text: We have developed and implemented a cybersecurity risk management program that leverages the Center for Internet Security Critical Security Controls framework (CIS CSC). As part of our cybersecurity risk management program, we use multiple internal and external systems and tools to help monitor, identify, assess and manage material risks from cybersecurity threats and protect the Company's data and systems. We also monitor various sources to identify risks including, but not limited to, data from government entities, security vendors, and industry sources.


text: Our cybersecurity risk management program includes: • We leverage third-party cybersecurity vendors to test our systems, identify previously undiscovered risks in the environment and validate existing cybersecurity controls. We maintain a process to oversee and identify risks from cybersecurity threats associated with our use of third-party vendors with access to our resources. • We educate our users on cybersecurity prevention tactics through monthly security awareness training and ongoing phishing tests. • Email is protected through multiple layers of security that cover all internal and external communication. • We have a robust patching and remediation process for our systems. We use a managed risk service to help detect and prioritize vulnerabilities found in the environment and track them for remediation. • We have a disaster recovery plan and controls designed to protect against business interruption, including multiple backups of our critical systems. • We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, access controls, extended detection and response, and event monitoring.

companyName: CARROLS RESTAURANT GROUP, INC.

secItem: Item 1C


text: Our Board of Directors is responsible for oversight of risk management, including cybersecurity risks. The Audit Committee is updated quarterly on current cybersecurity events, metrics and other technology risks by our Chief Information Officer and Senior Director of Technical Operations & Security. The Audit Committee, in turn, provides the Board of Directors with updates regarding cybersecurity risks as it deems necessary or appropriate.


text: Our Internal Cybersecurity Team is comprised of the Chief Information Officer, Senior Director of Technical Operations & Security, and Information Security Manager. This team is responsible for managing efforts to assess, detect, prevent, mitigate and remediate cybersecurity risks, threats and incidents. This team has combined experience of 70 years in Information Technology, with over 35 years in managing cybersecurity programs, and hold various cybersecurity certifications. In addition, this team meets monthly with the IT leadership team to review current risks and trends, along with monitoring ongoing cybersecurity metrics.


text: While risks from cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, a future cybersecurity incident could do so by, among other things, interrupting our operations, causing reputational harm and/or exposing us to litigation.


text: Enterprise Risk Management: CMS Energy and Consumers manage security risks, including cybersecurity risks, through a robust enterprise risk management program that includes people, processes, technology, and governance structures. The enterprise risk management program identifies risks that may significantly impact the business and informs the companies' risk-mitigation strategies. The enterprise risk management program is reviewed with the Board at least annually.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: Cybersecurity Program: CMS Energy's and Consumers' security function, led by the Executive Director of Security, is an integrated organization accountable for cyber and physical security and is subject to various state, federal, and industry cybersecurity, physical security, and privacy regulations. Their cybersecurity program is responsible for assessing, identifying, and managing risks from cybersecurity threats using industry frameworks, as well as best practices developed by government and industry partners. All employees and contractors are required to complete annual trainings on a variety of security-related topics. Additionally, the companies continuously upgrade technological investments designed to prevent, detect, and respond to attacks. The companies' electric, natural gas, and corporate systems each follow standards, controls, and requirements designed to maintain compliance with applicable regulations and standards, such as MPSC, NERC critical infrastructure protection, and payment card industry regulations. Technology projects and third-party service providers are reviewed for adherence to cybersecurity requirements.


text: CMS Energy's and Consumers' cybersecurity program focuses on finding and remediating vulnerabilities in their systems. The companies use third-party firms for penetration testing, audits, and assessments, and conduct exercises to practice their response to simulated events. The companies also have a dedicated, proactive function focused fully on monitoring CMS Energy's and Consumers' systems and responding when issues occur. This includes regular information sharing with industry partners, peer utilities, and state and federal partners. The companies' incident response plan outlines the individuals responsible, the methods employed, and the timeline for notifying state and federal governmental agencies. The companies retain a third-party cybersecurity firm to assist with potentially significant incidents and have invested in cybersecurity insurance to offset costs incurred from any such incidents. To manage cybersecurity risks associated with the companies' use of third-party service providers, the companies incorporate security requirements into contracts, when deemed applicable, and pursue third-party security certifications for vendors with a higher risk profile.


text: CMS Energy and Consumers have experienced no material cybersecurity incidents; however, future cybersecurity incidents could materially affect their business strategy, results of operations, or financial condition. For additional details regarding these and other uncertainties, see Item 1A. Risk Factors.


text: The Executive Director of Security has 25 years of information technology and security experience. To enhance governance, the Executive Director of Security reports to the Senior Vice President and Chief Customer Officer, who has extensive experience overseeing cybersecurity and has had executive oversight of the security function for nine years at CMS Energy and Consumers. Prior to joining CMS Energy, this officer served as Vice President of Business Technology at Pacific Gas & Electric Company, a non-affiliated company. The Executive Director of Security is responsible for informing the CEO and other members of senior management, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the Executive Director's team. Cyber incidents are managed using the companies' standard process for critical events. In the event of such incidents, the Executive Director of Security communicates and collaborates with the officers of the companies and subject matter experts to address business continuity, contingency, and recovery plans. Senior management will notify the Board, including the Audit Committee, of any significant cybersecurity incidents.


