text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, systems, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability and penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company with our information technology partner regularly engages assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the CTO and GC who shares data with the SLT and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The CTO, in coordination with the SLT, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The CTO and the SLT, through its information technology partner receives regular reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations. On an annual basis, the Audit Committee and the Board discuss the Company's approach to cybersecurity risk management with the members of the SLT, which includes the Company's CTO, GC, and Chief Financial Officer ("CFO").

companyName: Longeveron Inc.

ticker: LGVN

secItem: Item 1C


text: The CTO, in coordination with the SLT, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams are prepared to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the Company's information technology partner, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Company's SLT and Audit Committee, when appropriate.


text: The Company's information technology partner has worked in information technology and information security for over 30 years with over 300 employees with six locations in the United States. A virtual Chief Information Officer ("vCIO") from the partner works directly with the Company to align business and technical strategies, decisions, and implementations. The CTO has nearly 20 years of experience in the pharmaceutical and biotech industry managing programs and projects across a variety of implementation methodologies and risk factors and holds undergraduate degrees and certifications in his respective field. The Company's Chief Executive Officer, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personal data, including that of our employees, consultants and clinical trial participants (Information Systems and Data).

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The Chief Financial Officer, Chief Business Officer, Chief Accounting Officer, Senior Vice President of Legal, Vice President of Information Technology, and certain third-party providers are members of our Cybersecurity Risk Management Committee and help identify, assess and manage the Company's cybersecurity threats and risks. This Cybersecurity Risk Management Committee, which reports to the Audit Committee of the Company's Board of Directors, is responsible for identifying and assessing risks from cybersecurity threats. The Cybersecurity Risk Management Committee monitors and evaluates our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, evaluating certain cybersecurity threats reported to us, conducting internal and external audits of certain environments and systems, and performing third-party threat assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan; information security program; acceptable use policy; incident detection and response tools; risk assessments of certain environments and systems; encryption of certain data; network security for certain environments and systems; access controls for certain environments and systems; data segregation of certain data; physical security; asset management; third-party systems monitoring; employee cybersecurity training; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Cybersecurity Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, such as legal counsel, cybersecurity consultants, forensic investigators, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software application providers, hosting companies, and contract research organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including reviewing security questionnaires and imposing contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—General risk factors—If our information technology systems, or those of any of our third-party partners (such as contract research organizations and clinical trial sites), or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; additional costs; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer, Vice President of Information Technology and Senior Vice President of Legal, working closely with our third-party information technology team; the senior staff members of our third-party information technology team have been in business providing services to similarly situated companies in our industry for more than approximately 28 years, including extensive experience addressing complex information technology and cybersecurity matters. Company management has over 27 years of experience in cybersecurity and information technology matters, including multiple senior information technology leadership roles supervising cybersecurity teams and establishing cybersecurity risk assessment programs in the biotech industry.


text: In particular, the Chief Operating Officer is responsible for hiring appropriate personnel and third-party vendors, communicating key priorities to relevant personnel, and, in concert with members of the Cybersecurity Risk Management Committee, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy. Our Chief Operating Officer, Vice President of Information Technology and Senior Vice President of Legal, in consultation with our third-party information technology team, is responsible for maintaining cybersecurity-related budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Cybersecurity Risk Management Committee. This group works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives reports concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them, including during audit committee meetings and other periodic updates. These reports are provided by members of the Company's management team responsible for such reporting, including the Cybersecurity Risk Management Committee. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As a government contractor, GEO routinely processes, stores, and transmits large amounts of "Personally Identifiable Information". As such, we understand the criticalness of having a robust cybersecurity program that protects company assets as well as our clients' data. Our customers, suppliers, service providers, subcontractors, and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: GEO GROUP INC

ticker: GEO


text: The Board, through its Cybersecurity and Environmental Oversight Committee, oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), quarterly or as needed briefs the Board of Directors on our cybersecurity and information security posture, and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our current CISO has extensive information technology and program management experience and has served many years in our corporate information security organization. In addition, our CISO has a certificate in Cybersecurity Oversight from the Carnegie Mellon University Software Engineering Institute. The corporate information security organization oversees, manages, and continually enhances a robust enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture that supports information security, which we believe improves our cybersecurity.


text: The corporate information security organization has implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the Center for Internet Security controls. In addition, GEO has robust policies and procedures related to cybersecurity and general IT practices that include but are not limited to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. These initiatives are supported by a Managed Security Service Provider ("MSSP") that provides continuous intelligence and threat assessments, including such risks from cybersecurity threats associated with our use of any third-party service provider. Also, as part of the program, GEO engages third party cybersecurity organizations to perform bi-annual assessments of the environment. Identified cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment is presented to the Board.


text: Notwithstanding the extensive approach we take to prevent cybersecurity breaches, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse financial impact to our business. While GEO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. There have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect GEO, including its business strategy, results of operations, or financial condition.


