text: The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.

companyName: US BANCORP \DE\

ticker: USB


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.

secItem: Item 1C


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenge and recommendations for improvement.


text: The Company uses reporting and metrics frameworks and regular internal and external oversight to assess the health of the cybersecurity risk program. At the first level, the ISS team identifies, assesses, and manages cybersecurity risk and threats. The Company manages cybersecurity issues and findings through remediation and/or closure, with escalation processes if an issue or finding cannot be remediated within required timeframes. The Company engages external assessors, consultants, and auditors to review the Company's cybersecurity risk program against those of industry peers. The Company also uses consultants periodically to provide recommendations to improve and enhance the program. Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standards (PCI DSS), and other applicable standards, laws, and regulations.


text: The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. The Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Board's Risk Management Committee has a Cybersecurity and Technology Subcommittee that provides dedicated oversight to cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board typically holds an annual cybersecurity education session, which features the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level cybersecurity exercise to test its cyber incident response, completeness of playbooks, and communication protocols. This exercise involves Board members, managing committee members, third-party companies, and regulators as appropriate.


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard, which consists of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committee (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.


text: The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO, Timothy J. Held, has over 26 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.


text: The Company's CISO reports to the Vice Chair and Chief Risk Officer, Jodi L. Richard, who has served in that position since October 2018. She served as Executive Vice President and Chief Operational Risk Officer of the Company from January 2018 until October 2018, having served as Senior Vice President and Chief Operational Risk Officer from 2014 until January 2018. Prior to that time, Ms. Richard held various senior leadership roles at HSBC from 2003 until 2014, including Executive Vice President and Head of Operational Risk and Internal Control at HSBC North America from 2008 to 2014.


text: Venkatachari Dilip, the Company's Senior Executive Vice President and Chief Information and Technology Officer, has oversight of technology-related risk management issues and controls that align to the NIST CSF. Mr. Dilip previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since joining the Company in September 2018. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.


text: The CISO and his leadership team generally meet each business day to discuss security item triage and emerging threats and trends identified by the Threat Intelligence Team. The CISO shares pertinent information from those meetings with the Chief Risk Officer. During a cyber incident, which could involve the Company or a third-party service provider to the Company, the Company's Cyber Security Incident Response Team (CSIRT) leads the response and internal communication. CSIRT manages low and moderate severity incidents, and Enterprise Crisis Management manages high and very high severity incidents. The risk rating of an incident may change throughout the incident investigation period as new information is learned or the environment changes. Depending on severity level, CSIRT or Enterprise Crisis Management distributes incident communications to senior management, including the Chief Executive Officer, Chief Risk Officer, Board of Directors or appropriate Board committee, and if applicable, the Company's regulators.


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive.


text: Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.


text: During the fiscal year ended December 31, 2023, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2023 Annual Report.


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. Additionally, the Company's Information Security Awareness and Training Program educates employees and contractors on information security policies, standards, and practices to protect U.S. Bancorp's information, information systems, and processes. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenges and recommendations for improvement.


text: During the fiscal year ended December 31, 2024, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2024 Annual Report. The Company may not be successful in preventing or mitigating the impacts of a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.


text: The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. T he Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Risk Management Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks. The Board carries out its risk management oversight responsibilities primarily through its committees. Each Board committee is responsible for overseeing certain risks under its charter. The Board's Risk Management Committee, with support from its Cybersecurity and Technology Subcommittee, has primary oversight responsibility for cybersecurity risk, including risks from any cybersecurity threats. The Risk Management Committee monitors the Company's compliance with the risk management framework and risk limits established under the Company's risk appetite statement approved by the Board. The Risk Management Committee also oversees the Company's independent risk management function. The Cybersecurity and Technology Subcommittee has oversight responsibility for cybersecurity risk management and cyber resiliency and certain technology matters. The Risk Management Committee and its Cybersecurity and Technology Subcommittee receive quarterly reports from management on cybersecurity issues, including cybersecurity threats. The Board's Risk Management Committee and Audit Committee also hold a joint meeting annually at which they receive a report from the Company's CISO on cybersecurity threats facing the Company and its preparedness to meet and respond to those threats. In addition, the full Board holds periodic cybersecurity education sessions, which may feature the perspective of an outside expert on current cybersecurity topics. The Company also typically conducts an annual executive-level crisis exercise that includes a cybersecurity component to test its resiliency response, completeness of playbooks, and communication protocols. This exercise involves Board members, Managing Committee members, third-party companies, and regulators, as appropriate.


