text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: BREIT's board of directors is responsible for understanding the primary risks to our business. The audit committee of BREIT's board of directors is responsible for reviewing BREIT's and the Adviser's IT security controls with management and evaluating the adequacy of BREIT's and the Adviser's IT security program, compliance and controls with management.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT

secItem: Item 1C


text: Blackstone's CSO reports to both our executive officers as well as our board of directors and/or our audit committee annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such annual reports, our board of directors and/or the audit committee receive periodic updates from Blackstone on the primary cybersecurity risks facing us and our Adviser and the measures we and our Adviser are taking to mitigate such risks, as well as on changes to our and our Adviser's cybersecurity risk profile or certain newly identified risks.


text: We have integrated cybersecurity risk management into our overall risk management framework and include cybersecurity in our risk management processes and procedures and in our decision-making about and evaluation of such processes and procedures.

companyName: Sezzle Inc.

ticker: SEZL


text: As part of our cybersecurity risk management, we regularly assess risks from cybersecurity and technology vulnerabilities and monitor our information systems for potential threats. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. In light of the industry in which we operate and our processing of sensitive information, we engage external auditors to annually assess our internal controls governing our services and data, to conduct a payment card industry data security standard review of our security controls protecting payment information, and to perform third-party penetration testing of our payment information and related systems. In addition, we engage third-party service providers to monitor our information storage and systems and to conduct evaluations of our security controls, including independent audits. The results of these independent audits are reported to our management who then report to the Audit and Risk Committee.


text: Broad oversight of our overall risk assessment, where we assess key risks including security and technology risks and cybersecurity threats, is maintained by our full Board. Our Board delegates to the Audit and Risk Committee oversight of our programs, policies, and procedures related to cybersecurity, information asset security, network security, and data privacy and protection. The Audit and Risk Committee reports on such matters to the full Board as needed. The Audit and Risk Committee also receives regular reports about our cybersecurity program from the Response Team described below.


text: We have implemented incident response and breach management processes which have overarching and interconnected stages, including (i) preparation for a cybersecurity incident, (ii) detection and analysis of an incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. An internal committee of senior management (the "Response Team") is responsible for overseeing our incident response and breach management processes. The Response Team is tasked with reporting to the Audit and Risk Committee incidents and other cybersecurity matters deemed important or to have a business impact, even if immaterial to the Company as a whole. The Response Team, as necessary and appropriate, is briefed by our information security and engineering teams with respect to risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Our cybersecurity risk management and strategy processes are overseen by the Response Team, including our Chief Operating Officer ("COO"). The individuals on the Response Team and our COO have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed by our information security and engineering teams about, and monitor, the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response and breach management processes. The Response Team and COO report to the Audit and Risk Committee on any appropriate items. The Board retains broad oversight of all risk management of the Company.


text: Third Party Risk Management Because we are aware of the risks associated with third-party service providers, we have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such third-party service providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of any heightened risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and certifications by third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and we investigate security incidents that impact our third-party providers, as appropriate.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience any such event in the future. For more information about the cybersecurity risks we face in connection with our business, see the risk factor entitled "Data security breaches, cyberattacks, employee or other internal misconduct, malware, phishing or ransomware, physical security breaches, or other disruptions to our technology systems or a compromise of our data security could occur and would materially adversely impact our business and ability to protect the confidential information in our possession or control" in Item 1A of this Form 10-K, "Risk Factors."


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience any such event in the future. For more information about the cybersecurity risks we face in connection with our business, see the risk factor entitled "Data security breaches, cyberattacks, employee or other internal misconduct, malware, phishing or ransomware, physical security breaches, or other disruptions to our technology system or a compromise of our data security could occur and would materially adversely impact our business and ability to protect the confidential information in our possession or control" in Item 1A of this Form 10-K, "Risk Factors."


text: We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: iQSTEL Inc

ticker: IQST


text: We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have a trained group of people to carry out the activities of monitoring and detection of cybersecurity threats and respond to any cybersecurity threats or incidents. The Head of IT department is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners. The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: SKINVISIBLE, INC.

ticker: SKVI


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, quality audits and communication and reporting structures, among other processes.


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: ALTEROLA BIOTECH INC.

ticker: ABTI


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes.


text: We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Chief Financial Officer who reports to the audit committee or board, as appropriate.


text: As of March 31, 2024, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: AI Era Corp.

ticker: AERA


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We will seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting among other processes. We will engage a third-party consultant, if needed, to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: As of August 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we face numerous and evolving cybersecurity threats in our business.


text: As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout our company. We dedicate resources commensurate with our risk profile and business size to programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats.