text: As part of the Board's risk oversight process, senior management meets with the Board or Audit Committee at least twice annually to provide updates on and discuss cybersecurity. Such updates include a review of the companies' cybersecurity strategy, a scan of the threat landscape, and recent performance. Additionally, cybersecurity risks are included in the Audit Committee's risk oversight functions, which focus on operating and financial activities that could impact the companies' financial and other disclosure reporting. The Audit Committee's oversight involves reviewing and approving policies on risk assessment, controls, and accounting risk exposure. The Audit Committee also reviews internal audit reports regarding cybersecurity processes, and receives updates that focus on CMS Energy's and Consumers' cybersecurity program, mitigation of cybersecurity risks, and assessments by third-party experts. Of note, two members of the Board have extensive industry experience in cybersecurity and are on CMS Energy's and Consumers' Audit Committee.


text: Cybersecurity Program: CMS Energy's and Consumers' security function, led by the Vice President of Information Technology and Security and CIO, is accountable for cyber and physical security and is subject to various state, federal, and industry cybersecurity, physical security, and privacy regulations. Their cybersecurity program is responsible for assessing, identifying, and managing risks from cybersecurity threats using industry frameworks, as well as best practices developed by government and industry partners. All employees and contractors are required to complete annual trainings on a variety of security-related topics. Additionally, the companies continuously upgrade technological investments designed to prevent, detect, and respond to attacks. The companies' electric, natural gas, and corporate systems each follow standards, controls, and requirements designed to maintain compliance with applicable regulations and standards, such as MPSC, NERC critical infrastructure protection, and payment card industry regulations. Technology projects and third-party service providers are reviewed for adherence to cybersecurity requirements.


text: CMS Energy's and Consumers' cybersecurity program focuses on finding and remediating vulnerabilities in their systems. The companies use third-party firms for penetration testing, audits, and assessments, and conduct technical exercises to practice their response to simulated events as well as tabletop exercises to test that response using their incident command system, including leadership decisions. The companies also have a dedicated, proactive function focused fully on monitoring CMS Energy's and Consumers' systems and responding when cybersecurity attacks occur. This includes regular information sharing with industry partners, peer utilities, and state and federal partners. The companies' incident response plan outlines the individuals responsible, the methods employed, and the timeline for notifying state and federal governmental agencies. The companies retain a third-party cybersecurity firm to assist with potentially significant cybersecurity incidents and have invested in cybersecurity insurance to offset costs incurred from any such cybersecurity incidents. To manage cybersecurity risks associated with the companies' use of third-party service providers, the companies incorporate security requirements into contracts, when deemed applicable, and pursue third-party security certifications for vendors with a higher risk profile.


text: The Vice President of Information Technology and Security and CIO has over 25 years of information technology and security experience and, to enhance governance, reports to the Senior Vice President and General Counsel. The Vice President of Information Technology and Security and CIO is responsible for informing the CEO and other members of senior management, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cybersecurity team. Cybersecurity incidents are managed using the companies' standard process for critical events. In the event of such cybersecurity incidents, the Vice President of Information Technology and Security and CIO communicates and collaborates with the officers of the companies and subject matter experts to address business continuity, contingency, and recovery plans. Senior management will notify the Board, including the Audit Committee, of any significant cybersecurity incidents.


text: As described under Item 1A in this Form 10-K, we are subject to risks from cybersecurity threats, including risks relating to maintaining customer and employee data. Cybersecurity is a key focus at multiple levels of our organization, and we have developed policies and procedures to assess, identify and manage risks from cybersecurity threats.

companyName: CEDAR FAIR L P


text: –Board of Directors – Enterprise risk management ("ERM") process: As part of the ERM process, executive management and the Board of Directors regularly review an assessment related to cybersecurity and data protection risks to identify material risk areas, assess our processes to mitigate those risks, and identify process and procedure improvements to alleviate identified risks, including allocating appropriate resources. Cybersecurity and data protection focus areas of ERM include phishing, malware, data breaches, outdated software, staffing levels for key information technology positions, and risks associated with our use of third parties.


text: –Audit Committee of the Board of Directors: The Audit Committee is responsible for discussing the Company's major information technology risk exposures, including cybersecurity, and the steps management has taken to monitor and control such exposures. The Audit Committee dedicates attention to and provides oversight of certain cybersecurity risks. The Chief Information Officer and Corporate Vice President, IT Infrastructure Operations and Security, meet with the Audit Committee regularly to assess management's progress on implementing process and procedure improvements related to cybersecurity. The Audit Committee also provides guidance on long-term and short-term cybersecurity strategies.


text: –Executive Management – Technology Governance Committee: The Technology Governance Committee consists of certain members of executive management, including the Chief Accounting Officer, Chief Information Officer, Chief Commercial Officer, Chief Strategy Officer, and Corporate Vice President, IT Infrastructure Operations and Security. This committee evaluates projects involving information technology, including reviewing best practices and change management needs and communicating a company-wide approach. Therefore, the information technology department is aware of system and application implementations prior to execution to facilitate proper application and infrastructure security both during implementation and after implementation. Internal audit is notified of system and application implementations as part of this process as well. The internal audit department works with the information technology department to review information technology projects to ensure key projects are appropriately planned, designed, developed, tested, deployed and maintained, including verifying proper security both during and after implementation.