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee, and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard consisting of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committees (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. T he Company's CISO, Timothy J. Held, has over 27 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.


text: ISS leadership reports prevention, detection, mitigation, and remediation activities through various working groups and committees. Certain working groups meet with the CISO monthly to review completed risk assessments, and items that require escalation are reported up using the internal committee structure and ad hoc communications if time sensitive. Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.


text: The Cybersecurity Risk Management section within our 2023 MD&A (Item 7), beginning on page 86 of this report, is incorporated herein by reference.

companyName: FIRST HORIZON CORP

ticker: FHN


text: The Cybersecurity Risk Management section within our 2024 MD&A (Item 7), beginning on page 91 of this report, is incorporated herein by reference.


text: As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and continuously engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted. FMC frequently communicates with our third-party service providers to ensure timely notification of any matters that may impact our data security.

companyName: FMC CORP

ticker: FMC


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats. The most-recent audit was performed in 2022 over the Company's 2021 cybersecurity program. The audit results showed that FMC has a mature and robust cybersecurity program that is rated at or above peer industry benchmarks and also provided insight for areas of future improvement in risk mitigation and further program development.


text: Management Oversight in Cybersecurity Governance FMC's senior management Operating Committee, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, David Kotch, Vice President and Chief Information Officer, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's Operating Committee. He serves as a member of the Chemical Information Technology Center's CIO organization and the CIO Executive Summit. Mr. Kotch also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and Operating Committee are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management Operating Committee, including the Chief Information Officer, Chief Financial Officer, Chief Accounting Officer, and General Counsel will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.


text: During 2023, FMC did not directly experience a cybersecurity breach in any FMC system. During 2023, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.


text: Board of Directors Oversight in Cybersecurity Governance FMC's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which is comprised of independent directors whose prior work experience provides them with insights as to potential cybersecurity risks and mitigation strategies. Company executives along with external and internal cybersecurity experts update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic audits performed on the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. In addition to the routine updates provided to the Audit Committee, FMC has an established policy for communication of cybersecurity incidents with the Board of Directors and, if material, the investor community. Refer to the discussion above for further details of this policy.


text: As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. FMC performs a thorough security review prior to onboarding critical third-party providers, which includes review of third-party independent assessments in the form of SOC reports prior to contracting. SOC reports are also reviewed on an annual basis once the third-party is engaged. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted.


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats.


text: Management Oversight in Cybersecurity Governance FMC's senior management Executive Committee and Leadership Team, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, Jas Sidhu, Senior Director - Core IT, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's leadership team. He serves as a member of the Chemical Information Technology Center's CIO organization and the SAP Chemicals Advisory Board. Mr. Sidhu also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and other members of the Executive Committee and Leadership Team are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management, including the Chief Financial Officer, Chief Accounting Officer, and General Counsel, as well as the Senior Director - Core IT will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.


text: During 2024, FMC did not directly experience a cybersecurity breach in any FMC system. During 2024, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.


text: The Information Security Department reports to the Chief Information Security Officer and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity efforts and recommendations are reported to the Risk Management Council no less than quarterly which is then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks. As noted, we employ a Chief Risk Officer, along with information security personnel in our Information Security Department. The Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership. See "Risk Management" in section of MD&A for an overview of our risk management framework.

companyName: FNB CORP/PA/

ticker: FNB


text: The Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness. Certain processes involve the use of third parties. A summary of each process is below.


