident response and business resiliency exercises.


text: The Vice President of Technology, Data, and Security leads an information security team responsible for management of cybersecurity risk. The Vice President of Technology, Data and Security has decades of experience relevant to risk management, information systems and enterprise security. The Vice President of Technology, Data and Security serves on the Corporate Risk Oversight Committee where cyber risks are regularly discussed and addressed. The Registrants' Corporate Risk Oversight Committee includes corporate officers and members of management and is responsible for the overall development, implementation and enforcement of strategies and policies for all significant risk management activities of the Registrants.


text: The Registrants' contingency plans, including its security incident response plan and event management framework, set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified and elevated, as necessary, to an executive team which includes the Vice President of Technology, Data and Security and other executives on the Registrants' Corporate Risk Oversight Committee. Once elevated, these executives are ultimately responsible for the management, mitigation and remediation of incidents.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: PARSONS CORP

ticker: PSN


text: We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. We are also structured to CMMC which aligns with DOD/Federal contractor program compliance. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes; (2) our security processes; and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; • a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions, as we have described in the Risk Factors section of this Form 10-K.


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit and Risk Committee. The Audit and Risk Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Security & Risk Officer reports to the Chief Technology Officer and works closely with the Chief Legal Officer to ensure that all disclosure or reporting requirements are satisfied if an incident were to occur. The Chief Security & Risk Officer leads Parsons' overall cybersecurity function and provides quarterly reports to the Audit and Risk Committee on our cybersecurity risks, including briefings on our cybersecurity risk management program and cybersecurity incidents. The Audit and Risk Committee also receives periodic presentations on relevant cybersecurity topics as part of the Committee and the Board's continuing education on topics that impact public companies.


text: Our Chief Security & Risk Officer supervises efforts to prevent, detect, mitigation and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment. Our Chief Security & Risk Officer is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for leading our overall cybersecurity risks management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Chief Security & Risk Officer has significant global experience in managing and leading IT and cybersecurity teams.


text: The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. Risk-based analysis and judgment, along with a recognized security framework, are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services, as well as a security operations center. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Additionally, in Item 1A. Risk Factors, under the heading of Risk Related to Information Security and Business Disruptions, forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.


text: The Chief Technology Officer (CTO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CTO, Doug Fay, has served as the Chief Technology Officer & Sr. Vice President for Cinemark since August 2006. Mr. Fay has a background in software engineering and application architecture and has worked in the information technology field since the early 1990s. The CTO routinely reviews risks and security measures and meets monthly with the general counsel, CFO, and Global Controller to review security measures and risks. Oversight of the information security program at the Board level sits with Audit Committee. Presentations regarding security measures and risks to the Audit Committee occur semi-annually. The Company's incident response plan defines the process for escalating incidents based on level of severity to the management team and Audit Committee.


text: Garmin has a cybersecurity risk management program, generally aligned with the tenets and methodologies of industry standards and best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, designed to protect the confidentiality, integrity, and availability of the Company's information systems through assessing, identifying, and managing material risks from cybersecurity threats. The management of our information system platforms and the related cybersecurity is tightly integrated with Garmin's product development and technology management teams. Cybersecurity risks are identified, reported, and managed by the Company's in-house cybersecurity experts as well as third-party providers of penetration test reporting, cyber-threat intelligence, and incident forensics services.

companyName: GARMIN LTD

ticker: GRMN


text: Material Risk Identification The Company identifies risks from cybersecurity threats through a variety of methods including, but not limited to, internal and external assessments, security incidents, evaluations of changes to the business environment, systems, or technology, and reporting by associates, vendors, customers, and security researchers. These processes occur during the procurement, development, integration, modification, operation, and maintenance of the Company's information systems and the integration with or introduction, purchase, acquisition, or renewal of any third-party information systems and services. Notable changes to the Company's operating environment are scrutinized to ensure the confidentiality, integrity, and availability of the Company's information systems.


text: Material Risk Assessment The Company evaluates material risks from cybersecurity threats in terms of the potential impact on technology, information, data, and business operations, taking into account applicable laws and regulations, and with a focus on protecting the confidentiality, integrity, and availability of information, data and systems. Associated risk assessments are performed by the Company's risk analysts, subject matter experts, and information technology associates to identify, analyze, and quantify the risks and relevant objectives, and to determine the appropriate management action and priorities for managing the risks and implementing mitigating controls. Additional assessments to evaluate residual risk are performed when there are changes to controls that have the potential to create a material risk. Risk assessments also include appropriate considerations for regulatory and contractual requirements, and involve the Company's legal, data privacy, finance, and risk assurance functions as applicable.