text: –Information Technology Department: The information technology department consists of employees with extensive cybersecurity experience, including the Chief Information Officer and Corporate Vice President, IT Infrastructure Operations and Security, as well as a team of compliance and security associates. Cybersecurity experience within the information technology department includes prior work experience and bachelor's degrees or higher in technology related fields. In addition to internal resources, we engage a cyber insurance carrier with comprehensive data privacy and security risk management services; a managed security service provider with comprehensive security solutions, including continuous network monitoring, reporting and assistance with investigation; and an information security consulting company that consists of cybersecurity experts and information security practitioners to provide additional cybersecurity support. We also maintain a system of information technology controls and procedures, including controls and procedures related to authentication and access, recovery plans and secured backups of data, the design of applications and selection of packaged software, and testing of significant changes in applications and infrastructure technology. We also provide training to our employees about cybersecurity, perform penetration testing at least annually, perform security incident preparedness activities at least annually, and perform an annual Payment Card Industry ("PCI") attestation. Third party providers involving information technology are identified as part of our contract review process. System and Organizational Controls ("SOC") reports are reviewed annually for third party providers. The information technology department continuously monitors for cybersecurity threats in order to detect if a cybersecurity incident has occurred. The department uses endpoint detection and response ("EDR") and security information and event management ("SIEM") with the assistance of our managed security service provider and internal analysts to detect and identify threats. Lastly, we follow the National Institute of Standards and Technology ("NIST") Framework, which enables us to compare ourselves against the industry and manage dynamic cybersecurity risks.


text: If a cybersecurity incident were to occur, including a cybersecurity incident associated with one of our third-party providers, we have developed an incident response plan to align responsibilities throughout the organization to facilitate an efficient and effective response, as well as an appropriate investigation of each incident. The incident response plan is led by executive management, the Chief Information Officer, the Corporate Vice President, IT Infrastructure Operations and Security, and our information technology department and includes a further delegation of incident responsibility to key internal stakeholders, including the legal, investor relations, human resources, and internal audit departments. Upon identification of an incident, each incident is assigned an incident materiality rating based on both quantitative and qualitative considerations. Qualitative considerations include the presence of ransomware, operational degradation or interruption, operational loss, and sensitive or confidential data loss. Based on the severity of each incident, the incident response is escalated. Cybersecurity incidents, regardless of materiality, are investigated by the information technology department led by Corporate Vice President, IT Infrastructure Operations and Security and are communicated to the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer, the Chairman of the Board of Directors and the Chair of the Audit Committee. The entire Board of Directors is notified of material or high risk incidents.


text: Risks from cybersecurity threats could materially affect our business strategy, results of operations or financial condition as described under Item 1A in this Form 10-K. There are no known risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant as of the date of this filing.


text: The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board, primarily through its Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Company's Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Management IT Examination Handbook, FFIEC Cybersecurity Assessment Tool, and GLBA 501(b). In general, the Company addresses cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Information Security Program is focused on the following key areas: • Security Operation and Governance: The Board has delegated to senior management responsibility for the Information Security Program which is managed through the IT Steering Committee, which maintains alignment and appropriate insight regarding information security activities. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security department oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Incident Response Plan: The Company has a contracted with a third-party to provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, and intrusion hunting. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by our Risk Management department. The process provides awareness and collaboration across internal teams including Information Security and Business Continuity. A Technical Requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. This process is aimed at advocating the necessary security, infrastructure, and application standards or controls so that information systems and the third party have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.


text: The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board annually.


text: The Risk Committee of the Board provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Committee reviews and approves the Information Security Program and receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board Risk Committee also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The full Board receives reports from the Board Risk Committee related to information cybersecurity.


text: Our Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Incident Response Plans including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO, Information Security, and Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the Board when appropriate.


text: To our knowledge, neither cybersecurity threats, nor the results including as a result of any previous cybersecurity incidents have materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors - Risks Related to Out Business.


text: As one of the elements of the Company's overall enterprise-wide risk management approach, our Information Security Program is focused on the following key areas: • Security Operation and Governance: The Board has delegated to senior management responsibility for the Information Security Program which is managed through the IT Steering Committee, which maintains alignment and appropriate insight regarding information security activities. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security department oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Incident Response Plan: The Company has a contracted with a third-party to provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, and intrusion hunting. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by our Risk Management program. The process provides awareness and collaboration across internal teams including, but not limited to, Information Technology, Information Security and Business Continuity. In addition to ongoing monitoring of select vendors, a review is conducted on new or significantly changed third parties, applications, and technology to ensure that systems and third parties meet certain baseline requirements. This process is used to identify and monitor risks in vendor arrangements and assists management in establishing appropriate risk responses. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.


text: The Risk Committee of the Board provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Risk Committee receives periodic presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Risk Committee also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The full Board receives reports from the Risk Committee related to information cybersecurity.


text: Our Chief Operating Officer ("COO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Incident Response Plans, including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the COO, Information Security, and Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the Board when appropriate. We believe our Board and management, including the Chief Operating Officer, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, internal and external training, and periodic discussions with consultants and peers with applicable knowledge and expertise. In addition, members of our management hold varying levels of relevant cybersecurity certifications.


text: We have established processes to identify, assess, and manage material cybersecurity risk, which are fully integrated into our overall enterprise risk management system and processes. These processes include risks related to our use of third-party service providers.

companyName: Santander Holdings USA, Inc.