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System or CVSS score, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, FNB relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests look at our customer facing applications, how we respond to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions. These questions are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and deprovisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.


text: Network Security Management. The security of the FNB network infrastructure is maintained via • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks (VPN) to control remote access to our network, • intrusion detection capabilities, • network access controls (NAC) to prevent unauthorized assets from connecting to the network, and • web filtering.


text: Security Event Monitoring. A centralized security monitoring team is responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The monitoring tool is third-party provided SIEM, and enables threat identification, detects suspicious activity in the environment using the MITRE Att&ck framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber incident is occurring or not.


text: Security Awareness. Annual training is conducted for continuing education for all employees. Routine phishing tests are administered routinely. We also post articles on our intranet of common attack schemes for our employee's awareness.


text: We have a Vendor Management department that established policies and procedures to follow when utilizing external third-parties. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process. Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. See cybersecurity risk factors in Item 1A. Risk Factors.


text: Our Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness.


text: The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. Results of the information and cybersecurity evaluation and recommendations established by the Information Security Department are reported to the Risk Management Council no less than quarterly, and the results are then shared with the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk. See "Risk Management" in section of MD&A for an overview of our risk management framework.


text: We believe our management has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats including applicable knowledge gained through industry experience, education, ongoing internal and external training and regular discussions with consultants and peers with applicable knowledge and expertise. See the following details of certain cybersecurity personnel.


text: The CISO has served FNB since 2016, and has a career over 25 years in information technology, enterprise risk and information security controls. The CISO is a Certified Information Systems Security Professional (CISSP). The CISO has a Bachelor's degree in Criminal Justice with a minor in Computer Science. The CISO is supported by several managers including the following: • Manager of Cyber Security - CISSP with over 20 years of Information Technology and Systems Engineering experience. • Manager of Security Architecture - CISSP with over 20 years experience in Information Technology networking, network security and security engineering.


text: The CISO chairs an Information Security Committee made up of other risk professionals, Information Technology and line of business leaders to maintain an understanding and balance between security and business functionality.


text: A summary of the processes involved in our process of evaluating the effectiveness of information and cybersecurity controls is below.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to regular and routine vulnerability scanning, we rely on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. With the assistance of third-party vendors, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests review our customer facing applications, our response to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions, the responses to which are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Network Security Management. The security of the FNB network infrastructure is maintained via: • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks to control remote access to our network, • intrusion detection capabilities, • network access controls to prevent unauthorized assets from connecting to the network, and • web filtering.


text: Security Awareness. Annual security training is conducted for all employees, and routine phishing tests are administered routinely. We also post articles regarding common cybersecurity schemes on our intranet for our employees' awareness.


text: We have a Vendor Managemen t department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins.


text: To date, we have not experienced cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, see Item 1 of this Report, "Business – Cybersecurity" and Item 1A of this Report, "Risk Factors—5. Operational Risk—An interruption in or breach in security of our information systems, or other cybersecurity risks, could result in a loss of customer business, increased compliance and remediation costs, civil litigation or governmental regulatory action, and have an adverse effect on our results of operations, financial condition and cash flows."


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across the Company. Further, we may engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to the Company are brought to the attention of both the Chief Enterprise Technology Officer and General Counsel by the Chief Information Security Officer as part of our cybersecurity incident response processes.

companyName: FORD MOTOR CO

ticker: F


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Board. Once identified, each of the risks we view as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee.


text: As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These regular updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers have been the target of cybersecurity incidents and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to our networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 20.


text: Cybersecurity risk identification, assessment, and management are integrated into our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Board.


text: As a result of this enterprise risk management process, cybersecurity threats have been and continue to be identified as one of the Company's critical business risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Chief Enterprise Technology Officer and Chief Information Security Officer monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's global cybersecurity incident response plans, which include provisions for escalation to the Chief Policy Officer and General Counsel, as well as the Board and its committees, as appropriate. As discussed below, the executive risk owners for cybersecurity risk report out to the Audit Committee and, in some cases, the Board, on a regular basis as part of our enterprise risk management process.


text: The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. As part of its oversight responsibilities, the Audit Committee receives regular updates on our cybersecurity practices as well as cybersecurity and information technology risks from our Chief Information Security Officer. These updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Enterprise Technology Officer, in collaboration with the Chief Information Security Officer and Chief Policy Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into and oversight of our cybersecurity processes, and in the event Ford determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to our operational information systems, security systems, vehicles, and services could reasonably be expected to affect the Company, including its business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 22.


text: While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks, and have requirements for our suppliers to do the same. Data safeguard practices of suppliers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by our suppliers. When we do become aware that a supplier's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of the Company's information systems.