text: We maintain a risk-based cybersecurity program, including various protections designed to safeguard against cyber attacks and manage material information and cybersecurity risks to address the confidentiality, integrity, and availability of our critical systems and information. This program includes: • the implementation of access controls, firewalls and virus detection software; • the establishment (and periodic testing) of our disaster recovery plan, including protecting against business interruption by backing up our major systems; • periodic scans of our environment for vulnerabilities and engagement of third parties to perform penetration testing and assess effectiveness of our information security practices; and • the maintenance of insurance that currently includes cybersecurity coverage.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: In the normal course of business, we also collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, customer information including bank account information and invoice and payment information, sensitive third-party information and employee information, and certain personal information. To protect this information and our systems, our existing cybersecurity protections include monitoring and detection programs and technical security measures. Additionally, we have processes in place that are designed to assess and manage cybersecurity risks associated with our use of higher-risk third-party service providers.


text: Governance—Board Oversight and Management's Role in Assessing and Managing Cybersecurity Risks Our board of directors and Chief Executive Officer have ultimate accountability for risk. This includes oversight of our risk management program, which includes risks from cybersecurity threats. Our board of directors and Chief Executive Officer, including through the risk management committee of our board of directors, provide oversight to ensure the appropriate measures are in place so that management can identify, assess, prioritize, and respond to risk, including cybersecurity risks. We believe our board of directors, the risk management committee of our board of directors, and our Chief Executive Officer collectively have the requisite experience, knowledge, inquisitiveness, and visibility into the design and operation of our information security practices to fulfill this responsibility effectively.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks At an operating level, our cybersecurity program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO has over 20 years of information technology experience that spans architecture and design, governance, disaster recovery, department development, and risk identification and remediation. In addition, our CISO has over 25 years of cybersecurity experience with a skill set that includes incident and remediation management, company-wide training, and the creation and implementation of cybersecurity compliance programs that address administrative, physical, and technical safeguards.


text: Our cybersecurity program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity leadership regularly reports to the board of directors and its risk management committees on information security and cybersecurity matters, including risk assessments, incident responses, and strategic initiatives aimed at mitigating potential threats. For example, the risk management committee in conjunction with management and our enterprise risk management team reviews and discusses cybersecurity metrics on a regular basis that include phishing incidents and training, vulnerability management, and security incident trends.


text: We have implemented policies, standards, and technical controls based on the National Institute of Standards and Technology ("NIST") framework with the aim of protecting our networks and applications, to safeguard the confidentiality of sensitive information entrusted to us. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Material Impacts from Cybersecurity Threats and Incidents Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyber-attack will not occur. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: In early April 2023, we detected a cybersecurity incident as part of our routine security monitoring protocols. In response to the incident, we undertook an investigation with the support of leading cybersecurity experts, reached out to law enforcement, accelerated planned security enhancements, and have taken and will continue to take actions to implement additional safeguards.


text: The investigation determined that the incident primarily affected systems that were used for back-office activities. Data was exfiltrated from these systems and posted on the dark web. The data consisted of confidential information from our files, including personally identifiable information, primarily information of our employees, former employees, and their dependents, and the bank account information of some customers and other sensitive Company information. We cooperated with inquiries about the incident from three state consumer and financial service regulators, provided notices to impacted customers and individuals, and complied with regulatory requirements of various states that address notice and credit monitoring. We delivered all required notices during the fourth quarter of 2023 and consider our investigation to be complete.


text: During the fiscal year ended December 31, 2024, we incurred $ 302 in response costs related to the incident, including professional services and legal fees, before insurance recoveries. We do not expect to experience material expenses and costs associated with our response to this cybersecurity incident during 2025. No liability for losses has been recorded related to the incident as of December 31, 2024.


text: We maintain cyber insurance coverage and have tendered claims for certain expenses incurred in connection with this event. During the year ended December 31, 2024, we recovered $ 2.1 million from our insurer. Insurance recoveries are recorded as a reduction of general and administrative expense. Refer to Note 13 of the Notes to Consolidated Financial Statements included elsewhere in this Annual Report on Form 10-K for additional information concerning the incident.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, financial, or competitive in nature, information related to our clinical trials and preclinical studies and information of our employees, or Information Systems and Data.

companyName: Kura Oncology, Inc.

ticker: KURA


text: Our Information Technology, or IT, department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, evaluating threats that are reported to us, using external intelligence feeds, engaging in internal and external audits, and engaging third parties to conduct threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a disaster recover/business continuity plan and information security policy, encrypting certain data, data segmentation, network security controls, access and physical security controls, asset management, tracking and disposal, systems monitoring, employee training, maintaining cyber insurance and using third party threat detection software.


text: The head of our IT department, who has more than 25 years of experience in IT and more than 15 years of experience in cybersecurity for public companies, reports to our Chief Operating Officer and works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We have established an Incident Review Team, which consists of representatives of our Finance, IT and Legal departments, to investigate, evaluate and respond to cybersecurity incidents. The Incident Review Team is responsible for escalating confirmed cybersecurity incidents to a Materiality Assessment Team, consisting of members of management. The Materiality Assessment Team is responsible for reporting cybersecurity incidents to the audit committee of the board of directors, as appropriate based upon the nature of the incident (or series of incidents).