text: We organize roles and responsibilities for risk management into a three-LOD model. Our Information Security Program is a first LOD function and has responsibility for the primary management of the risks that emanate from first LOD activities. Each first LOD unit owns, identifies, measures, controls, monitors, and reports risks originated through its activities. The second LOD which reports to the Chief Risk Officer, independently monitors risk exposures, implements comprehensive and appropriate risk controls, and reviews and challenges first LOD units on their activities to ensure that risk is managed in line with agreed frameworks and risk appetite levels. The third LOD provides independent assurance to the Company's Board of Directors and senior management by assessing the quality and effectiveness of the processes and systems of internal control, risk management and risk governance, compliance with applicable regulations, and the reliability and integrity of financial and operational information. The third LOD reports to the Chief Audit Executive and to the Board of Directors, independent of any other function or unit in the Company.


text: The Company's Information Security Program aligns with Santander's Information Security Framework, as well as US regulatory requirements and industry standards, including the guidelines provided by the FFIEC IT Handbook and the US National Institute of Science and Technology. This program is risk-driven, with documented policies, standards, processes, and procedures to ensure the identification, assessment, and appropriate management of risk. The Company has implemented a multi-layered and integrated defense model built around five security pillars – Identify, Protect, Detect, Respond and Recover, and Foundational – with key controls implemented in each of these pillars. • Identify covers the identification of information security and cybersecurity risk to systems, assets, data, and capabilities consisting of threat intelligence, privacy and regulatory compliance, asset management, risk management, and the business environment. • Protect covers development and implementation of appropriate safeguards to ensure delivery of critical infrastructure services. This pillar supports the ability to limit or contain the impact of a potential cybersecurity event consisting of access management, data security, protective technology, network security, and vulnerability management. • Detect covers the development and implementation of the appropriate activities to identify the occurrence of a cybersecurity event consisting of anomalous activities or events, security continuous monitoring, and vulnerability detection. • Respond and recover covers the development and implementation of the appropriate activities to take action regarding a detected cybersecurity event and to maintain plans for resilience and restore any capabilities or services that were impaired due to a cybersecurity event. • Foundational covers the essential aspects of the information security program consisting of governance, awareness and training, third-party information security, security architecture, change management, strategy and standards, and talent management.


text: An internal cyber risk assessment is performed annually to ensure that our cybersecurity program and its processes and controls adequately mitigate material cybersecurity threats and risks. As part of the program, we proactively identify IT assets, systems, and information and assess their risk and protection levels to detect and remediate any potential weaknesses by using vulnerability scanning, penetration testing and simulations of real cyberattacks. The Company also engages an external third party to independently validate the organization's maturity with regard to managing cybersecurity risks and that it meets regulatory and industry standards with respect to managing those risks.


text: The Company has multiple other enterprise risk programs and assessments which include information security as an integrated component that allow the Company to identify, assess, and manage risk. Processes and controls documented as part of these programs are tested as part of the enterprise-wide risk control self-assessment program. Additionally, metrics have been identified across the organization to cover key information security risk, including risk thresholds in line with our risk appetite. A management information systems program is in place with supporting governance routines to review any breaches of these metrics. Further risk management practices related to cybersecurity include scenario risk analysis, operational risk event escalation and monitoring, as well as processes to assure policy compliance.


text: Third-party service providers are managed through an established third-party risk management program. This includes processes to identify and assess cyber risk associated with the third-party service following a phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning. Third Party service providers are also required to notify the Company through established channels of any cyber incidents that may impact services or customers. Risks identified through any of these programs are managed through an enterprise risk and issue management process.


text: As of the time of filing, there are no known cybersecurity threats that have materially affected, or are reasonable likely to materially affect the Company, including its business strategy, result of operations, or financial conditions. The Company pro-actively monitors for cybersecurity threats and responds accordingly to minimize its exposure to such threats.


text: The Risk Committee, in collaboration and coordination with the Board of Directors and its other committees, is responsible to review risks related to information security, cybersecurity, and technology, as well as the steps taken by management to control for such risks.


text: The SHUSA Board of Directors and its Risk Committee oversee the development, implementation, and maintenance of the Company's Information Security Program. Annually, the CISO provides the Board of Directors with a report that includes the cyber risk assessment process, risk management and control decisions, results of testing, third-party service provider arrangements, security breaches or violations (if any), and adjustments to the program. In addition, the CISO provides the Board Risk Committee with annual cyber awareness reporting, in which cybersecurity risk and internal mitigating controls are reviewed.


text: The SHUSA CISO is responsible to oversee, develop, and maintain the Information Security Program, including assessing risks and managing controls appropriate to the size and complexity of SHUSA and its subsidiaries. The SHUSA CISO is also responsible to inform the SHUSA Board of Directors, management, and staff of information security risks. The SHUSA CISO has relevant experience to effectively carry out this role, including 20 years of experience within the IT and information security fields.


text: We have an established governance model to provide mechanisms to identify and escalate material risks from cybersecurity threats. This includes management processes across the information security program designed to monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents. Risk escalation and reporting paths are in place, including review of cybersecurity risks by management committees such as the Operational Risk Committees and Enterprise Risk Management Committees chaired by SHUSA's Chief Operational Risk Officer and Chief Risk Officer, respectively. The Company also maintains a dedicated Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and an Internal Audit team among its members. The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them.