text: As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on systems owned, operated or controlled by unaffiliated third-party operators and (ii) our processing and storage of large amounts of sensitive customer data. Cyber-attacks on our systems may be initiated by a wide variety of intruders, including employees, cyber-criminals, nation state actors and other advanced persistent threat actors, and may include attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We will seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We will engage a third-party consultant, if needed, to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: As of August 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we face numerous and evolving cybersecurity threats in our business.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data and information related to our product candidates, preclinical studies and clinical trials, which we refer to collectively as Information Systems and Data.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Our information technology and security, or IT, team and risk committee, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using a multi-faceted approach including use of automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, and evaluating reported threats as well as the industry's risk profile.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan and policy, incident detection and response, maintaining a vulnerability management policy, maintaining disaster recovery and business continuity plans, conducting risk assessments, implementing security standards and certifications, maintaining network security controls, access controls, and physical security measures, asset management, systems monitoring, conducting proactive privacy and cybersecurity reviews of systems and applications, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and implement appropriate changes and encrypting Information Systems and Data. In addition, we maintain cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our risk committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms and dark web monitoring services.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling or processing our Information Systems and Data. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the heading "If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants upon which we rely, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Members of our audit committee receive updates on a regular basis from senior management, including leaders from our IT and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Head of IT, who has experience in various roles involving information technology and cybersecurity. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee on any appropriate items.


text: Our Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer, Chief Operating Officer, General Counsel and Head of Human Resources. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. Our Head of IT works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to our audit committee for certain cybersecurity incidents.


text: Our information technology and security, or IT, management team, and legal, and risk management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using a multi-faceted approach including use of manual and automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, evaluating reported threats as well as the industry's risk profile, and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers and penetration testing firms.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling or processing our Information Systems and Data. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including completion of security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and security assessment calls with the vendor's security personnel.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the heading "If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants with whom we work, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Executive Director who serves as the Head of IT and Cybersecurity, who has twenty years of experience in various roles involving information technology and cybersecurity. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee on any appropriate items.


text: We invest in a comprehensive cybersecurity program that applies a recognized framework, utilizes industry standard tools, relies on expert partners, connects associates across the organization and leverages communication to protect our systems and our data.

companyName: US Foods Holding Corp.

ticker: USFD


text: Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cyber Security Framework to define and regularly reassess our cybersecurity program. The NIST framework is structured around five commonly defined stages (Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our policies, including our Information Security Policy and Privacy Policy, and procedures are designed to align with industry best practices and comply with regulatory requirements. We align our payment processing policies and procedures with industry security standards, including the Payment Card Industry Data Security Standard. Throughout the year, we conduct targeted audits and assessments, using internal and external resources, of certain aspects of our information security systems. We have developed and implemented a comprehensive program designed to protect the confidentiality of sensitive information, ensure the integrity of critical data and automated processes, and safeguard the availability of our information technology capabilities.


text: Moreover, we have implemented appropriate policies, processes, and technology to reduce the likelihood or impact of a breach, either at US Foods or through any third-party service provider, and have appropriate cyber insurance coverage through a standalone cyber policy. Our comprehensive cybersecurity program leverages technology, third-party expertise and trained personnel to provide whole-enterprise governance, collaboration for 24-hour monitoring, threat detection and incident response (whether an incident were to occur at US Foods or involving a third-party provider) and network, cloud and mobile security. We partner with security firms to manage our security incident and event management, identify external threats, perform penetration testing, complete security assessments and support incident response. These relationships are evaluated and benchmarked regularly to ensure quality resourcing to augment our internal staff and provide insight into emerging risks inside and outside the foodservice industry. Information obtained from these processes is shared directly with our Internal Audit and Legal functions to ensure cybersecurity policies, processes, threat detection and incident response are accurately captured as part of our broader enterprise risk management systems and processes. We have developed and continually evolve our privacy and security policies to promote organizational accountability for privacy, data governance, and data protection across our business and with our collaborative partners and suppliers.


text: In addition, we have an employee awareness program to regularly educate our workforce on the cybersecurity risks they face and how they can operate safely. We provide all associates that have network access with annual data-security training. Our training and education programs include specialized training for associates handling confidential information, information security awareness training, periodic anti-phishing campaigns, one-click email-enabled phish alert reporting functionality and advisory emails on emerging threats.


text: To date, we have not experienced any cybersecurity incidents that materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Governance Framework Under the oversight of the Audit Committee of our Board of Directors, our cybersecurity function is managed by our Technology and Innovation team, led by our Senior Vice President, Chief Information Security Officer, Sara Schmidt, with support from the Internal Audit and Legal functions. Ms. Schmidt has served in the role since 2022. Before joining US Foods, Ms. Schmidt served as Chief Information Security Officer for Farmers Insurance, a national insurance company, from 2019 to 2022, and various other positions from 2015 to 2019. Ms. Schmidt began her career as a cryptography analyst with the National Security Agency, learning best practices and tactics to be an effective hacker and defender. After eight years with the NSA, she transitioned into the private sector, joining Perrigo Company from 2011 to 2015, before joining Farmers Insurance.


text: Ms. Schmidt and other members of Company management provide an annual cybersecurity report to our Board of Directors and quarterly reports to our Audit Committee, which reports include a review of potential threats and vulnerabilities.


text: We are aware that we must continuously evolve our controls to address new threats, adhere to changing laws and standards, and reduce the risk associated with the introduction of new, innovative technology. While all of our employees play a part in information security, cybersecurity, and data privacy, oversight responsibility is shared by the Board, its committees, and management, as further highlighted below.