companyName: FORD MOTOR CREDIT CO LLC


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program leverages both internal and external techniques and expertise. Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals (often referred to as "white hackers" or a "Red Team") to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets. On a monthly basis, we disseminate security awareness newsletters to employees to highlight emerging or urgent cybersecurity threats and best practices. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and offer bounties to responsible third-parties who notify us of vulnerabilities they are able to detect in our cyber defenses (commonly referred to as a "Bug Bounty"). Our capabilities, processes, and other security measures also include, without limitation: • Security Information and Event Management ("SIEM") software, which provides a threat detection, compliance, and security incident management system; • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on external-facing endpoints (e.g., Windows workstations, servers, MAC clients, and Linux endpoints); • Cloud monitoring, running on primary public and private cloud environments; and • Disaster recovery and incident response plans, including a ransomware response plan.


text: We invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Additionally, Ford is a member of the Financial Services and Information Technology ISACs and both a founding member and board member of the Automotive ISAC. Ford's membership with these industry cybersecurity groups assists in the efforts to protect Ford and Ford Credit against both enterprise and in-vehicle security risks.


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 6 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades leading digital and technology organizations at both enterprise software companies and Fortune 50 enterprises. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.


text: Cybersecurity risk management is an integral part of Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Once identified, each of the risks viewed as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with Ford Credit's Chief Technology Officer assigned as the executive risk owner. Ford Credit's Board is responsible for the oversight of cybersecurity and information technology risks, and Ford Credit's preparedness for these risks.


text: As part of its oversight responsibilities, the Ford Credit Board receives annual cybersecurity updates from Ford's Chief Information Security Officer. The annual review includes oversight of cybersecurity practices, cyber risks, and risk management processes, such as updates to Ford Credit's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition, Ford Credit's Compliance Committee reviews at least annually Ford Credit's cybersecurity programs, and the Ford Credit Audit Committee receives updates on Ford Credit's cybersecurity initiatives and information technology internal controls. In addition to these regular updates, as part of Ford Credit's incident response processes, Ford Credit's Chief Technology Officer, in collaboration with Ford Credit's Qualified Individual and Chief Compliance Officer, provides updates on certain cybersecurity incidents to Ford Credit's Compliance Committee and, in some cases, the Ford Credit Board of Directors. In the event Ford Credit determines it has experienced a material cybersecurity incident, Ford Credit's Audit Committee and Chief Compliance Officer are notified about the incident in advance of filing a Current Report on Form 8-K.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers are the target of cybersecurity incidents, and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and Ford's in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to these networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 15.


text: We devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. We believe our cybersecurity program is reasonably designed to protect our information systems, software, networks, and other assets against, and mitigate the effects of, cybersecurity incidents where unauthorized parties attempt, among other things, to disrupt or degrade service or our operations; misuse or abuse technology and information systems; make unauthorized disclosure of data; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are reasonably designed to reduce and mitigate these risks, and have requirements for our suppliers and service providers to do the same. Data safeguard practices of suppliers and service providers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers and service providers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by those parties. When we become aware that a supplier or service provider's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems.


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program is informed by and designed to comply with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The program leverages both internal and external techniques and expertise. Internally, we perform penetration tests, internal tests/code reviews, and Red Team exercises, among other things, to evaluate aspects of our cybersecurity program. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets, and regularly circulate security awareness newsletters to employees. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and operate a bug bounty program. The cybersecurity program also includes disaster recovery and incident response plans, including a ransomware response plan, which is regularly tested and evaluated in tabletop simulations.


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 7 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades managing cybersecurity risks as a leader at enterprise software and Fortune 50 companies. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we have in the past and may in the future engage with third-party advisors and government and law enforcement agencies as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.


text: Cybersecurity risk identification, assessment, and management are integrated into Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Ford Credit Board.


text: As a result of this enterprise risk management process, cybersecurity threats have been and continue to be identified as one of the Company's top risks, with Ford Credit's Chief Technology Officer assigned as the executive risk owner. Ford Credit's Board is responsible for the oversight of cybersecurity and information technology risks, and Ford Credit's preparedness for these risks.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how cybersecurity incidents, ransomware attacks, and other disruptions to Ford and Ford Credit's operational information systems, security systems, vehicles, and services could reasonably be expected to affect Ford and Ford Credit, including their business strategy, results of operations or financial condition, see our risk factors above in Item 1A. generally and, in particular, "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers" on page 18.


text: RISK MANAGEMENT AND STRATEGY 1st Franklin is committed to maintaining the confidentiality, integrity and availability of our data and information systems. We understand the risks presented by existing and emerging cybersecurity threats against our electronic infrastructure and the information it stores and processes, as well as against our customers and employees. We also recognize that there are cybersecurity risks associated with remote work environments which are utilized by some of 1st Franklin's employees, our use of cloud-based infrastructure and networks, and our use of third parties to support our operations.

companyName: 1st FRANKLIN FINANCIAL CORP


text: As a part of our overall risk management processes, we have implemented a comprehensive cybersecurity program designed to identify and manage cybersecurity risks. This program includes a robust risk assessment process designed to identify security vulnerabilities, incorporates regulatory requirements and also provides the foundation for the Information Security department's annually updated multi-year project roadmap, which is used to continually enhance 1st Franklin's cybersecurity program to respond to new threats and challenges.


text: We employ a comprehensive set of cybersecurity policies and guidelines and a strong security training and awareness program to communicate policy directives and current threats to 1st Franklin employees. Additionally, we have a strong due diligence and risk assessment process to identify and manage risks associated with our use of third-party service providers.


text: Some of the other features of our cybersecurity program include: • Monthly phishing simulations and additional training as required for incorrect identification of phishing attempts • Ongoing vulnerability scanning and annual penetration testing of our internal and external environments • IDS/IPS ( Intrusion Detection Device / Intrusion Prevention System) • Firewalls • Endpoint Detection and Response •24x7x365 Security Operations Center


text: • Security Incident and Event Monitoring • Cloud alerting and monitoring • Disaster recovery and business continuity planning and backup strategy • Incident response process • Network segmentation • Data classification labeling and data loss prevention • Privileged access management • Secure builds • Multi-factor and adaptive authentication • Physical security • Internet filtering, email spam filtering and anti-phishing • Brand protection and phishing takedown service • Database security • Data transfer and encryption Additionally, we maintain cybersecurity insurance coverage to help mitigate risk in the event of a potential breach or attack. Although we maintain insurance coverage at levels we deem appropriate for our business, it is possible that such coverage could be insufficient to cover all losses or types of claims that may arise.


text: We have experienced targeted and non-targeted cybersecurity attacks in the past, and we could experience similar attacks in the future. As previously disclosed, we suffered a cyber-attack against certain systems within our network environment in November 2022. The attack temporarily affected operations and caused delays in originating loans at some locations. During the incident, the attackers had access to the PII of certain Company employees, customers and investors. We contained the harm caused by the incident, quickly restored our business operations, and provided timely notifications to affected individuals, entities, and governmental agencies as required by law. Following the cyber-attack, we began undertaking significant remediation efforts and other steps to enhance our cybersecurity and data security infrastructure. Five (5) putative class action lawsuits were filed in the United States District Court in the Northern District of Georgia against the Company alleging harm from the cyber-attack. The Court consolidated all cases into one, and after extensive motion practice, administratively dismissed the consolidated case in full in January 2024. The Plaintiffs have asked the Court to reconsider its dismissal. To date, the Company's cyber insurance policy has covered and paid all material costs and expenses related to the class action litigation.


text: Other than as described above, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. We continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. For additional information regarding the risks from cybersecurity threats we face, see "Risks Related to Our Business – We could incur significant liability, and our business, financial condition, results of operations and reputation could be harmed, if our information systems are breached or we otherwise fail to protect customer, investor, employee or Company data or systems" under Part I, Item 1A. "Risk Factors" above.


text: The Board of Directors maintains the ultimate responsibility for oversight of the Company's risks, including cybersecurity risks. The Board regularly receives presentations on matters of cybersecurity risk from management. Management discusses matters of particular importance or concern as they may be materially impacted by risk on an ongoing basis, and members of the Company's Executive Leadership Team ("ELT") are also available to members of the Board for discussion and review both during meetings of the Board of Directors and at other times.


text: The Company's information security efforts are led by our Chief Information Security Officer ("CISO"). The CISO meets at least quarterly with each of the Board of Directors, the ELT, and the Senior Leadership Team ("SLT"), facilitating the Company's robust cybersecurity oversight and strategies that help us to assess, identify, and manage cybersecurity risks. This includes performing tabletop exercises at least annually with the Board and with the SLT to evaluate our incident response processes and keeping them informed of the evolving threat landscape and how 1st Franklin is managing such risks.