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity software, and darkweb monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, CROs and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, the access to be provided to such Information Systems and Data, and the identity of the provider, our vendor due diligence involves different levels of assessment of systems and controls designed to help identify cybersecurity risks associated with a provider. In addition, we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the head of our IT department. The head of IT is responsible for integrating cybersecurity risk considerations into our overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Materiality Assessment Team, comprised of members of management. In addition, our cybersecurity incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The audit committee receives regular reports from the head of our IT department concerning the measures we have taken to monitor and evaluate our cybersecurity threat environment and any cybersecurity incidents that have occurred.


text: As an HCM company, we face a multitude of cybersecurity threats from threat actors seeking to access, compromise access, or leverage the data we possess for malicious ends. Review of our information security program, including our cybersecurity policies, standards, and processes, is integrated into our Enterprise Risk Management ("ERM") program which is based on the COSO Enterprise Risk Management Framework and International Organization for Standardization ("ISO") 31000, the two most widely used global standards for ERM.

companyName: Dayforce, Inc.

ticker: DAY


text: Our information security program aligns with recommended practices in security standards issued by ISO, American Institute of Certified Public Accountants (SSAE18), National Institute of Standards and Technology ("NIST") and other industry sources. Specifically, we maintain several ISO certifications (ISO 27001, 27701, 27017, 27018, 27036), NIST 800-171 compliance, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. We have invested in our data security team, information security program, and security environment in an effort to identify, prevent, and mitigate cybersecurity threats and promptly identify and respond to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program to ensure that it remains reasonable and appropriate with respect to changes in the security threat landscape, available technology, security vulnerabilities, and legal and contractual requirements applicable to us, is a continuous effort.


text: We believe that effective cybersecurity depends upon the successful implementation and maintenance of a comprehensive information security program. Deploying suitable security technology, which encompasses analytics and automation, and leveraging the expertise of highly skilled security and risk professionals, is crucial in our strategy. Additionally, we prioritize data governance and data-centric security as integral components of our approach in an effort to ensure compliance, uphold privacy standards, and safeguard customer and enterprise data.


text: We continue to enhance our capabilities in cloud security and assurance testing, security operations and automation, product security, and enterprise risk management. To combat the evolving cybersecurity risk landscape and the enhanced level of sophistication of cybersecurity threats, management has prioritized five areas of our information security program: global standards and operations, a risk-aware workforce, product security, detection and response, and data governance management. In addition, we maintain cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: We contract with several outside cybersecurity experts to audit and test security controls on a regular basis. Any risks or control gaps identified as a result of such assessments, audits, and reviews are reported to the senior leadership of all functional areas of the Company, the Audit Committee of the Board (the "Audit Committee"), and the Board as appropriate, and we adjust our cybersecurity policies, standards, and practices as necessary.


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry-leading practices, and we evaluate them for additional information, product, and physical security requirements.


text: We face a number of risks from cybersecurity threats, which may materially affect our business, financial condition, and results of operations, because our business is dependent on the successful operation of our payroll, transaction, financial, accounting, and other data processing systems. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have detected all cybersecurity incidents. Please refer to Part I, Item 1A, "Risk Factors" for further discussion of our cybersecurity-related risks.


text: Our commitment to cybersecurity begins at the Board and extends to the senior leadership of all functional areas of the Company. Our Audit Committee oversees our risk management process at the Board level. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management, including in the areas of cybersecurity and other information technology risk and privacy.


text: The Company's cybersecurity program is supervised by our Chief Information Security Officer ("CISO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity, strategy, policy, standards, and processes. The CISO provides quarterly updates related to the cybersecurity program, including any notable incidents at regularly scheduled Audit Committee meetings. The CISO updates include details regarding the magnitude, financial impact, and remediation of cybersecurity incidents. Members of our Board and senior Company executives participate in annual tabletop exercises that focus on testing response plans to ransomware, cloud security, payroll disruption, and other incidents. In addition, in order to deploy a consistent cybersecurity framework, and to manage the risk of social engineering, software downloads, and phishing, we educate employees globally through ongoing security awareness training.


text: Our CISO has over 25 years of experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and is a member of the National Association of Corporate Directors ("NACD"). Our CISO works closely with our Vice President, Enterprise Risk, Compliance and Service Management to assess and manage the cybersecurity element of our ERM program. In the area of risk, the Vice President, Enterprise Risk, Compliance and Service Management focuses on risk management, business continuity planning, crisis management, operations management, and executive and Board reporting.