text: Participates in regular reviews and discussions dedicated to the Company's risks related to the protection of our data and systems, including cybersecurity and privacy. Receives periodic updates from external advisors regarding cybersecurity risk management and reporting.


text: Primarily responsible for overseeing the Company's risk management program related to cybersecurity. The Audit Committee provides feedback on the Company's framework for assessing, prioritizing and mitigating cybersecurity risk and receives periodic updates based on this framework, including from third-party and internal audit assessments. Receives periodic updates from external advisors regarding cybersecurity risk management and reporting.


text: Disclosure Committee The Disclosure Committee, which consists of individuals from our legal, accounting, finance and investor relations groups, provides general oversight in the area of cybersecurity and privacy, and is responsible for making disclosure determinations regarding cybersecurity incidents. The Disclosure Committee also receives periodic updates from the Chief Information Security Officer regarding threat detection and incident response.


text: Responsible for designing, implementing and managing the Company's framework for assessing, prioritizing and mitigating cybersecurity risk. Manages the Company's privacy program. Responds to incidents and issues in a timely manner, and elevates emergent risks or incidents to the Disclosure Committee. Provides periodic updates to the Board, the Audit Committee and the Disclosure Committee, as applicable.


text: Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cyber Security Framework and regularly reassess our cybersecurity program. The NIST framework is structured around five commonly defined stages (Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our policies, including our Information Security Policy and Privacy Policy, and procedures are designed to align with industry best practices and comply with regulatory requirements. We align our payment processing policies and procedures with industry security standards, including the Payment Card Industry Data Security Standard. Throughout the year, we conduct targeted audits and assessments, using internal and external resources, of certain aspects of our information security systems. We have developed and implemented a comprehensive program designed to protect the confidentiality of sensitive information, ensure the integrity of critical data and automated processes, and safeguard the availability of our information technology capabilities.


text: In addition, we have an employee awareness program to regularly educate our workforce on the cybersecurity risks they face and how they can operate safely. We provide all associates that have network access with annual data-security training. Our training and education programs include specialized training for associates handling confidential information, associates with privileged access, executive specific training, general information security awareness training, periodic anti-phishing campaigns, one-click email-enabled phish alert reporting functionality and advisory emails on emerging threats.


text: Governance Framework Under the oversight of the Audit Committee of our Board of Directors, our cybersecurity function is managed by our Technology and Innovation team, led by our Senior Vice President, Chief Information Security Officer, Sara Schmidt, with support from the Internal Audit and Legal functions. Ms. Schmidt has served in the role since 2022. Before joining US Foods, Ms. Schmidt served as Chief Information Security Officer for Farmers Insurance, a national insurance company, from 2019 to 2022, and various other positions from 2015 to 2019. Ms. Schmidt began her career as a cryptography analyst with the National Security Agency ("NSA"), learning best practices and tactics to be an effective hacker and defender. After eight years with the NSA, she transitioned into the private sector, joining Perrigo Company from 2011 to 2015, before joining Farmers Insurance.


text: Disclosure Committee The Disclosure Committee, which consists of individuals from our legal, accounting, finance and investor relations groups, provides general oversight in the area of cybersecurity and privacy reporting, and is responsible for making disclosure determinations regarding cybersecurity incidents. The Disclosure Committee also receives periodic updates from the Chief Information Security Officer regarding threat detection and incident response.


text: We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers. A critical part of our strategy involves focusing on gathering data without collecting, maintaining or using sensitive personal data such as social security numbers, credit card numbers, financial account information or medical records. The Cardlytics platform is designed so that we do not receive or have access to any PII from our FI partners. We only perform targeted marketing using data that has undergone processing such that it is only linked to anonymized identifiers.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We have implemented and maintain various information security risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our information assets and mitigate harm to our business.


text: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions to reduce, eliminate or manage risks. Risk assessments are performed quarterly as part of this program and the results are discussed and reviewed with management.


text: We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats and conducting vulnerability assessments to identify vulnerabilities.


text: We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers) to assess how cybersecurity threats could impact our business. We assess the likelihood that such threats could result in a material impact to our information assets, operations, ability to provide our goods and services, our core business functions, customer acquisition and retention, personnel, reputation and identified critical business objectives.


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate such risks and potential material impacts. We may implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. We prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as ransomware, theft of IP and interruption of services. The risk management and reduction measures we implement, depending on the computing environment or system, may include the following: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, disaster recovery/business continuity plans and clear desk policies; threat detection and incident response; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards and certifications; credit and background checks on our personnel and contractors; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; continuous monitoring for potential intrusions; vendor risk management program; employee security training; penetration testing; cyber insurance; and a dedicated cybersecurity staff and officer.


text: We work with third parties from time to time that assist us to identify, assess and manage cybersecurity risks, including professional services firms to conduct SOC 2, Type II assessments, incident response consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, encryption and authentication technology and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "An actual or perceived breach of the security of our systems, or those of third parties upon which we rely, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors along with the audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, Chief Operating Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer, to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.