text: Material Risk Management The Company continually analyzes and responds to material risks from cybersecurity threats in order to manage them to acceptable levels. The results of related risk assessments are used to prioritize the risks based on their potential impact to the Company and to inform the necessary actions and the appropriate functions to be involved in responding to those risks. Garmin's cybersecurity risk management processes are integrated into the Company's overall risk management processes. Material risks from cybersecurity threats are communicated to the Company's management and Board of Directors and are evaluated and considered alongside operational, legal, and other risks faced by the Company in determining mitigating actions and the allocation of resources.


text: Risks Related to Third-party Service Providers Garmin operates a third-party risk management program, which is aligned to NIST principles, to oversee and identify material risks from cybersecurity threats, undertake appropriate remediation, and establish and maintain compensating controls when appropriate. We conduct cybersecurity assessments of third-party service providers that will process personal, confidential, or proprietary information. Before proceeding with any such third-party service provider, we require them to remediate or mitigate any material findings from our cybersecurity assessment and to agree contractually to maintain acceptable cybersecurity practices throughout the duration of their service to Garmin and after for so long as they retain any personal, confidential, or proprietary information, and to promptly notify Garmin of any cybersecurity incidents that impact Garmin.


text: Risks from Cybersecurity Threats While the Company has technology and processes in place designed to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. Management does not believe our business strategy, results of operations, or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information about risks from cybersecurity threats, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Garmin's entire Board of Directors performs the risk oversight role, including with respect to risks from cybersecurity threats. Garmin's Chief Executive Officer is a member of the Board, and Garmin's Chief Financial Officer and its General Counsel regularly attend Board meetings, which helps facilitate discussions regarding risk between the Board and Garmin's senior management. In addition, on an annual basis Garmin's head of cybersecurity provides a comprehensive update of the Company's cybersecurity practices, risks and risk mitigation strategies to the Board of Directors. Each member of the Board of Directors actively participates in those discussions and has an opportunity to ask questions or provide direction. Garmin's Chief Executive Officer and head of cybersecurity also have discussions with members of the Board of Directors on an ad hoc basis as appropriate if and when a specific cybersecurity risk arises.


text: Management's Role Managing Risk and Monitoring Incidents Garmin's head of cybersecurity, who has over 30 years of relevant cybersecurity experience, oversees the Company's cybersecurity risk management program and is responsible for assessing and managing the Company's material risks from cybersecurity threats. Garmin's head of cybersecurity regularly meets with the Company's senior management, including the Chief Executive Officer, to discuss the Company's cybersecurity practices, risks, risk mitigation strategies, and whether further investments in internal or external cybersecurity resources are warranted.


text: If the cybersecurity team detects a potentially significant cybersecurity incident it is escalated promptly to the Company's head of cybersecurity, who then activates the Company's incident response plan and convenes the incident response team, which includes leaders of the Company's Legal, Finance, Operations, Communications, Risk Assurance, and other departments and executive leadership as appropriate. The Chief Executive Officer will inform the Company's Board of Directors of any material cybersecurity incidents.


text: As is the case for most companies, we are regularly subject to cyberattacks and other cyber incidents, and, therefore, cybersecurity is an important element of our ongoing information technology operations. We devote significant resources to protecting and enhancing the security of our computer systems, business information, software, networks and other technology assets, by applying our cybersecurity risk management processes, which consider physical, procedural and technical safeguards. We have a multi-faceted program for assessing, identifying and managing cybersecurity risks, that is designed to help protect our information assets and operations from internal and external cyber threats by: • organizing our cybersecurity efforts based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework by applying the framework's rubric of Govern, Identify, Protect, Detect, Respond, and Recover; • seeking to understand, manage and mitigate risk while ensuring business resiliency and protecting business, employee and patient information from unauthorized access or attack; • identifying critical business information, the lifecycles of that information, and the systems where this information is stored, distributed, processed, and eventually destroyed. For example, by managing important external parties and their operations, analyzing their cybersecurity risk to our business operations, and reviewing the residual risk with business leaders to accept and manage each external party appropriately; • protecting and securing our systems from attack with secure configuration standards and protective cybersecurity tools; • detecting potential attacks through appropriate tools, including cybersecurity-related data collection and analysis to help identify potential attacks; • responding to alerts from those tools with processes to verify whether there is a real incident and the severity of that incident using appropriate resources and team members, including establishing and exercising a Cybersecurity Incident Response Plan ("IRP") based on recognized industry practices, including NIST guidance; and • establishing and exercising processes and procedures to recover from cybersecurity incidents.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: Our IRP contains tools and guidance related to cybersecurity events and is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents as well as comply with applicable legal obligations. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We regularly engage external parties, inclusive of but not limited to, service vendors, consultants, independent privacy assessors, peer companies, industry groups, and governance experts to enhance our understanding and application of oversight of the cybersecurity landscape. For example, we provide an annual assessment of our cybersecurity program, completed by our third-party Chief Information Security Officer ("CISO"), to our Audit Committee for review and feedback. These external parties provide an industry perspective on appropriate risk management and investment in our cybersecurity efforts that is reviewed and approved by company management and the Board of Directors.