text: The Company's Information Security Program aligns with Santander's Information Security Framework, as well as US regulatory requirements and industry standards, including the guidelines provided by the FFIEC IT Handbook and the US National Institute of Standards and Technology. This program is risk-driven, with documented policies, standards, processes, and procedures to ensure the identification, assessment, and appropriate management of risk. The Company has implemented a multi-layered and integrated defense model built around five security pillars – Govern, Identify, Protect, Detect, Respond and Recover – with key controls implemented in each of these pillars. • Govern covers the essential aspects of the information security program consisting of risk management strategy, third-party and supply chain risk management, roles and responsibilities, strategy, policies, and standards. • Identify covers the identification of information security and cybersecurity risk to systems, assets, data, and capabilities consisting of asset management, risk assessments including vulnerability identification and continuous improvements from testing and evaluations. • Protect covers development and implementation of appropriate safeguards to ensure delivery of critical infrastructure services. This pillar supports the ability to protect the organization against potential cybersecurity events and consists of access management and authentication, data security, awareness and training, platform security, and infrastructure resilience including network defenses. • Detect covers the development and implementation of the appropriate activities to identify the occurrence of a cybersecurity event consisting of adverse activities or events analysis, and security continuous monitoring. • Respond and recover covers the development and implementation of the appropriate activities to take action regarding a detected cybersecurity event and to maintain plans for resilience and restore any capabilities or services that were impaired due to a cybersecurity event.


text: The Company has multiple enterprise risk programs and assessments that include information security as an integrated component and allow the Company to identify, assess, and manage risk. Processes and controls documented through these programs are tested as part of the enterprise-wide risk and control self-assessment program. Additionally, metrics have been identified across the organization to cover key information security risk, which have defined risk thresholds in line with our risk appetite. A management information systems program is in place with supporting governance routines to review any breaches of these metrics. Further risk management practices related to cybersecurity include scenario risk analysis, operational risk event escalation and monitoring, as well as processes to assure policy compliance.


text: Third-party service providers are managed through an established third-party risk management program. This includes processes to identify and assess cyber risk associated with the third-party service following a phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning. Third-party service providers are also required to notify the Company through established channels of any cyber incidents that may impact services or customers. Risks identified through any of these programs are managed via an enterprise issue management process.


text: As of the time of filing, there are no known cybersecurity threats that have materially affected or are reasonable likely to materially affect the Company, including its business strategy, result of operations, or financial conditions. The Company pro-actively monitors for cybersecurity threats and responds accordingly to minimize its exposure to such threats.


text: We have an established governance model to provide mechanisms to identify and escalate material risks from cybersecurity threats. This includes management processes across the information security program designed to monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents. Risk escalation and reporting paths are in place, including review of cybersecurity risks by management committees such as the Operational Risk Committees and Enterprise Risk Management Committee chaired by SHUSA's Head of Technology & Operations and Chief Risk Officer, respectively. The Company also maintains a dedicated Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and Internal Audit representatives among its members. The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them.


text: Cybersecurity is a dynamic and constantly evolving field. We are committed to continuously improving our cybersecurity posture by staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessments and incidents. Our goal is to maintain a resilient cybersecurity framework that protects our assets and supports our long-term business objectives.

companyName: VAIL RESORTS INC

ticker: MTN


text: We manage risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by our Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. Management has created an information security program, which is comprised of a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of data created, collected, stored, and used to operate our business.


text: We identify, assess, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third party service providers and other companies with whom we do business. As part of our cybersecurity program, team members receive cybersecurity training and participate in awareness programs including phishing simulation exercises and reminders, and programming and events during Cybersecurity Awareness Month. We also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: We maintain an Incident Response Plan ("IRP"), which applies to information security incidents. Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, as well as the communication protocol of such incidents to senior management and other key stakeholders pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.


text: Board oversight of cybersecurity risk management is supported by the Audit Committee, which regularly reviews internal reports from management with respect to information technology and cybersecurity issues, and interacts with our enterprise risk management function and our Chief Information Officer ("CIO") regarding major cybersecurity risk areas and recommended actions to address such risks.


text: Our Information Security and Compliance teams, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that our CIO and our Vice President of Information Security, in coordination with our Information Technology Senior Leadership Team, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each quarter, the Audit Committee discusses our approach to cybersecurity risk management with our CIO, and at least annually, or more frequently as necessary, our CIO meets with the Board to discuss cybersecurity risk management.


text: Our CIO and our Vice President of Information Security are principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across company. Our CIO serves as Chair of our Cybersecurity Incident Materiality Assessment Council and works in coordination with the other members of our Executive Committee.


text: Our CIO has served in various roles in information technology and information security for over 27 years, including in technology leadership roles such as Chief Information Officer, Vice President Business Technology, Vice President Business Information Services, Senior Director of Mountain Technology, Director of Resort Application Development, and Director of Order Management Systems leadership roles for large public companies. Our CIO holds a B.B.A. in Management Information Systems and Accounting from University of Oklahoma.


text: Our Vice President of Information Security has served in various roles in information technology and information security for over 27 years, including as Vice President of Information Security for large public companies. In addition, our Vice President of Information Security has previously held roles including Vice President of Information Security and Technology, Senior Director Information Technology, Director IT Security and Compliance, and Senior IT Audit Manager. Our Vice President of Information Security holds several certifications including CISSP, CISA, CISSM, and PCI-ISA. Our Vice President of Information Security holds a B.S. in Management Information Systems from Iowa State University and an MBA from Auburn University.


text: Our CIO and Vice President of Information Security, in coordination with our Legal, Internal Audit, and Compliance teams, work collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our security IRP. To facilitate the success of this program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CIO, the Vice President of Information Security, and our Cybersecurity Incident Materiality Assessment Council monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: The Audit Committee reviews our cybersecurity management strategy and initiatives on a regular basis and oversees the management of risks from cybersecurity threats, including the policies, processes, and practices implemented by the Company to address such risks. The Audit Committee also routinely receives reports on the cybersecurity landscape, regulatory requirements, industry standards, and emerging threats. Prompt and timely information regarding any significant cybersecurity incident as specified in our IRP, including ongoing updates as the incident unfolds and until it has been addressed, are also provided to both the Board and the Audit Committee.