text: Every six months, management discusses cybersecurity risk and reviews our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors regarding cybersecurity matters.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing and testing of incident response plans. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: Our board of directors oversees our risk management strategy with respect to cybersecurity risks and threats. The board, through its audit committee, holds regular meetings quarterly to discuss issues including our cybersecurity threats, and has a dedicated agenda during such meetings that are designed to assist the audit committee to exercise its oversight function. The meetings involve presentations and reports from the Chief Information Security Officer and management, including updates on contemporary cybersecurity threats faced by us and steps we are taking to address them.


text: We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers. A critical part of our strategy involves focusing on gathering data without collecting, maintaining or using sensitive personal data such as social security numbers, credit card numbers, financial account information or medical records. The Cardlytics platform is designed so that we do not receive or have access to any personal data from our FI partners. We only perform targeted marketing using data that has undergone processing such that it is only linked to anonymized identifiers.


text: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions designed to reduce, eliminate or manage risks. Risk assessments are performed quarterly as part of this program and the results are discussed and reviewed with management.


text: We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities and conducting tabletop incident response exercises.


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate such risks and potential material impacts. We implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. We prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as ransomware, theft of IP and interruption of services. The risk management and reduction measures we implement, depending on the computing environment or system, may include the following: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, disaster recovery/business continuity plans and clear desk policies; threat detection and incident response; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards and certifications; credit and background checks on our personnel and contractors; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; continuous monitoring for potential intrusions; vendor risk management program; employee security training; penetration testing; cyber insurance; and a dedicated cybersecurity staff and officer.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, encryption and authentication technology and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "An actual or perceived breach of the security of our systems, or those of third parties with whom we work, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."


text: Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer, to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees. Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.


text: Cybersecurity is a key component of BlackLine's overall cross-functional approach to risk management. Our cybersecurity risk management practices are integrated into our overall risk management practices, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board through our annual enterprise risk assessment. Our cybersecurity policies and practices are designed with the cybersecurity framework of the National Institute of Standards and Technology and certain other applicable industry standards in mind, and BlackLine maintains an information security management system, which is certified against certain international standards, such as ISO 27001 and ISO 27017.

companyName: BLACKLINE, INC.

ticker: BL


text: Our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity threat operation that endeavors to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Collaboration: We have established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers to identify and assess cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments. • Third-Party Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks with respect to third parties, including third parties who provide solutions we rely upon for our security measures. This includes contractually obligating third-party service providers with access to our systems or processing sensitive data on our behalf to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected security breach that may affect BlackLine. • Education: Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity. We provide training upon onboarding, and annually thereafter, for all personnel regarding cybersecurity threats, with additional role-based security training as applicable. We also provide periodic cybersecurity newsletters and updates to all employees, and have a phishing awareness program that includes monthly simulations, and we periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Incident Response Planning: We have established and maintain an incident response plan that addresses our response to suspected cybersecurity incidents and is tested periodically. • Communication and Coordination: We utilize a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from the information security, technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Audit Committee of the Board (the "Audit Committee") and Technology and Cybersecurity Committee of the Board (the "Technology and Cybersecurity Committee") regarding cybersecurity threats and incidents. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our risk management function and Chief Information Security Officer ("CISO"). In February 2024, the Board formed a standing Technology and Cybersecurity Committee, which is comprised of independent members of the Board and assists the Board in fulfilling its oversight responsibilities with respect to risks relating to our information security, data privacy and disaster recovery capabilities.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises focused on evaluating effectiveness. We periodically engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Board, the Audit Committee, and the newly formed Technology and Cybersecurity Committee, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: The Audit Committee and the Technology and Cybersecurity Committee are responsible for oversight relating to cybersecurity. The Board and the Audit Committee regularly receive (and the newly formed Technology and Cybersecurity Committee will receive) presentations and reports on cybersecurity risks from the CISO, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to our peers and vendors. Our incident response process includes escalation of potentially material cybersecurity incidents to relevant members of our executive management team. The Board, the Audit Committee, and the newly formed Technology and Cybersecurity Committee, are updated as appropriate.


text: Periodically, the Audit Committee discusses our approach to cybersecurity risk management with our CISO. Our Technology and Cybersecurity Committee will receive regular reports from our CISO as part of its assessment of our cybersecurity threat landscape, and the quality and effectiveness of our information security programs.


text: Our CISO is the member of our management who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across BlackLine. She has over 15 years of experience as a chief information security officer responsible for enterprise-wide oversight of information security programs. She holds CISSP and CISM certifications, and a BS in Computer Science. She leads a team of information security professionals, and works in coordination with the Chief Information Officer, the Chief Legal and Administrative Officer, the Senior Vice President, Cloud Engineering and Operations, and other members of management.


text: The CISO, in coordination with the other members of the executive management team, works collaboratively across BlackLine to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of such programs, we designate certain employees as security champions throughout BlackLine to respond to cybersecurity incidents in accordance with our incident response plan. Through communications with these employees, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, and reports such incidents to the Board, the Audit Committee, and the Technology and Cybersecurity Committee, when appropriate, as discussed above.


text: As of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected BlackLine, including its business strategy, results of operations or financial condition. Notwithstanding our investment in cybersecurity, however, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition.