text: Our CISO and Vice President, Enterprise Risk, Compliance and Service Management report to our Chief Digital Officer, who in turn reports to our President and Chief Operating Officer. These officers drive our cybersecurity priorities at the executive level.


text: We have established a documented cybersecurity incident materiality assessment and disclosure program that is jointly managed by our Incident Response, Cybersecurity, and Corporate Legal teams. This program calls for the immediate assessment of potentially material cybersecurity incidents, and the appropriate escalation to our cross-functional Disclosure Committee in order to facilitate the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner and elevated to our Audit Committee or Board, as appropriate.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. All companies utilizing technology are subject to threats and potential breaches of their cybersecurity programs. Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including customer and bank information. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our board of directors (the "Board"), through our Audit Committee, and our management, are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and procedures, and cyber security safeguards will be sufficient to protect against all possible threats and properly followed in every instance, or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on applicable banking regulations, including the Interagency Guidelines Establishing Information Security Standards ("Interagency Guidelines"), and a Cybersecurity Assessment Framework. Our cybersecurity program in particular focuses on the following key areas: Process


text: Our cybersecurity risks are identified and addressed through a cross-functional approach that includes coordination through our Corporate Information Security Committee, which includes senior managers in our information security, information technology, operations, risk, compliance and privacy departments or functions. Key security, operations, risk, compliance and privacy stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to follow state and federal regulations to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response, Recovery Planning and Disclosure Our Bank is subject to the Interagency Guidelines, as noted above, and our Company is subject to the SEC's Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies adopted in July 2023. In accordance with these rules and regulations, we have sought to establish comprehensive incident response and recovery plans, and we continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our planned response to a cybersecurity incident. With respect to the potential disclosure of material cybersecurity incidents, we have designated our management Financial Review and Disclosure Committee as the proper forum to address such issues. Members of Financial Review and Disclosure Committee include the Chief Financial Officer ("CFO"), General Counsel, Chief Operating Officer ("COO"), Chief Risk Officer ("CRO"), and the Chief Information Security Officer ("CISO").


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, in the manner and to the extent required by our bank regulators and applicable regulations. Such third-party providers are subject to security risk assessments at the time of onboarding, and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by such third-party providers and other industry sources. In addition, we require our third-party providers to meet appropriate security requirements, controls and responsibilities and to investigate and report on security incidents that have impacted their operations, as appropriate.


text: Education and Awareness Our policies require each of our employees to participate in our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also conduct regular phishing email exercises and training to test employees of security practices to mitigate this threat.


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. These assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board, through its Audit Committee, oversees the management of our cybersecurity program led by our CISO. The Audit Committee receives regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, including material security risks and information security vulnerabilities. Specifically, the Audit Committee receives regular updates from our CISO on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, and any relevant internal and industry cybersecurity incidents.


text: Management's Responsibility The Bank's cybersecurity program is managed by our CISO, who reports to the Audit Committee. Management's Corporate Information Security Committee (the "Security Committee"), led by our CISO, is a governance body that drives alignment on security decisions across multiple departments and functional areas within the Bank, while monitoring and managing Cyber risks to minimize exposure to the Bank. Members of the Security Committee include the Chief Information Officer ("CIO"), the CRO, and the COO. The Security Committee oversees processes for assessing, identifying, and managing material risks from cybersecurity threats. The Security Committee meets at least quarterly to review cybersecurity performance metrics, identify cybersecurity risks, and assess the status of approved cybersecurity enhancements. The Security Committee also considers and makes recommendations on cybersecurity policies and procedures, service requirements, and risk mitigation strategies.


text: Our CISO has more than 27 years of Information Technology and 21 years of Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 25 years of information technology experience and 18 years of experience in the financial services industry. Our CRO has more than 33 years of experience in Banking and over 15 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with over 35 years of banking experience in Operations, Vendor Management, IT, Security, Treasury Management and Payment Operations.


text: The Company depends on the proper functioning, availability, and security of its information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties, grants limited access to the Company's systems to third parties providing specific outsourced functions or other services, and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the Company's critical information systems, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees, and others (including joint venture partners and Curbline Properties), could result in liability for the Company to third parties and have a significant impact on the Company's operations and reputation.

companyName: SITE Centers Corp.

ticker: SITC


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the Company's networks, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. This oversight has been integrated into the Company's enterprise risk management system. For example, the Company's management team reviews the findings, if any, of the internal audit team's assessments, analyzed the identified risks, and takes action based on the Company's overall risk profile. In order to assess the risks posed to the Company's information systems by third-party service providers and vendors, the information technology department, coordinating with the Company's internal audit services team, evaluates new software and network application vendors' contracts, internal policies, certifications, and System and Organization Controls ("SOC") reports during the procurement of solutions and services.