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future.


text: Our Vice President of Information Security has served in various roles in information technology and information security for over 27 years, including as Vice President of Information Security for large public companies. In addition, our Vice President of Information Security has previously held roles including Vice President of Information Security and Technology, Senior Director Information Technology, Director IT Security and Compliance, and Senior IT Audit Manager. Our Vice President of Information Security has earned several certifications including CISSP, CISA, CISSM, and PCI-ISA. Our Vice President of Information Security holds a B.S. in Management Information Systems from Iowa State University and an MBA from Auburn University.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including our customers', vendors', partners' and employees' data, including personal information.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Our cybersecurity risk management program is guided by frameworks and standards promulgated by the EU, National Institute of Standards and Technology, Cloud Security Alliance ("CSA") and International Organization for Standardization/International Electrotechnical Commission ("ISO/IEC"). While we seek to maintain ISO/IEC 27001:2013, ISO/IEC 27017 and the SOC 2 Type 1 certifications, this does not imply that we specifically or comprehensively comply with technical specification or requirements, only that we use all the above-mentioned standards and regulations as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk oversight strategy and utilizes common reporting channels and governance processes that apply across other risk areas. We have a dedicated Chief Information Security Officer ("CISO"), who leads our Information Security team responsible for managing our cybersecurity processes, strategy and controls. Certain members of our Information Security team hold cybersecurity certifications, including the Certified Information Systems Security Professional ("CISSP") and the Certified Information Systems Auditor ("CISA") designations.


text: Our cybersecurity risk management program includes: • a security incident response plan that includes procedures for responding to cybersecurity incidents; • risk assessment processes designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • our Information Security team, principally responsible for identifying and mitigating cybersecurity risks, and managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes; • implementation of new hire and annual data privacy and cybersecurity training of employees, including senior management, and cybersecurity governance training for our Board of Directors; • a cybersecurity insurance policy to cover certain types of costs and losses from cybersecurity incidents; and • a third-party risk management process, including risk assessment and risk rating, for certain service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and our Board committees assist with certain aspects of risk oversight. With respect to cybersecurity risk, our Board of Directors shares certain of the oversight responsibility and processes with the Audit Committee of the Board of Directors ("Audit Committee").


text: The Audit Committee, comprised entirely of independent directors, reviews and discusses with management our guidelines, policies and practices regarding risk assessment and risk management as they relate to our financial condition, and oversees our financial risk exposures, including planning regarding business continuity and cybersecurity. In addition, the Audit Committee oversees our annual enterprise business risk assessment, which includes the review of cybersecurity risks we face and our associated risk mitigation measures, and receives semi-annual reports from management on cybersecurity matters, including areas such as threat intelligence, major cybersecurity risk areas, regulations and cybersecurity incidents. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the Board of Directors regarding its activities related to cybersecurity. In addition, the Board of Directors also directly receives reports from management on our cybersecurity risk profile and on the performance of our data privacy and cybersecurity risk management program, semi-annually in alternating quarters with the Audit Committee.


text: Our management team, including our Chief Information Officer ("CIO"), CISO and the General Counsel, is responsible for assessing and managing material risks from cybersecurity threats, including supervision of our internal security incident response team and our Disclosure Committee comprised of certain of our employees (including any applicable subcommittees thereof). Our management team has relevant expertise in the following:(i) understanding of cybersecurity risks in enterprise operations, (ii) experience in overseeing risk management and understanding risks faced by enterprise operations and (iii) significant operating experience allowing them to provide insight into developing, implementing and assessing our operating plan. In addition, our CISO has over 25 years of broad cybersecurity and information technology risk management experience, is a Certified Information Security Manager ("CISM") and holds a Master's Degree in computer science and information systems.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information, including our customers', vendors', partners' and employees' data, including personal information.


text: Our cybersecurity risk management program is guided by frameworks and standards promulgated by the EU, National Institute of Standards and Technology, Cloud Security Alliance ("CSA") and International Organization for Standardization/International Electrotechnical Commission ("ISO/IEC"). While we seek to maintain ISO/IEC 27001:2013 and ISO/IEC 27017:2015 certifications, and seek to achieve the SOC 2 Type 1 and Type 2 attestations, this does not imply that we specifically or comprehensively comply with technical specification or requirements, only that we use all the above-mentioned standards and regulations as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • a security incident response plan that includes procedures for responding to cybersecurity incidents; • risk assessment processes designed to help identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • our Information Security team, principally responsible for identifying and mitigating cybersecurity risks, and managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test (including penetration test) or otherwise assist with certain aspects of our security controls and processes; • global security operations center services through certain service providers; • implementation of new hire and annual data privacy and cybersecurity training of employees, including senior management, and cybersecurity governance training for our Board of Directors; • a cybersecurity insurance policy to cover certain types of costs and losses from cybersecurity incidents; and • a third-party risk management process, including risk assessment and risk rating (using common vulnerability scoring system or similar methodologies based on industry practices), for certain service providers, suppliers and vendors.