text: We are at risk for cybersecurity breaches and incidents, including as a result of third-party action, employee, vendor or contractor error, cyberattacks (including from nation states and affiliated actors) and other forms of hacking, malfeasance, ransomware, and other malicious software, or other factors. If our security controls are breached or circumvented, or unauthorized or inadvertent access to, modification to, or processing of customer, employee, or other confidential data otherwise occurs, our software solutions may be perceived as insecure, or may become unavailable or inaccessible to our end users. As a result, we may lose existing customers or fail to attract new customers, our business may be harmed, and we may incur significant liabilities. These and other risks could affect BlackLine, including our business strategy, results of operations, or financial condition. For more detailed information about these and other cybersecurity risks, please see Part I, Item 1A, "Risk Factors", including the risk factor entitled "If our security controls are breached or unauthorized, or inadvertent access to customer, employee or other confidential data is otherwise obtained, our software solutions may be perceived as insecure, we may lose existing customers or fail to attract new customers, our business may be harmed and we may incur significant liabilities."


text: Our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity threat operation that endeavors to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Collaboration: We have established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers to identify and assess cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments. • Third-Party Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks with respect to third parties, including third parties who provide solutions we rely upon for our security measures. This includes contractually obligating third-party service providers with access to our systems or processing sensitive data on our behalf to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected security breach that may affect BlackLine. • Education: Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity. We provide training upon onboarding, and annually thereafter, for all personnel regarding cybersecurity threats, with additional role-based security training as applicable. We also provide periodic cybersecurity newsletters and updates to all employees, have a phishing awareness program that includes monthly simulations, and periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Incident Response Planning: We have established and maintain an incident response plan that addresses our response to suspected cybersecurity incidents and is tested periodically. • Communication and Coordination: We utilize a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from the information security, technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Audit Committee of the Board (the "Audit Committee") and Technology and Cybersecurity Committee of the Board (the "Technology and Cybersecurity Committee") regarding cybersecurity threats and incidents. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our risk management function and Chief Information Security Officer ("CISO"). In February 2024, the Board formed a standing Technology and Cybersecurity Committee, which is comprised of independent members of the Board and assists the Board in fulfilling its oversight responsibilities with respect to risks relating to our information security, data privacy and disaster recovery capabilities.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises focused on evaluating effectiveness. We periodically engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Board, the Audit Committee, and the Technology and Cybersecurity Committee, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: The Audit Committee and the Technology and Cybersecurity Committee are responsible for oversight relating to cybersecurity. The Board, the Audit Committee, and the Technology and Cybersecurity Committee regularly receive presentations and reports on cybersecurity risks from the CISO, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to our peers and vendors. Our incident response process includes escalation of potentially material cybersecurity incidents to relevant members of our executive management team. The Board, the Audit Committee, and the Technology and Cybersecurity Committee are updated as appropriate. Periodically, the Audit Committee discusses our approach to cybersecurity risk management with our CISO. Our Technology and Cybersecurity Committee receives regular reports from our CISO as part of its assessment of our cybersecurity threat landscape, and the quality and effectiveness of our information security programs.


text: Our CISO is the member of our management who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across BlackLine. She has over 15 years of experience as a chief information security officer responsible for enterprise-wide oversight of information security programs. She holds CISSP and CISM certifications, and a BS in Computer Science. She leads a team of information security professionals, and works in coordination with the Chief Information Officer, the Chief Legal and Administrative Officer, the Chief Technology Officer, the Senior Vice President, Cloud Engineering and Operations, and other members of management.


text: As of the date of this report, and based on facts currently known, the risks from previously occurring cybersecurity threats have not materially affected, nor do we believe that they are reasonably likely to materially affect BlackLine, including its business strategy, results of operations or financial condition. Notwithstanding our investment in cybersecurity, however, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition.


text: Atkore's commitment to cybersecurity emphasizes maintaining secure technology and data environments and the cultivation of a security-minded culture and capability. We do this through education and training, and a layered approach to identifying, preventing, detecting, responding and restoration from cybersecurity threats and incidents. Key elements of our program for assessing, identifying, and managing material risks from cybersecurity threats are anchored in widely used and industry recognized security frameworks and are described below.

companyName: Atkore Inc.

ticker: ATKR


text: We maintain cybersecurity policies that articulate Atkore's expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Atkore employee, we regularly educate and share best practices with our employees to raise awareness of cybersecurity threats. Atkore employees participate in monthly training and testing. In addition to training, Atkore conducts table-top exercises as often as twice a year to simulate cybersecurity risk and response scenarios.


text: Our cybersecurity team implements measures to ensure that Atkore can quickly identify and mitigate cybersecurity risks. Our controls are designed to restrict access to locations that house significant physical information technology assets. Other controls include the use of multifactor authentication, various third-party tools, network security technologies, and a crisis playbook. Our notification policies and processes are escalated to the appropriate personnel on a timely basis to support effective review, response, and compliance with legal requirements. Data is also aggregated to support the identification of trends for forward looking oversight.


text: Key elements of Atkore's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity, and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Cybersecurity is one of six topical areas required to be addressed as part of the annual ERM program. Cybersecurity risks are scored using the same methodology applied to all other risks. This helps evaluate the significance and prioritization of cyber-related risks relative to wider business risks. Members of Internal Audit present annually to the Atkore Board of Directors a report on the results of the ERM process. This includes cybersecurity risks. We periodically engage external consultants to assess our cybersecurity program.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats, have materially affected or are likely to materially affect Atkore, including our business strategy, results of operations or financial condition.


text: At the management level, Atkore's cybersecurity program is led by the Company's Vice President - Chief Information Officer ("CIO"), who reports to Atkore's Vice President – Business Development and Strategy, who in turn reports to Atkore's Chief Executive Officer. Atkore's CIO has over 30 years of experience in information technology roles with responsibilities including global cyber security strategy, global IT strategy, technology platforms and internal controls. The CIO has a Master of Business Administration from Kellogg School of Management at Northwestern University and a Bachelor of Science in Computer Information Systems from DeVry Institute of Technology. Reporting to the CIO is a Director of Cybersecurity. The current Director of Cybersecurity has over 20 years of experience in information technology roles with responsibilities including cyber security and security architecture and engineering. The CIO is supported by the Cybersecurity Steering Committee ("CSC"), a management committee comprising members of the Executive Leadership Team and includes the leaders of the information technology, legal, finance, human resources, commercial and communications functions and that report to the Chief Executive Officer. The CSC supports the CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation, and remediation.


text: At the Board level, Atkore's cybersecurity is overseen by a subset of the full Board of Directors, specifically the independent board members. This oversight includes a quarterly review of Atkore's cybersecurity program, including key program metrics, initiatives, and developments. In addition, in the event of a significant cybersecurity incident, Atkore's policy and process requires timely engagement of and consultation with the Board of Directors.


text: Additional information about cybersecurity risks we face is discussed in "Item 1a. Risk Factors," which should be read in conjunction with the information above.


text: Risk Management and Strategy DuPont has implemented processes for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. DuPont's cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and containment. The Company has other policies and procedures which directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption standards, antivirus protection, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. The Company also engages third parties in connection with the assessment of its cybersecurity risk management processes against the NIST framework.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: DuPont has dedicated Information Technology security professionals that form the DuPont Cyber Incident Response Team ("DCIRT"). The DCIRT is led by our Chief Information Security Officer ("CISO") and is responsible for the detection and initial assessment of cybersecurity threats and incidents (collectively, "cyber incidents"), whether internal or experienced by significant third-party service providers, using, among other means, third-party software. The DCIRT classifies detected cyber incidents into one of four categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of a cyber incident is designed to allow rapid prioritization, response and escalation. The CISO and the Chief Information Officer ("CIO") are alerted as to any detected cyber incident that is potentially significant. Incidents are documented for regular internal reporting processes including notations and considerations of related attacks.


text: The CIO and CISO are required to engage the Cybersecurity Incident Review Committee ("CIRC"), a subcommittee of the DuPont Disclosure Committee, if a cyber incident has materially affected, or is reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The CIRC is engaged if, in the opinion of the DCIRT, based on information then-available, a cyber incident is, or it is reasonably possible it may be, classified in one of the highest two severity categories discussed above. The CIRC includes membership representation from information technology, legal, finance, investor relations and internal audit and, if appropriate, the impacted business. The CIRC is responsible for performing a materiality assessment, activating the Crisis Management Committee ("CMC") when applicable, and overseeing the public disclosure of material cybersecurity matters, as appropriate. The CIRC coordinates with the Company's legal counsel and third parties, such as consultants and legal advisors, as needed. The CMC is a standing committee comprised of senior management and reports to the CEO. In the event the CMC is activated in relation to a cyber incident, the CEO is required by Board adopted policy to notify the Lead Director and any member of the Board of Directors identified as having cybersecurity expertise.


text: As part of preparatory and post-closing integration activities in connection with merger and acquisition activity, the Company: (i) conducts a cybersecurity risk threat assessment and when evidence of a breach is uncovered, conducts additional due diligence; (ii) based on the assessment, the Company develops and implements risk mitigation plans if needed and brings the acquisition under the Company's cyber-attack/breach detection and response programs; and (iii) conducts an internal controls risk and compliance assessment and creates, as needed, responsive action plans intended to mitigate and remediate identified weaknesses in the control environment.


text: DuPont deploys annual cybersecurity training for employees and considers this a critical step in safeguarding the Company's data and assets. The training provides employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The course includes enhancements to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and includes interactive modules covering various areas, including insider attacks, phishing and email attacks, preventing malware attacks, data protection, data handling, passwords, cloud and internet security and cybersecurity fundamentals for mobile devices.


text: Like other major corporations, DuPont is the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "The Company's business, results of operations, financial condition and cash flows could be adversely affected by interruption of the Company's information technology or network systems and other business disruptions" in Item 1A. Risk Factors of this Annual Report.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for DuPont's Board of Directors and management. The CIO and the CISO are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO has fifteen years of cybersecurity experience, including six years with DuPont, and the CISO has twenty-six years of cybersecurity experience, including one year with DuPont. Each of the CIO and CISO maintain industry recognized credentials relevant to their roles.


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the risk management process and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the full Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk.


text: The full Board is responsible for oversight of cybersecurity risk and receives regular reports from the CIO and the CISO. The CIO and the CISO also present their assessment of material risks from cybersecurity threats to the Board at least annually. The Audit Committee receives periodic reports regarding information technology general controls ("ITGC") in connection with its oversight of internal control over financial reporting. The impact, if any, of cyber incidents on internal control over financial reporting is also discussed with the full Board. The Nomination and Governance Committee considers cyber expertise in vetting nominees for the Board and recommending Committee appointments, and DuPont's Board of Directors has determined that one of its independent board members has cybersecurity expertise.


text: Like other major corporations, DuPont is the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected the Company, including its strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "The Company's business, results of operations, financial condition and cash flows could be adversely affected by interruption of the Company's information technology or network systems and other business disruptions" in Item 1A. Risk Factors of this Annual Report.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for DuPont's Board of Directors and management. The CIO and the CISO are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO has sixteen years of cybersecurity experience, including seven years with DuPont, and the CISO has seventeen years of cybersecurity experience, including over three years with DuPont. Each of the CIO and CISO maintain industry recognized credentials relevant to their roles.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Arteris, Inc.

ticker: AIP


text: Our cybersecurity risk management program includes common methodologies, reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk areas.


text: Risk assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: A management team, including the Chief Financial Officer (CFO), head of information technology (Head of IT), General Counsel/Chief Compliance Officer, and Deputy General Counsel (together, the Cybersecurity Management Team) responsible for managing and communicating priorities related to (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; Cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and A third-party risk management process for essential service providers, suppliers, and vendors.


text: Our Cybersecurity Management Team is responsible for assessing and managing our material risks from cybersecurity threats. The Head of IT has a primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. Our Head of IT has served in various roles in information technology and information security for over 17 years. Our Deputy General Counsel has over 20 years of experience as an attorney and holds various certifications related to privacy and data protection.


text: Our Cybersecurity Management Team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We have not at this time identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Intellectual Property, Information Technology and Data Security and Privacy—Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Management updates the board of directors, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The board of directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the board of directors' continuing education on topics that impact public companies.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information and is designed to identify, assess, prioritize and manage cybersecurity threats.


text: As part of our comprehensive risk management program, our cybersecurity risk management program includes methodologies, reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk areas.


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity risk management program; Cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and A third-party risk management process to oversee and identify cybersecurity risks for our use of service providers, suppliers, and vendors.


text: Our Cybersecurity Management Team is responsible for assessing and managing our material risks from cybersecurity threats. The Head of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. Our Head of IT has served in various roles in information technology and information security for over 17 years. Our Deputy General Counsel has over 20 years of experience as an attorney and holds various certifications related to privacy and data protection.


text: We have not at this time identified risks from known cybersecurity threats, including as a result of any prior cybersecurity events, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Intellectual Property, Information Technology and Data Security and Privacy—Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."


text: Cybersecurity Board Governance Our board of directors considers cybersecurity risk as part of its risk oversight function. The Cybersecurity Management Team updates the board of directors, as necessary, regarding any significant cybersecurity incidents.


text: The board of directors receives briefings from management and the Cybersecurity Management Team periodically on our cyber risk management program and presentations on cybersecurity topics as part of the board of directors' continuing education on topics that impact public companies.


text: The Company has adopted standard operating procedures and processes designed to monitor, detect, evaluate and respond to cybersecurity incidents that impact and jeopardize sensitive data stored on the Company's internal systems or on third party systems utilized by the Company. Because the importance and sensitivity of information utilized by the Company varies, the Company applies different levels of protection according to a defined data classification matrix. The Company has implemented a data classification policy to ensure that all data utilized, or housed by or on behalf of the Company, is identified, classified, labeled, properly handled and protected in accordance with its risk profile and as may be required by applicable law. A Data Classification Steering Committee comprised of the Chief Executive Officer (CEO), the President and General Counsel oversees and approves this classification policy. The Company's Information Security team, a group with expertise in cybersecurity that is within the Information Technology function, operating under direction of the Company's Chief Information Officer (CIO), is responsible for monitoring data classification ratings and implementing control solutions to protect data in accordance with the classification assigned. The Company's Information Security team has appropriate experience in information technology roles. The Information Security team also evaluates third party service providers that store sensitive Company data to ensure reputability and the Company reviews service auditor reports annually as may be available. The Company engages third-party services to conduct evaluations of security controls, whether through penetration testing, automated vulnerability scanning, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Company regularly tests defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing operational policies and procedures with third-party experts. The Company also shares and receives threat intelligence with its defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations. Third parties are expected to communicate cybersecurity incidents to the Company within a timely manner.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: We have adopted several measures aimed to protect against cybersecurity breaches and to minimize disruption if a data breach were to occur. Such measures include documenting, among other things: (i) incident response plans; (ii) procedures for identifying and reporting an incident; and (iii) procedures for containing and eradicating known threats and restoring service to the impacted systems. Upon identification of a cybersecurity event, our policies guide how to handle the incident based on the incident severity and includes information about the required response times, communication protocols and preparation and dissemination of reporting to management. The severity of an incident is classified as "high", "medium" or "low" based on the sensitivity and type of data compromised, the criticality of the system to the Company's operations and its ability to function for users, and the anticipated recovery time and remediation resources required. Incidents classified as "high" must be communicated immediately along with regular progress updates to the CEO, the President, Chief Financial Officer (CFO), General Counsel, CIO and various members of the Information Technology team. High severity events require a sustained response effort using all available resources, which may include engaging third parties to assist in the resolution process as necessary, until resolved.


text: Once the Company gathers sufficient information about a high severity incident, it is evaluated for materiality, both individually and in the aggregate with any other incidents, by a management sub-committee comprised of the President, CFO, CIO and General Counsel. This sub-committee may engage or consult with third parties. Criteria used to evaluate materiality include both quantitative and qualitative factors, including, but not limited to, financial loss, risk to reputation and competitiveness, harm to customer or vendor relationships and the potential for litigation or regulatory investigations. Incidents determined to be material are then communicated immediately to the CEO and then to the Board of Directors after such determination and disclosed in an 8-K within 4 business days upon such determination.


text: As a part of the Company's overall integrated approach to risk management, the Company assesses, identifies and manages cybersecurity related risks. The full Board of Directors provides an additional level of cybersecurity risk oversight.


text: Medpace assesses and evaluates cybersecurity risk using the framework established by the National Institute of Standards and Technology (NIST). Bi-annually, at meetings of the Board of Directors, utilizing the NIST framework standards as a guide, the Information Technology Team discusses the Company's cybersecurity mitigation and resolution maturity and readiness. The Information Technology team's reports to the Board also include reviews and evaluations of key cybersecurity risk focus areas and initiatives, as well as quantitative incident occurrence information.


text: See Item 1A. "Risk Factors" of Part I of this Annual Report on Form 10-K for discussion of cybersecurity risks that are reasonably likely to materially affect the Company.


text: Once the Company gathers sufficient information about a high severity incident, it is evaluated for materiality, both individually and in the aggregate with any other incidents, by a management sub-committee comprised of the President, CFO, CIO and General Counsel. This sub-committee may engage or consult with third parties. Criteria used to evaluate materiality include both quantitative and qualitative factors, including, but not limited to, financial loss, risk to reputation and competitiveness, harm to customer or vendor relationships and the potential for litigation or regulatory investigations. Incidents determined to be material will then be communicated immediately to the CEO and then to the Board of Directors after such determination and disclosed in a Form 8-K within the required timeframe upon such determination.


text: As a part of the Company's overall integrated approach to risk management, the Company assesses, identifies and manages cybersecurity related risks. The full Board of Directors provides an additional level of cybersecurity risk oversight. Medpace assesses and evaluates cybersecurity risk using the framework established by the National Institute of Standards and Technology (NIST). Bi-annually, at meetings of the Board of Directors, utilizing the NIST framework standards as a guide, the Information Technology Team discusses the Company's cybersecurity mitigation and resolution maturity and readiness. The Information Technology team's reports to the Board also include reviews and evaluations of key cybersecurity risk focus areas and initiatives, as well as quantitative incident occurrence information.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" of Part I of this Annual Report on Form 10-K for discussion of cybersecurity risks that are reasonably likely to materially affect the Company.


text: The Company's risk management process includes assessing, identifying and managing material risks from various sources, including those related to cybersecurity. The Company uses information from incident history, industry publications and analysis centers, public news, government information sharing and recognized information security frameworks to inform its risk management program. Management employs a suite of detective and preventative cybersecurity measures including, but not limited to • Maintaining a vulnerability management program, • implementing and operating controls over logical access provisioning, • maintaining an enterprise-wide security awareness program and • administering periodic trainings.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: The Company engages multiple vendors with subject matter and technological expertise in various aspects of cybersecurity management, including continuous threat detection and response coverage, endpoint detection, anti-malware, penetration testing and suspicious activity alerting, among others. When the Company engages third parties, management retains responsibility for the security and resiliency of its information assets. The Company maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide business continuity and disclosure objectives.


text: We describe risks related to cybersecurity threats that could materially impact our business strategy, results of operations or financial condition under the heading "Risk Factors." Material impacts could include loss of access to systems and data, financial costs and reputational harm, among others.


text: Our Chief Executive Officer ("CEO") is responsible for assessing and managing overall material risks to the Company. With respect to cybersecurity risks, our CEO leverages the collective expertise of the Company's information security function which reports to our CEO through the Company's Chief Information Officer. The information security function is staffed with individuals with extensive information security employment experience, including in the financial services sector, educational experience and relevant credentials. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for receiving periodic updates on cybersecurity and information security risks, reviewing and discussing with management the quality and effectiveness of the Company's efforts to mitigate such risks and reporting such findings to the Board of Directors. Management informs the Audit Committee about prevention, detection, mitigation and remediation of cybersecurity incidents at least annually and monitors such matters continuously.