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the Company's networks, the Company's information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. The Company contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, the Company has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates to reduce the Company's risk.


text: The Company has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect the Company's on-site data center, and electrical power protection and generation facilities. The Company also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.


text: The Company conducts annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of the Company's risk mitigation efforts. The Company also maintains cybersecurity insurance; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Under the leadership of the Company's Chief Technology Officer, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the Company's information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors ( the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part our overall risk assessment process.


text: The Company has experienced issues from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of its information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies—A Disruption, Failure or Breach of the Company's Networks or Systems, Including as a Result of Cyber-Attacks, Could Harm Its Business."


text: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We are committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to effectively mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Biannual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: We have insurance coverage in place for certain potential liabilities and costs relating to cybersecurity risks, data security incidents and/or network security breaches, but this insurance is limited in amount, subject to a deductible, and may not be adequate to cover us for all costs arising from these incidents.


text: Use of Consultants and Advisors: We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to evaluate our cyber processes including an assessment of our incident response procedures.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and company and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. All of the Audit Committee members are independent directors. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer, or CDIO, is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.


text: Despite ongoing threats like cyber-attacks, phishing, and ransomware, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats.


text: We rely on digital technology to conduct our businesses and interact with customers, policyholders, agents, and vendors. With this reliance on technology comes the associated security risks from using today's communication technology and networks.

companyName: HCI Group, Inc.

ticker: HCI


text: The goal of our cybersecurity risk management strategy is to protect the privacy, integrity, and availability of our critical systems and information. Our processes identify, assess, and manage material risk from cybersecurity threats as part of our entity-wide risk management efforts. To safeguard our data and the data of our customers, management utilizes a multi-layered approach consisting first of an external security operations center company that specializes in the detection and containment of cyber-attacks. For protection of endpoint devices connected to our network, we use the tailored security software of a third-party consultant company for managed detection and response. Perimeter defense technology is used to filter e-mail for threats from malware viruses and e-mail phishing attempts. We also detect threats through the use of our firewalls that monitor incoming and outgoing network traffic.


text: Tools utilized to prevent threats include multifactor authentication, e-mail security services, mobile e-mail security policies, virtual private networks, third-party security experts, and timely applied software patches, among others. We engage in annual penetration testing, disaster recovery testing, internal and external audits of our cybersecurity controls and simulated cyberattack scenarios to gauge our preparedness for these situations. In addition, employees are required to pass a mandatory cybersecurity training course annually and receive periodic phishing simulations to facilitate recognizing phishing attempts. We carry Cyber Insurance which includes access to a Cyber Incident Response team in the case of a cybersecurity event.


text: Management of cybersecurity also extends to third-party service providers we use for specialized purposes such as payroll processing, investment tracking, regulatory financial reporting, and equity compensation plan administration. Our communication with these providers is protected by the safeguards within our security operation center. In addition, we annually obtain a Service Organization Controls (SOC) report on the suitability and operating effectiveness of the providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective controls over unauthorized access at third party service providers.


text: We respond to cybersecurity events in accordance with our Cyber Security Incident Response Plan (CSIRP), which follows the guidance of the National Institute of Standards and Technology Cybersecurity Framework and provides for assessment, mitigation, and if necessary, remediation of any effects of a system breach. We also conduct annual breach simulations with internal information technology teams to test each step of our CSIRP.


text: There have been no cybersecurity events in the past that have materially affected the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to respond to sophisticated and rapidly evolving attempts to overcome our security measures. Such continuing threats could have a variety of adverse business impacts. See Item 1A – "Risk Factors" under the heading "Security and fraud risks" above for additional information on risks to our business from cybersecurity incidents and related matters.


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the President of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the President have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.


text: Our Board receives periodic reports on cybersecurity risks and any material cybersecurity incidents. One member of our Board of Directors, Paresh Patel, has information technology expertise.


text: We recognize the critical importance of cybersecurity and data privacy in safeguarding our operations, sensitive data, and maintaining the trust of our stakeholders. We acknowledge the significance of cybersecurity incidents and threats as potential risks that may impact our operations and information systems. We have developed and implemented cybersecurity and data privacy programs in accordance with the requirements of ISO standards 27001:2022 and 27701:2019, which are intended to appropriately preserve the confidentiality, integrity, and availability of information maintained by our company. These programs identify, select, maintain, operate, and improve cybersecurity and privacy controls.

companyName: EXPONENT INC

ticker: EXPO


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are designed to preserve the confidentiality, integrity, and availability of our information systems and the information residing therein. Our cybersecurity incident response plan is based on the NIST 800-61r2 "Computer Security Incident Handling Guide." This plan is used to process security events identified through our real-time, 24x7 monitoring, and is also used to conduct security incident tabletop exercises. The incident response plan includes detailed steps for incident leadership, escalation to established partners, response protocols based on the type of incident, responsibilities for follow-up and reporting, and steps to capture lessons learned and improvement opportunities. Our vulnerability management processes include real-time monitoring for vulnerabilities and standardized reporting for managing remediation efforts. Our cybersecurity risk management processes are integrated into our overall risk management system to ensure alignment with our business objectives and strategies. We engage assessors, consultants, auditors and other third parties to execute certification audits, penetration tests, and security framework risk assessments. These external entities provide specialized expertise and insights to enhance the effectiveness of our cybersecurity risk management processes.