text: Our management team, including our Chief Information Officer ("CIO"), CISO and the General Counsel, is responsible for assessing and managing material risks from cybersecurity threats, including supervision of our internal security incident response team and our Disclosure Committee comprised of certain of our employees (including any applicable subcommittees thereof). Our management team has relevant expertise in the following:(i) understanding of cybersecurity risks in enterprise operations, including information technology, information security, product security, physical security and legal, (ii) experience in overseeing risk management and understanding risks faced by enterprise operations and (iii) significant operating experience allowing them to provide insight into developing, implementing and assessing our operating plan. In addition, our CISO has over 30 years of broad cybersecurity and information technology risk management experience, is a Certified Information Security Manager ("CISM") and holds a Master's Degree in computer science and information systems.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.


text: Our information security program, the framework for how we assess, identify and manage risks from information security and cybersecurity threats, is designed in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverages the International Organization for Standardization 27001 framework. Cybersecurity risk is integrated into our overall strategic risk management ("SRM") program, which evaluates key risk areas across Paramount by a cross-functional group of risk owners, in close coordination with members of senior management.

companyName: Paramount Global


text: Our information security program is overseen by our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, the CISO and members of the information security team timely notify members of senior management, including our CTO and General Counsel, and under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and CISO, which include information on the broader information security and cybersecurity threat landscape, the information security program's strategic priorities, progress made in respect of those priorities and summaries of cybersecurity incidents and related remediation efforts. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. Our CISO has more than 20 years of experience managing information security for media/entertainment, technology, retail and financial services companies. While at Paramount, our CISO oversaw the integration of Viacom's and CBS's information security programs and our transformation to a cloud-centric, global streaming provider.


text: We have experienced cybersecurity attacks in the past and may experience attacks in the future, potentially with more frequency or sophistication. Although past attacks have not materially impacted our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors — Risks Relating to Business Continuity, Cybersecurity and Privacy and Data Protection."


text: Our information security program is overseen by our Chief Technology Officer ("CTO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers, partners and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, members of the information security team notify members of senior management as soon as reasonably practicable, including our CTO, Acting General Counsel and, under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and senior members of the information security team, which include information on cybersecurity incidents and related remediation efforts, the broader information security and cybersecurity threat landscape, the information security program's strategic priorities and progress made in respect of those priorities. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. The senior members of our information security team have extensive experience in technology and information security.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: FAIR ISAAC CORP

ticker: FICO


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and managed through a multi-faceted approach including third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: We employ an experienced team of cybersecurity professionals with a variety of backgrounds. We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including: SOC 1, SOC 2 Type II, ISO 27001, CSA STAR Level 2, PCI-DSS and others.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Audit Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also makes available to clients attestations of its various certifications, audits, and penetration tests.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. Additional information on the cybersecurity risks that could materially affect us is discussed in Part I, Item 1A, "Risk Factors."


text: Management Oversight and Governance The Company's Chief Information Security Officer ("CISO"), who reports to the President, Software, is responsible for the design and implementation of our security program and strategy based on the mandate provided by the Board and senior management. The CISO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 20 years, including serving as the Chief Security Officer of two other large public technology companies. We believe the Company's business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CISO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Audit Committee and the Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents if and when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems it controls from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including any required public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Board Oversight and Governance Our management is responsible for identifying the various risks facing the Company, formulating risk management policies and procedures, and managing the Company's risk exposures. Our Board responsibility is to monitor the Company's risk management processes by informing itself concerning our material risks and evaluating whether management has reasonable controls in place to address the material risks. The Audit Committee of the Board is responsible for discussing with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures, including the Company's risk assessment and risk management policies. Accordingly, our internal risk management team regularly reports to the Audit Committee on our major risk exposures and the steps management has taken to monitor and control such exposures, including our risk assessment and risk management policies. The Audit Committee, in turn, reports on the matters discussed at the committee level to the full Board.


text: As part of its oversight of the Company's risk management noted above, the Audit Committee oversees, reviews and discusses with management the Company's risks from cybersecurity threats and management's role in assessing and managing such risks. The Audit Committee receives regular presentations, reports and updates from the CISO and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics.


text: The Company's processes also allow for the Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management at any time it deems appropriate to discuss matters relevant to the Audit Committee. The Company's policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: With an increasingly technology-driven business landscape, cybersecurity is critical to safeguarding our company's shipboard and shoreside assets and maintaining our operational integrity. We have implemented cybersecurity measures that are designed to protect the confidentiality, integrity and availability of our information technology and operational technology systems against the constantly evolving cyber threats.

companyName: CARNIVAL PLC

ticker: CUK


text: Our processes to identify and manage cybersecurity risks form part of our overall risk management framework which includes an organization wide, multi-layered approach to risk assessment and management. Our cybersecurity risk management program is designed to proactively identify, assess and mitigate potential cybersecurity threats. It leverages industry-leading cybersecurity frameworks and standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the ISO/IEC 27001 standard. We conduct regular risk assessments to evaluate the security posture of our systems and processes, including vulnerability assessments, penetration testing, external attack surface mitigations and monitor our network for suspicious activity and potential breaches. We engage third-party advisory firms to conduct assessments of the maturity of our cybersecurity program, including measures to improve our Payment Card Industry Data Security Standard ("PCI DSS") compliance, as well as to conduct penetration testing of our shoreside and shipboard assets on a periodic basis. We continue to invest in our information technology, operational technology and cybersecurity programs to layer in the right mix of risk-based controls to protect against evolving threats.