text: Based on an assessment using the previously described cybersecurity risk management process, we do not believe that there are any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Our business and operations may be materially adversely affected in the event of information technology system failures or security breaches, and the costs and consequences of implementing data protection measures could be significant." in Part I, Item 1A. "Risk Factors" for additional information.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on quarterly updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity threats or incidents, if any. As part of these quarterly updates to the Audit Committee, our Vice President of Information Technology presents any developments, emerging risks or key topics to the Audit Committee, including, among other things, the external threat environment, risk profile changes, training initiatives, the status of projects to strengthen cybersecurity, emerging global policies and regulations, cybersecurity technologies and industry practices, cyber readiness, results of third-party assessments, mitigation efforts and response plans. The full Board of Directors receives regular reports from the Chair of the Audit Committee, as well as periodic updates highlighting recent incidents throughout the industry and the emerging threat landscape.


text: Our Vice President of Information Technology leads an IT Security Team and has overall responsibility for the security program. The IT Security Team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes. The IT Security Team works across the enterprise to assess and prepare our employees and third parties to manage cybersecurity risks and detect, investigate and respond to cybersecurity incidents. Our Vice President of Information Technology has over 25 years of information technology experience, including 23 years of leadership responsibility, and has substantial operational experience with cybersecurity policy, protection, incident response, and governance. We also utilize a third-party cybersecurity advisor to act as our CISO, supporting the Vice President of Information Technology. This fractional executive has extensive experience as a CISO and cybersecurity executive with over 25 years of expertise in designing, building, and operating transformational information security programs, is a Certified Information Systems Security Professional, and holds a Master of Science in Strategic Intelligence.


text: Further, our IRP establishes a corporate incident response team, which is responsible for providing oversight, direction, and governance of incident response policies and processes and is composed of certain company stakeholders, including our Chief Financial Officer, General Counsel, Vice President of Information Technology and our third-party CISO.


text: In an effort to deter and detect cyber threats, we provide a monthly cybersecurity awareness newsletter to all employees, including part-time and temporary contractors, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The cybersecurity training and awareness programs function to remind employees of the importance of reporting all incidents quickly. We run frequent phishing tests to raise awareness of spam emails, the primary attack vectors for cyber threats and to further raise awareness of cyber threats. We provide annual training on employee responsibilities for protecting company information and data along with our overall compliance responsibility. Each October during cybersecurity awareness month in the U.S., we provide weekly updates on cybersecurity awareness and host a company-wide lunch and learn discussion of our cybersecurity program and the impact of cybersecurity on individuals as well as the company, with a data protection, cybersecurity and incident response and prevention training and compliance program.


text: Risk Management & Strategy Innospec has strategically integrated cyber security risk management into its broader risk management framework to promote a company-wide culture of cyber security risk management. This integration ensures that cyber security considerations are an integral part of our decision-making processes at every level. For example, training on cyber security risks was required of all Innospec directors and employees who have access to our information technology resources. Our risk management team works closely with our Information Technology ("IT") leadership to continuously evaluate and address cyber security risks in alignment with our business objectives and operational needs.

companyName: INNOSPEC INC.

ticker: IOSP


text: Innospec's IT leadership team is responsible for assessing, identifying and managing the inherent and residual risks associated with cyber security threats across our IT and Operational Technology landscape. IT leadership periodically reviews the Company's external threats, portfolio, and external services, and will update its risk register accordingly.


text: IT leadership will, when required by either executive management or the Board, engage third-party reviews of our overall cyber security compliance using The National Institute of Technology ("NIST") framework. IT leadership will also periodically engage specialist security contractors to test the Company's resilience to cyber security threats, conduct penetration testing and vulnerability assessments across its assets and request additional investment where necessary to further improve our cyber security.


text: Innospec utilizes an external service to provide ongoing analysis of the security related to our critical third-party service providers for IT operations and business IT services. Innospec will use the information provided by this external service as part of its IT vendor selection criteria and for ongoing third-party risk management.


text: Innospec's cyber security is underpinned by a third-party specialist that monitors critical systems and end-user devices for cyber-attacks. In the first instance, cyber-attacks are brought to the attention of the IT leadership for evaluation and remediation before further escalation to the CEO and CFO is considered.


text: Periodically, our systems are subject to targeted attacks which are intended to interrupt our operations or may lead to the loss, misuse or theft of personal information relating to our employees, suppliers and customers or lead to the loss of Company data, confidential information or our intellectual property.


text: Innospec's Board and its committees provide oversight of the Company's IT, including cyber security, in connection with the Company's efforts to assess and manage the Company's risk exposure. Oversight of risk management, including cyber security risk management is an integral part of Board and committee deliberations throughout the year. Since 2019, the Board has retained NCC Group ("NCC") to perform cyber security reviews. NCC reports its findings directly to the Board.


text: Innospec's Board has delegated responsibility for the management of the Company's IT to the Company's IT steering committee via the CEO and CFO. The IT steering committee is made up of executive management, business leaders from our reporting segments, the functional heads responsible for our operating systems, IT leadership and is chaired by our Global IT Director. The Company considers that the IT steering committee members have the appropriate qualifications and experience required to enable them to fulfill their responsibilities. The IT steering committee may, as per its agreed terms of reference, escalate any matter it wishes to the Board via either the CEO or CFO.


text: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles overseeing Innospec's IT operations. In addition, the IT leadership team includes specialists with many years cyber security experience at both Innospec and previously with other organizations, combined with multiple cyber security qualifications. Innospec's IT leadership formally reports through the CEO and CFO to the Board.


text: Innospec's CEO and CFO are involved with and approve the Company's strategy for managing the prevention, detection, mitigation and remediation of cyber security incidents as part of its "IT Security Management System" which includes defined escalation and internal communications processes and responsibilities.


text: IT leadership will, as required, present to the IT steering committee, information regarding any IT risks identified and the mitigation plans to reduce the Company's residual risks. The IT steering committee will be regularly updated as to the occurrence, mitigation and resolution of cyber security incidents. Any cyber security incident that is considered significant in nature will be shared by IT leadership with the IT steering committee in accordance with the agreed communication and escalation processes. The IT steering committee will assess the incident and make a recommendation to the CEO and CFO as to whether the incident is reportable to the SEC and/or other regulators or stakeholders.


text: In the last three fiscal years, management has determined there were no cyber security threats that have materially affected Innospec and that the expenses incurred relating to cyber incidents have been immaterial. The Company is not aware of any threats that are reasonably likely to materially affect its business strategy, results of operations or financial condition for the foreseeable future.


text: IT leadership provides a written report to the Board each quarter and the Global IT Director presents in person at least annually. Those reports and presentations include information on Innospec's cyber security and the related key performance indicators. IT leadership also provides external threat analysis to the Board when new relevant threats are identified as being exploitable and their potential impact on Innospec.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: The Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic training and testing for personnel regarding cybersecurity threats, which reinforce the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident; such plans are tested and evaluated periodically. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Company's executive leadership team and Cybersecurity Steering Committee, which regularly interacts with the Company's Vice President of Information Technology and other members of the cyber team and management.


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cybersecurity update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board oversees the effectiveness of the Company's management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives on a regular basis information and updates regarding cybersecurity matters. The Cybersecurity Steering Committee meets multiple times throughout the year to discuss the Company's cybersecurity programs and practices, risk management related to cybersecurity and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cybersecurity professionals with decades of relevant experience.


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plan. Through the ongoing communications from these teams, the Cybersecurity Steering Committee monitors effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any material cybersecurity incidents to the Board when appropriate.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company maintains a comprehensive cybersecurity management and governance program. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR INC

ticker: PCAR


text: The Company's Security Risk Council, including the Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the Company's Security Risk Council evaluates its significance and briefs the Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to the Company.