text: Our current CISO is a veteran security professional with over 30 years of information technology and information security experience. Prior to joining 1st Franklin, she worked at one of the largest banks in Canada and the U.S., where she was initially the Head of Application Security and later the Head of Cyber Innovation and Emerging Technologies. Prior to that, she also worked for two multinational banks in New York City in information security and information technology roles. The CISO is supported by a team of highly technical and experienced security professionals who are responsible for implementing and maintaining the security program for 1st Franklin, including security engineers, a cybersecurity analyst and a VP of Information Security.


text: We have been, and in the future may be, the target of cyberattacks, including the previously disclosed November 2022 cyberattack on the Company and related data breach. We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. We continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. For additional information regarding the risks from cybersecurity threats we face, see " Risks Related to Our Business – We could incur significant liability, and our business, financial condition, results of operations and reputation could be harmed, if our information systems are breached or we otherwise fail to protect customer, investor, employee or Company data or systems" under Part I, Item 1A. "Risk Factors" above.


text: The Board of Directors maintains the ultimate responsibility for oversight of the Company's risks, including cybersecurity risks. The Board regularly receives presentations on matters of cybersecurity risk from management. Management discusses matters of particular importance or concern as they may be materially impacted by risk on an ongoing basis, and members of the Company's Executive Committee ("EXCO") are also available to members of the Board for discussion and review both during meetings of the Board of Directors and at other times.


text: The Company's information security efforts are led by our Chief Information Security Officer ("CISO"). The CISO meets at least quarterly with each of the Board of Directors, the EXCO, and the Senior Leadership Team ("SLT"), facilitating the Company's robust cybersecurity oversight and strategies that help us to assess, identify, and manage cybersecurity risks. This includes performing tabletop exercises at least annually with the Board, the EXCO and the SLT to evaluate our incident response processes and keeping them informed of the evolving threat landscape and how 1st Franklin is managing such risks.


text: The CISO is supported by a team of highly technical and experienced security professionals who are responsible for implementing and maintaining the security program for 1st Franklin, including security engineers and a cybersecurity analyst.


text: Data and information systems are a key part of how the Company delivers value to its customers, employees and stakeholders, and the Company's cybersecurity program is committed to protecting its customers, employees, partners, infrastructure and systems. The Company's cybersecurity program and approach is overseen by its Board of Directors, in coordination with the Audit Committee, and Senior Leadership, along with its Senior Director of Global Information Technology Operations and Infrastructure who has expertise around global cybersecurity matters. The Board of Directors receives annual reports from Senior Leadership on the Company's cybersecurity risks. In addition, Senior Leadership updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents. The Board of Directors and Senior Leadership review the strategy, tools, metrics and latest trends affecting cybersecurity and utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework as the foundation for its cybersecurity strategy and approach. Third parties are engaged to assess the Company's cybersecurity posture and adherence to the NIST Cybersecurity Framework, and the Company evaluates cybersecurity risks as part of its annual risk assessment process. Cybersecurity risk mitigation strategies and initiatives are developed based on these assessments. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of Senior Leadership.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: A key area for the Cybersecurity Program is employee cybersecurity education. The Company's employees play a key role in cybersecurity and receive mandatory cybersecurity training, phishing attack simulations, educational events, and news bulletins. The Company's data protection and privacy program is designed to adhere to and adapt to global privacy and data protection laws.


text: The Company's business strategy, results of operations and financial condition have not been materially affected and are not reasonably likely to be affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but it cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on the Company's information technology related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Company's data protection and privacy program is designed to help it assess, identify, manage, and mitigate risks relating to cybersecurity threats and incidents. The Company designs its cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security, Inc (CIS) Controls, as guides in supporting its ability to perform such functions.


text: The Company manages its data protection and privacy program, fostering collaboration with partners across business units and functional areas to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate and manage such risks. Third parties are engaged to assess the Company's cybersecurity posture and adherence to the NIST Cybersecurity Framework and CIS Controls, and the Company evaluates cybersecurity risks as part of its annual risk assessment process. Cybersecurity risk mitigation strategies and initiatives are developed based on these assessments.


text: As part of the Company's data protection and privacy program, it maintains a cyber risk management program that seeks to address key risk management concepts, including mission and vision, escalation path for risk mitigation, risk assessments, and risk treatment. The Company does so by conducting a variety of planning and preparedness activities, including employing monitoring tools to identify suspicious or anomalous activity, vulnerabilities, or signs of compromise across its networks, systems, and data. The Company utilizes data from attack surface management tools to produce a prioritized set of vulnerabilities for remediation. A key area for the program is employee cybersecurity education. The Company's employees play a key role in cybersecurity and participate in mandatory cybersecurity training, phishing attack simulations, educational events, and receive news bulletins. The Company's data protection and privacy program is designed to adhere to and adapt to global privacy and data protection laws.


text: The Company has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If the Company experiences a cybersecurity incident, the Company activates an incident response plan, which includes processes to enable it to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Based on initial investigation into such incident's impact to the Company, the actor(s) involved, and other factors, the Company assigns a severity level to an incident, which dictates the escalation path for a given incident. Incidents rising to higher levels of severity and potential materiality are escalated to designated members of the Company's senior management for further assessment, response, and remediation. Additionally, the Company has established a Cyber Crisis Management Team, responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the Company continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.


text: The Company's cybersecurity program and approach is overseen by its Board of Directors, in coordination with the Audit Committee, and Senior Leadership, along with its Vice President, Information Technology. The Vice President, Information Technology reports to the Chief Administration Officer and has more than 25 years of IT experience with over 10 years of cybersecurity and international business experience. The Board of Directors receives annual reports from Senior Leadership on the Company's cybersecurity risks. In addition, Senior Leadership updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents. The Board of Directors and Senior Leadership review the strategy, tools, metrics and latest trends affecting cybersecurity utilizing the NIST Cybersecurity Framework and CIS Controls as the foundation for its cybersecurity strategy and approach.


text: We recognize the importance of assessing, identifying and managing material risks from cybersecurity threats. Our cybersecurity program focuses on (i) identification of and protection from cybersecurity risks, (ii) detection and analysis of cybersecurity events, (iii) response to and recovery from cybersecurity incidents, and (iv) education and awareness. Under our program, designated personnel are responsible for: • assessing the severity of a cybersecurity incident and associated threat; • containing the threat; • remediating the threat, including recovery of data and access to systems; • analyzing the reporting obligations associated with the incident; and • performing post-incident analysis and program improvements.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Our cybersecurity team is led by our Chief Security Officer ("CSO") or the CSO's delegee partnering with our risk, technology, legal, compliance, privacy, human resources, and other applicable business teams.


text: Our cybersecurity program has established processes to identify and categorize cybersecurity threats and vulnerabilities as part of our risk identification process, pursuant to which we regularly seek to obtain, monitor, assess and respond to evolving threat and vulnerability information. Information about threats and vulnerabilities generally originates from multiple sources, including, but not limited to, government, information-sharing organizations, industry threat intelligence sources, and third parties. The identification of risks is supported through various security controls and testing to help minimize exposure to reported cybersecurity threats and vulnerabilities. These security controls include, but are not limited to, penetration testing, compromise assessments, vulnerability scanning, and various additional internal and external security audits and assessments. In addition, we maintain a third-party risk management program that includes an initial and periodic cybersecurity assessment on critical vendors' security posture and controls.


text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event and sensitivity of any compromised data.


text: In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example forensic investigations, and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.


text: Our cybersecurity education and awareness program for employees and contractors covers a wide range of cyber topics including, but not limited to, policies and procedures, business/technology roles and responsibilities, threats and vulnerabilities, data privacy, confidentiality and asset protection. Our employees and contractors are required to complete mandatory initial onboarding and annual cybersecurity trainings, supplemented by other periodic cyber-related testing and training.


text: Our Board is responsible for the oversight of our cybersecurity risk management program. The Board has delegated to the Franklin Audit Committee oversight responsibility regarding cybersecurity risks. Our CSO reports directly to our Chief Risk and Transformation Officer, each of whom has extensive experience in information security and risk management. The Board and/or Audit Committee receive(s) a report on cybersecurity matters, including threats, events and program enhancements, at least annually. We update our cybersecurity policies at a minimum annually and benchmark our program to applicable cybersecurity standards and frameworks.