text: We have established processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, including cloud service providers and AI system. We conduct due diligence assessments and evaluate contractual obligations to mitigate potential risks arising from third-party relationships.


text: Cybersecurity threats, including previous incidents, have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the evolving nature of these risks and remain vigilant in our efforts to mitigate potential impacts.


text: Our Board of Directors provides oversight of risks from cybersecurity threats. The Security and Privacy Management Committee (the "SPMC") consists of our Chief Financial Officer, General Counsel, Vice President of Information Technology, Chief Human Resources Officer, Director of Information Security and Director of Environmental Health and Safety. The SPMC is tasked with ensuring risks are adequately addressed within our governance framework.


text: We maintain a dedicated team of cybersecurity professionals. The Director of Information Security, the Information Security team, the SPMC, the Vice President of Information Technology, and the Information Technology leadership team are principally responsible for assessing and managing cybersecurity risks for our company. These individuals possess relevant expertise in cybersecurity risk management and are equipped to address the evolving nature of cyber threats. Our Director of Information Security has over 20 years of cybersecurity experience, holds several professional certifications and is an adjunct faculty member teaching courses on information security management and governance. Our cybersecurity professionals have a proven track record of executing strategic security objectives across various sectors, including utility, government, healthcare, and consulting. They bring with them experience in designing, implementing, and managing information security programs focused on quality, performance, and compliance.


text: Our information security team and our third-party security service providers actively monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, ensuring timely response and resolution. Processes are in place to inform relevant management positions and committees about emerging threats and incident response activities. The Director of Information Security provides regular updates on cybersecurity risks and incidents to the Board of Directors, the SPMC, and IT leadership.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: SKECHERS USA INC


text: We have developed and implemented a Cybersecurity Risk Management Program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We leverage industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center for Internet Security ("CIS") framework to inform how we identify, assess and manage cybersecurity risks relevant to our business.


text: Our Cybersecurity Risk Management Program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, and incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • engage ment of third parties for our 24/7 monitoring, detection, and response; regular penetration testing, program controls assessment, and proactive incident preparedness activities.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. Our Senior Vice President ("SVP") of Information Technology and the Vice President ("VP") of Information Security have overall responsibility for assessing and managing our material risks from cybersecurity threats. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity at least annually, and receives an update quarterly on information security and cybersecurity from materials provided by the VP of Information Security.


text: The VP of Information Security oversees the Information Security Steering Committee ("Steering Committee"), which provides education on the Company's cybersecurity programs and controls to key members of the Company. The Steering Committee meets quarterly and is comprised of members from the Executive Leadership Team, including the Chief Financial Officer and Executive Vice President of Business Affairs, as well as the SVP of Information Technology, VP of Information Security, VP of Corporate Communications, SVP of Digital Innovation, and Head of Global Human Resources.


text: Cybersecurity risk management is led by our VP of Information Security and our SVP of Information Technology, who reports to our Chief Operating Officer, who are generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The VP of Information Security manages a team of cybersecurity professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, digital security and regulatory compliance.


text: Our VP of Information Security has over 15 years of experience in technology and information security, serves on the board of directors of the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") and holds several cybersecurity and risk management certifications. Our SVP of Information Technology has over 30 years of information technology management and cybersecurity experience and has held leadership roles overseeing all aspects of information technology operations for multiple Fortune 500 and Fortune 50 global companies, particularly in the retail and media & entertainment sectors.


text: We continue to invest in cybersecurity and resiliency of our networks and adapt our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A "Risk Factors."


text: Cybersecurity is critical to the delivery of our services to our clients. We face cybersecurity threats that are common to most industries. We have a cybersecurity risk management program in place that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. This program is a key component of our enterprise risk management program. The Company's Board is responsible for oversight of the Company's information technology systems, including cybersecurity, and has delegated such oversight to the Audit Committee. The Audit Committee regularly reviews the status of the initiatives such as the seeking of certifications associated with our information technology systems and receives regular updates on matters relating to information technology and cybersecurity. Our corporate information security organization, led by our Senior Director of IT who reports to our Chief Financial Officer, is responsible for our overall information security strategy, policy, security, operations and cyber threat detection and response. Our current Senior Director of IT has an extensive background and experience in information technology management and design, and data security. An integral part of our cybersecurity framework is our Security Response Team which is responsible for the detection, review, and response to cybersecurity incidents. In the event of a security incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas as well as senior leadership and the Board, as appropriate.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained our second ISO 27001 certification.


text: To further bolster our cybersecurity controls, we also have a third-party risk management program in place applicable to all of its contractors, vendors, and service providers which includes risk assessments, cybersecurity questionnaires, data privacy addendums, and contractual flow-downs of legal and regulatory requirements. We also require our contractors, subcontractors, vendors and service providers to report security incidents to us without undue delay.


text: To date, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business operations or financial condition. Despite the extensive approach we take to cybersecurity, prevention of a cybersecurity incident cannot be completely guaranteed. Please refer to "Item 1A. Risk Factors – We rely on information technology and security systems and any damage, interruption or compromise of our information technology and security systems or data could disrupt and harm our business" and "Item 1A. Risk Factors – A breach of our information technology and security systems could materially adversely affect our business" for further information.


text: At Outset, we strive to protect the confidentiality, integrity and availability of the personal data entrusted to us. We continue to invest in our cybersecurity program in an effort to enhance our ability to prevent, detect, contain, and mitigate cybersecurity threats.

companyName: Outset Medical, Inc.

ticker: OM


text: Oversight of our information security program, including oversight of risks related to cybersecurity threats and the assessment and management of such risks, is accomplished through a governance structure which includes our Board, Audit Committee, and executive management.


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.


text: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.


text: Our full Board and Audit Committee are kept informed about significant risks related to cybersecurity, including enterprise-level risks from cybersecurity threats. The Board receives written updates, generally on a quarterly basis, regarding the status of our information security program. In addition, the Audit Committee receives in-person updates on our information security programs on at least an annual basis. These updates generally cover topics such as our cybersecurity strategy, the threat landscape, key cybersecurity risk areas facing the organization, any key findings of audits and testing, the status of key initiatives, as well as a review of any major incidents.


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our VP of Information Technology manages our information security program.


text: Executive leadership Our VP of Information Technology and the information security team periodically present information about the Company's information security program, including program goals and actions, progress against key initiatives and key risks, to our executive leadership team. As described above, significant risks related to cybersecurity are escalated to the Audit Committee and/or the full Board as appropriate.


text: Cross-functional management engagement We have established a committee comprised of leaders from key functions across the Company including, but not limited to, information security, IT, engineering, legal, privacy, finance, and people operations. Members of this committee generally meet regularly to review the Company's cybersecurity program, the evolving threat landscape and key related action items.


text: Governance of information security risks We have also established a risk governance committee, which generally meets on a quarterly basis. This committee, which is sponsored by our VP of Information Technology, is comprised of Company leaders from information security, information technology (IT), legal, privacy, finance, operations, and other functions, who have experience in managing cybersecurity risks, who review the cybersecurity threat landscape, and who evaluate key emerging data security risks. The committee reviews certain cybersecurity-related risks facing the company; discusses open policy exceptions and key risk indicators; and manages cybersecurity risks presented by the information security team and proposed mitigation actions. Members of this committee review the key risks identified as an outcome of our cybersecurity risk management strategy described below.


text: Our cybersecurity risk management program is designed to identify, assess, and manage reasonably foreseeable material risks facing Outset from cybersecurity threats. We identify cybersecurity risks in various ways, including but not limited to the ongoing monitoring of our systems using various technologies and processes, monitoring of emerging threats, third-party penetration testing of our device and systems, vulnerability scanning and assessments, and cross-functional risk discussions. We have also received Systems and Organizations Controls 2 (SOC 2) certification for Tablo cloud. We have developed processes to help us track, prioritize, and manage identified cybersecurity risks. For example, risks are defined, categorized, and assigned a risk rating based on potential impact and likelihood, which informs acceptance, mitigation or remediation actions which should be undertaken. The Risk Governance Committee reviews key identified risks and discusses related mitigation actions in response to such risks.


text: We have operationalized key processes to help us identify, assess, manage, and mitigate reasonably foreseeable risks from potential cybersecurity threats. For example: • USE OF THIRD PARTIES: We engage third-party cybersecurity consulting firms to assist us with various aspects of our cybersecurity risk management program. For example, we currently consult with third party firms to assist with our annual penetration testing for the Tablo device, Tablo cloud and IT infrastructure. In addition, In addition, we used a third-party audit firm accredited by the American Institute of Certified Public Accountants (AICPA) to support us in the SOC 2 certification process for Tablo cloud. • VENDOR ASSESSMENT: We leverage a third-party risk assessment tool to help us identify cybersecurity, privacy, and operational related risks associated with our use of certain third-party service providers. • INCIDENT PREPAREDNESS AND RESPONSE: We maintain a Cybersecurity Incident Response Plan (IRP) which establishes a framework designed to enable us to respond to cybersecurity incidents in a consistent, timely and effective manner. Our IRP outlines procedures for identifying, reporting, investigating, assessing, and responding to cybersecurity incidents, including incident response team formation, roles and responsibilities by department, and communication and escalation protocols. Depending on the severity of the cybersecurity incident, our IRP contemplates escalation to our executive leadership team and the Audit Committee and/or the full Board, as well as periodic briefings on developments related to the incident response. We periodically review and update our IRP and have conducted training of key team members regarding the IRP. In addition, we have conducted a tabletop exercise to simulate a response to a cybersecurity incident. • SECURITY STANDARDS: Our IT and Tablo cloud security architecture are designed to comply with the HIPAA Security Rule. In addition, our Tablo cloud security architecture leverages recognized frameworks designed to protect customer data. For example, we have received SOC 2 certification for Tablo cloud and we are working to align our processes, protocols and product software with the FDA's recent cybersecurity guidance finalized in September 2023. We periodically examine our security controls and take steps to review, prioritize and address key compliance gaps where identified, using a risk-based approach. • TECHNICAL SAFEGUARDS: We perform information security maturity assessments and penetration testing for the Tablo device and Tablo cloud (including in connection with new product features and services), as well as for our IT infrastructure. We conduct vulnerability scans across key assets, core infrastructure, and endpoints to identify potential vulnerabilities and potential cybersecurity events. We assess and prioritize the remediation of vulnerabilities and other cybersecurity risks identified through these activities, using a risk-based approach. • THREAT LANDSCAPE AWARENESS: We regularly receive and review threat landscape bulletins from Health Information Sharing and Analysis Center (H-ISAC), Cybersecurity and Infrastructure Security Agency (CISA) and others, and incorporate enhancements into our ongoing cybersecurity program based on this review. • INSURANCE: We maintain information security risk insurance coverage to mitigate potential losses in the event of a business disruption.


text: • TRAINING: All Outset employees are assigned HIPAA and information security training as part of the new employee onboarding process and refresher training is assigned annually. Our IT team also conducts continuous automated phishing simulation campaigns, which can trigger additional training for employees on how to recognize social engineering attempts (e.g., phishing, smishing, etc.). We track employee performance on phishing exercises to help us monitor the awareness of our employees and inform future training priorities. For employees whose jobs require access to sensitive data, including PHI, additional security training may be required.


text: Risks from Cybersecurity Threats Our business relies on secure and continuous processing of information and the availability of our IT networks and IT resources, as well as critical IT vendors that support our technology and data processing operations. Security breaches, computer malware and computer hacking attacks have become more prevalent across industries and may occur on our systems or those of our third-party service providers. Attacks upon IT systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may face increased risks from cybersecurity threats due to our reliance on internet technology and the increased frequency of employees working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.


text: We regularly monitor for, defend against, and respond to cybersecurity threats to our networks and information systems, as well as other types of security threats and incidents. Despite our information security efforts, our facilities, systems, servers, platforms and data, as well as those of our third-party cloud and other service providers and Tablo's two-way wireless communication system, may be vulnerable to privacy and information security incidents and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. These include data breaches, viruses or other malicious code, exploitation of known or unknown vulnerabilities, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, insider threats or other security or IT incidents caused by threat actors, technological vulnerabilities, or human error. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information to gain access to the data and personal information we maintain. As of the date of this Annual Report, we are not aware of any material adverse impact to our business or operations from cybersecurity threats or incidents. We do, however, recognize that the cybersecurity landscape evolves rapidly and that we are not immune to such incidents. If we, or any of our third-party service providers, fail to comply with laws requiring the protection of sensitive personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, or if our incident response, containment or mitigation measures are inadequate in the face of a particular data breach or cybersecurity incident, we may face significant business interruptions, incur reputational damage, and be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, and mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. If we are unable to prevent or mitigate the impact of such security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.


text: In addition, manufacturing operations at our Mexico-based facility may also suffer disruptions from cybersecurity attacks, which could negatively impact our ability to produce Tablo consoles and cartridges, restrict or delay our ability to deliver products to our customers and meet our customers' demand on a timely basis, and result in customer dissatisfaction, all of which would adversely impact our results of operations. Moreover, we use Amazon Web Services to support Tablo's cloud connectivity and any disruption of service as a result of cybersecurity attacks could interrupt or delay our ability to receive and deliver certain treatment and reporting information from and to providers and patients. The continuing and uninterrupted performance of Tablo is critical to our success and any repeated or prolonged system failures may damage our reputation, reduce the attractiveness of Tablo to providers and patients, and result in decreased demand for Tablo, thereby adversely affecting our business, financial condition and results of operations. For more information on the risks we face from cybersecurity threats and the potential impacts on our company, see the section above entitled "Risk Factors" under Part I, Item 1A, including the risk factor entitled "We may face additional costs, loss of revenue, significant liabilities, harm to our brand, decreased use of our platform and business disruption if there are any security or data privacy breaches or other unauthorized or improper access."


text: The Company is externally managed by the Advisor and has no employees or internal information systems. Thus, the Company relies on the Advisor, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO") oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. The CCO and the Advisor also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Company to information technology vulnerabilities, and receive reports from the Company's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Direct Lending Corp.


text: Specifically, the Company relies on the enterprise risk management ("ERM") framework of BlackRock, Inc. ("BlackRock") for the Company's cybersecurity risk management and strategy. The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: o Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: o Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: o Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.


text: o Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: o Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.