text: We maintain an incident response plan and related policies and protocols which outline procedures for identifying, reporting and responding to cybersecurity incidents. Our incident response plan is regularly updated to address new threats and tested through crisis simulation exercises involving our shipboard and shoreside employees. We also have an incident response team who is trained to handle a wide range of security events and collaborates with external cybersecurity experts when necessary.


text: We have data privacy and security standards across the company that are designed to comply with relevant regulations, including the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and PCI DSS. We employ encryption, access controls, and other data anonymization techniques to safeguard data throughout its lifecycle.


text: We also have data privacy and cybersecurity focused training for our shoreside and select shipboard team members. We regularly educate our shoreside and shipboard team members about the importance of handling and protecting guest and team member data, including phishing simulation exercises and annual privacy and security training to enhance awareness of how to detect and respond to cybersecurity threats.


text: Our cybersecurity diligence extends to third-party vendors and partners. We have operationalized processes that seek to identify and manage cybersecurity risks from our service providers, including those who have access to our guest or team member data or direct access to our network, systems and applications, with the goal of minimizing our exposure to third party risks. In addition, cybersecurity and data privacy considerations factor greatly in the sourcing, selection and oversight of our third-party service providers. We generally require third-party service providers that access or host our data, systems, or applications or could otherwise introduce cybersecurity risk to us, to complete additional risk assessments, comply with our security and privacy requirements, and agree to the timely reporting of cyber security incidents to us.


text: As of November 30, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. Despite our efforts with respect to protecting information technology operations and strengthening our cybersecurity and data privacy positions, we have been, and may continue to be, impacted by breaches in data security and lapses in data privacy, which occur from time to time. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses incurred in connection with cybersecurity incidents were not material. For additional information on the risks from cybersecurity threats and the potential related impacts on the company, refer to Operational Risk Factor f.


text: Our Chief Information Security Officer ("CISO") leads our worldwide efforts in cybersecurity risk reduction and regulatory compliance. Our CISO oversees risk management across information technology operations, cybersecurity and data privacy. With over 20 years of experience across various industries, including Fortune 50 and 100 organizations, our CISO brings a comprehensive background in strategic cybersecurity leadership and risk management. This expertise is further supported by an array of certifications (C-CISO, CISSP, CISM, CRISC, CISA, and CIPT), as well as academic credentials, including a Master's in Information Systems from Harvard University and a Bachelor's in Business Administration from Florida International University. Our CISO regularly updates executive management and actively engages within the cybersecurity community to stay informed on the latest industry developments.


text: Our CISO chairs our Cybersecurity Advisory Council ("CAC"), a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The CAC is sponsored by our Chief Financial Officer and is composed of senior leaders from our brand information security, data privacy, legal, internal audit and information technology teams. The CAC meets at least quarterly and has responsibility for oversight of our cybersecurity strategic direction, risks and threats, priorities, resource allocation, capabilities and planning. The CISO and her team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our cyber incident response plan. Additionally, the CISO informs our Disclosure Committee on a quarterly basis, or more frequently if needed, of any cybersecurity risks or incidents or other information system matters that may affect our business strategy, results of operations or financial condition.


text: Our Chief Privacy Officer and Data Protection Officers oversee our focus on the proper processing of personal information in alignment with our privacy policy and applicable privacy laws and regulations.


text: The Audit Committees are responsible for oversight of our risk management with respect to information technology operations and cybersecurity while the Compliance Committees oversee risk management in the area of data privacy and the HESS Committees oversee risk management related to our maritime operational technologies. The Audit Committees receive updates from the CISO on our information technology operations, including cybersecurity developments and risks, three times a year, and our Board of Directors receive updates from the CISO on an annual basis.


text: We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC).

companyName: FASTENAL CO

ticker: FAST


text: Our information technology (IT) security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes: • Enterprise security framework and cyber security standards; • Cyber security awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.


text: Our IT security department maintains a playbook to respond to potential cybersecurity threats. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. Any identified risks are included in our overall risk management program, and internal and external auditors validate our IT controls on a regular basis.


text: We conduct organization-wide cybersecurity training and compliance exercises in connection with our information security program. This training consists of educational material and compliance testing administered to all of our employees, which is tracked and recorded throughout the year. Results and progress are shared with Executive Leadership, the Audit Committee, and the Board. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training.


text: We have implemented an IT vendor risk management policy that provides guidance in managing risks associated with IT vendors and business partners. We have also established a third-party risk management program and conduct pre-onboarding security assessments and annual re-assessments of our service providers to collect, track, and manage third-party security controls based upon the risk presented to the business. Any issues identified during assessment are tracked through to remediation.


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, Information Technology, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and Enterprise Risk Management teams.


text: We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. The Information Security Risk Council, Executive Leadership, the Audit Committee, and the Board are notified of any material cybersecurity incidents through an established escalation process. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: The IT security department team members have degrees applicable to cybersecurity, including Bachelors in Information Systems, Computer Science, Management Information Systems and/or Masters in Cybersecurity, and hold professional certifications, including Certified Information Systems Security Professional, Offensive Security Certified Professional, Global Information Assurance Certification (GIAC) Defensible Security Architecture, GIAC Forensic Examiner, GIAC Incident Handling, and GIAC Open Source Intelligence. Our SVP IT Infrastructure & Security holds a Cybersecurity and Privacy Law Certificate from Mitchell Hamline School of Law, and has 28 years of experience in systems, network, and database administration. Additionally, our Senior IT security department manager is an Offensive Security Certified Professional, and holds GIAC Security Leadership (GSLC), with over 25 years of experience in network performance, availability, and protection.


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission.