text: Cybersecurity threats have become significantly more numerous and sophisticated over time, and the oil and gas industry in particular is highly targeted by malicious actors seeking to attack oil and gas infrastructure to disrupt operations. Because we are focused on mineral and royalty interests, we do not maintain any material physical infrastructure; nonetheless, being an industry participant increases our exposure to external attacks. We are committed to safeguarding our information technology systems and data and managing the risks associated with cybersecurity threats and implemented governance structures, processes, and technologies designed to prevent, detect, investigate, and mitigate any incident that could pose a cybersecurity risk.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Our Vice President, Information Technology ("VP IT"), with support from our Information Technology Infrastructure Team ("Infrastructure Team" and, together with the VP IT, the "Cybersecurity Team"), has primary responsibility for the assessment and management of risks from cybersecurity threats. Collectively, the four members of the Cybersecurity Team have over 75 years of cybersecurity-related experience in both the private and public sectors, including perimeter and internal network security, secure email gateway, B2B and B2C eCommerce, on-premises and cloud storage environment security, and ransomware protection solutions. In addition, members of the Cybersecurity Team have multiple network-security certifications relevant to the technologies we deploy.

secItem: Item 1C


text: Our Board of Directors provides oversight over our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management regularly and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.


text: Our VP IT, the Manager of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by NIST and ISO, as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.


text: While we and our service providers have experienced cybersecurity incidents in the past, as of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation, or financial condition. For more information regarding the risks we face, please read Part I, Item 1A. "Risk Factors—General Risk Factors—Various security risks, including cybersecurity threats, data breaches, and other disruptions, could significantly affect us."


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis but at least annually.

companyName: Gatos Silver, Inc.


text: Our board of directors has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Financial Officer ("CFO"), who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CFO was previously the chief financial officer for other mining companies where he was responsible for information technology security at such companies. Any significant Cyber incidents are reported to the audit committee and ultimately to the board of directors.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Our information technology systems may be vulnerable to disruption and cyberattacks, which could place our systems at risk from data loss, operational failure or compromise of confidential information." in this annual report on Form 10-K.


text: Risk Management & Strategy Shentel's Risk Management Program defines the framework for risk identification and assessment, including cybersecurity risks. Our overall Risk Management Program integrates processes for assessing, identifying and managing material risks from cybersecurity threats. Cybersecurity risks are identified through various means including, but not limited to, regularly conducted security assessments, external and internal penetration testing, data privacy assessments, external security evaluations, the testing and implementation, as applicable, of new technologies, and continuing education and awareness of existing and new threat vectors, industry trends, changes in the environment and changes in the overall technology landscape. Pursuant to our Information Security Program, once a cybersecurity risk is identified, the Information Security team, in collaboration with other areas of the organization, will assess the risk and implement an appropriate response. Security risk assessments comprise the reasonably foreseeable impacts to the Company and its stakeholders due to the threats and known vulnerabilities associated with the operation and use of information systems and the environments in which those systems operate.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: To mitigate or address risks, Shentel leverages acceptable and well-known security tools and services allowing Shentel to maintain a robust security posture. Our Information Security Program addresses risks through a wide spectrum of measures, including enhanced monitoring, endpoint protection, multifactor authentication, privileged account security, web and email filtering and comprehensive internal employee training. Our security protocols are rooted in industry standards and guidelines issued by respected bodies such as the National Institute of Standards and Technology, the Department of Homeland Cybersecurity and Infrastructure Security Agency, and the Center for Internet Security. In addition, we regularly consult with external advisors regarding opportunities to enhance and strengthen our policies and practices.


text: With respect to third-party service providers, our Information Security Program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of actual or reasonably suspected information security incidents occurring on their systems that may affect our systems or data, including personal information.


text: Should a security breach or incident occur, the Chief Information Officer (the "CIO") in collaboration with the Company's General Counsel, Chief Accounting Officer (the "CAO") and Chief Operating Officer (the "COO") will evaluate the materiality of any specific incident. The Company's Chief Executive Officer (the "CEO") and Chief Financial Officer (the "CFO") will ultimately decide if an incident is material. Considerations of materiality will include a variety of factors, including, for example, the extent of expected financial cost, customers impacted, operational impacts, and/or data exposed or lost as a result of the incident.


text: The Information Security Program is intended to provide effective governance and oversight for assessing cybersecurity risks, recognizing that no program, no matter how well designed and implemented, can prevent all potential cybersecurity risks and that the benefits of any potential controls or mitigations should be considered in relation to their costs. While we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and threats have not materially affected our business strategy, results of operations or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Form 10-K.


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. If applicable, these committees periodically report to the Board of Directors on their risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program and our Board of Directors is involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis. The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management process and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks, including cybersecurity.


text: Our Director of Information Security leads the Information Security Program and reports to the CIO, who also provides additional oversight of the Program. The Director of Information Security has over 18 years of experience in the information technology and information security fields and the CIO has over 28 years of experience in the information technology and information security fields. In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives. The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr. Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO. Information security risks are reviewed with the Security Steering Committee periodically or as needed.


text: The CIO, in connection with the General Counsel and CEO, updates the Audit Committee periodically on cybersecurity and other information technology risks and opportunities. Additionally, the Audit Committee, with guidance from the CIO, General Counsel and CEO, provides updates to the Board of Directors on the Information Security Program at least annually. In the case of an information security incident or breach, the Director of Information Security and CIO will follow the Company's Incident Response Plan and follow communication protocols within the plan, which, depending on the severity of the incident, include escalation timelines and responsibilities that involve updating the Audit Committee and the Board of Directors, as applicable.


text: The Company has processes in place designed to protect its information systems and to assess, identify and manage material risks from cybersecurity threats. Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations. As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing monthly training and regular phishing simulation and exercises. In addition, the Company has engaged third parties in connection with these processes.

companyName: Root, Inc.

ticker: ROOT


text: The Company has engaged third parties to perform information security risk assessments and testing on a periodic basis. It also has engaged third parties to provide a variety of services, including providing hosted security products as well as services to support security incident detection and response activities. In order to identify and manage risk from third parties, the Company has implemented a third-party cybersecurity risk management program involving the assessment of information security risk related to the third-party, with consideration given to the inherent risk level, the adequacy of the third-party's control environment to mitigate those risks, and areas of residual risk. The breadth and depth of the assessment activities are designed to be commensurate with the nature and scope of the services provided by the third party.


text: The oversight of the Company's cybersecurity risk management processes are integrated into the Company's enterprise risk management process. Our board of directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, to improve long-term organizational performance and to enhance stockholder value. A fundamental part of risk management is not only understanding the most significant risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for a given company. The involvement of our full board of directors in reviewing our business is an integral aspect of its assessment of management's tolerance for risk and also its determination of what constitutes an appropriate level of risk. In connection with its reviews of the operations of our business, the board of directors addresses the primary risks associated with our business including cybersecurity. In particular, our board of directors is committed to the prevention, timely detection and mitigation of the effects of cybersecurity threats or incidents.


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. However, future threats could materially affect our business strategy, results of operations or financial condition. Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled "Risk Factors—Risks Related to Our Business—Data security breaches, or real or perceived errors, failures or bugs in our systems, website or app could impair our operations, compromise our confidential information or our customers' personal information, damage our reputation and brand, and harm our business and operating results."


text: While our full board of directors has overall responsibility for risk oversight, it has delegated oversight of certain risks to its committees, including the oversight of risks from cybersecurity threats. The board of directors delegated the oversight of cybersecurity risks to the Audit, Risk and Finance Committee, which oversees controls for the Company's major financial and security risk exposures. The board of directors, through the Audit, Risk and Finance Committee, oversees the design and implementation of the Information Security Program. The board of directors and the Audit, Risk and Finance Committee are informed about these risks through regular reports from the Chief Information Security Officer, or CISO, about the Information Security Program.


text: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company's Chief Legal Officer.


text: The Information Security group and senior leadership are responsible for assessing and managing risks from cybersecurity threats. The Information Security group is led by the Company's CISO, who is also responsible for the day-to-day management of the Information Security Program. Katelynn Sandy is the Company's CISO. Ms. Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology. Additionally, Ms. Sandy holds various information security certifications.


text: The Information Security group, senior leadership and the CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Information Security Program. At least quarterly, the CISO provides updates to the Audit, Risk and Finance Committee, which includes updates on the overall Information Security Program status and compliance, cybersecurity related risks, and recommended changes to the Information Security Program. Senior members of our Information Security and Internal Audit functions also provide detailed, regular reports on information security and privacy to the Audit, Risk and Finance Committee.


text: The consideration of cybersecurity threats are integrated into our overall risk management program. We engage external consultants who are experts in the field of cybersecurity and meet at regular intervals to evaluate current conditions and address any cybersecurity threats accordingly. We also provide continuous training to our employees regarding the risks related to cybersecurity. We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations, or financial condition. Governance.

companyName: SenesTech, Inc.

ticker: SNES


text: Our board of directors are responsible for the oversight of risks from cybersecurity threats. At least annually management reports to our board of directors about such risks. Our chief financial officer, Thomas Chesterman, has direct management responsibility in assessing and managing such risks. Mr. Chesterman has prior academic and professional experience in cybersecurity.


text: Cyberattacks represent a threat to water, wastewater and electric utility systems. There have also been increasing threats to the information that companies maintain that have resulted in unauthorized disclosure of private customer, employee, director and corporate financial information.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Threats can come from many sources, including, but not limited to, ransomware, malicious software, credential loss or theft, supervisory control and data acquisition ("SCADA") system takeover, equipment theft, supply chain attacks, phishing attacks, identity-based attacks, denial-of-service attacks or the actions of employees either intentional or accidental. Ransomware whereby hackers take control of a company's systems and/or data has been identified as the most significant threat to Registrant's critical infrastructure systems and is getting harder to detect and encrypted files are becoming harder to recover. Threat actors using ransomware have also increased their use of data, not only for direct ransom and data destruction, but also to release the data to the public. Registrant believes a breach of customer personally identifiable information is one of the most significant financial risks to it as the costs incurred could exceed the amount of its cybersecurity insurance coverage.


text: Nevertheless, in order to continue meeting Registrant's technological business needs and as more vendors build solutions in the cloud, Registrant expects to further expand its use of cloud-computing environments. As such, Registrant expects risks from cyberattacks and data breaches to increase due to the growth of its technological footprint in the cloud environments.


text: Registrant expects to continue to increase its investment in information technology to monitor and address cyber threats and attempted cyber-attacks, and to improve its posture in addressing security vulnerabilities. In addition, Registrant has dedicated employees with cybersecurity technical expertise and also leverages outside cybersecurity firms. Registrant has adopted multi-layered safeguards and educational measures to protect its operations, assets and digital information. Registrant conducts mandatory quarterly cybersecurity training for all employees. Registrant also conducts specialized training for ASUS employees annually on protecting certain types of information relating to the work ASUS and its subsidiaries do with the U.S. government to comply with U.S. government contracting requirements. In addition, Registrant conducts periodic and unannounced phishing tests with all employees and vulnerability assessment and penetration tests.


text: Registrant has adopted a cybersecurity incident response policy, plan and set of specific instructions, which are annually reviewed by the IT cybersecurity team members. Registrant is also taking actions intended to strengthen its cybersecurity posture and to improve its cybersecurity incident response plans and operating procedures. Despite the actions Registrant has taken and is taking and the fact that, to its knowledge, it has yet to experience a cybersecurity incident, there can be no assurance that Registrant will not experience a cybersecurity incident.


text: Risk management, oversight and response Cyber risk management is an ongoing iterative process that requires continuous identification, assessment and management of possible cyber threats and has become a vital part of Registrant's overall risk management efforts. Registrant's cybersecurity team assesses ongoing cybersecurity threats and vulnerabilities to prioritize and implement mitigation factors and defense to help contain and combat identified risks.


text: To ensure threat and vulnerability information is up-to-date, the cybersecurity team subscribes to multiple national and state-level threat and vulnerability information disclosure services, both general-purpose and industry-specific in nature. Updates from these sources include general information delivered on a daily basis and more threat-specific information delivered as required. Tools are in place within Registrant's environment to monitor for anomalous behavior and provide alerting and, in some cases, automated responses to threats. Registrant's cybersecurity team meets regularly with product vendors for these tools to ensure optimal configurations are in place to protect its environment.


text: To determine the risk to Registrant's systems, it engages in a continuous vulnerability management lifecycle process to identify and remediate vulnerable systems and system configurations. In this regard, Registrant leverages the National Institute of Standards and Technologies cybersecurity framework. To supplement Registrant's internal process, the cybersecurity team regularly contracts consultants to assess system configurations, both passively through exercises such as configuration review and actively through penetration testing, and response procedures, such as tabletop exercises, to identify areas for improvement. In addition, Registrant supplements its day-to-day operations with around the clock identification, assessment and mitigation of cyber risks with third-party security services as well. Registrant is working on implementing across AWR and its subsidiaries a comprehensive, risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems and data, as well as the systems of third parties that could adversely impact Registrant's business in the event of a cybersecurity incident affecting those third-party systems.


text: Cybersecurity updates are provided periodically to Registrant's senior management, including its CEO, CFO and senior vice presidents of Registrant's operations, and to the senior management of Registrant's subsidiaries. Cybersecurity risk management extends beyond Registrant's and its subsidiaries' senior management teams. Registrant's Board of Directors ("the Board") oversees enterprise risk management, or ERM, performed under the direction of Registrant's senior management team. Cybersecurity updates, including recent findings, changes to processes or personnel changes, are provided to the ERM liaison to the Board, who is a member of the Board, and to the full Board on a quarterly basis or more frequently if needed. Cybersecurity is one component of an overall ERM framework that involves Registrant's Board. The Board satisfies its oversight responsibility by obtaining information from the ERM liaison and senior management of Registrant, with input from the senior management of Registrant's subsidiaries as necessary. On a quarterly basis, Registrant's senior management will discuss the implementation status of plans to mitigate cybersecurity risks with the ERM liaison. The ERM liaison and Registrant's senior management will then provide a report to the full Board regarding the critical cybersecurity risks discussed, mitigation plans and implementation of the ERM program that addresses cybersecurity risks.


text: In addition, Registrant's plans require members of its senior management, such as its CEO and CFO, as well as members of management from its, and its subsidiaries', Operations, Information Technology, Human Capital Management, Accounting and Legal teams participate in Registrant's Cybersecurity Incident Response Team ("CIRT") to be kept current on all aspects related to a cyber-attack, if a cybersecurity incident were to occur.


text: Responses to cyber-attacks are fast-moving and dynamic and would require an assessment of actual or potential damage performed by Registrant's cybersecurity team. If a cyber-attack were to occur, continuous engagement, communication and collaboration between Registrant's cybersecurity team and members of its CIRT as well as third parties would likely be necessary in order to gather accurate and complete information, perform a comprehensive evaluation and assessment of the cyber-attack, manage and contain the cybersecurity threat, and develop and execute a remediation and recovery plan. Members of its CIRT team would work together to determine whether a cybersecurity breach is material and required to be reported to the Board and publicly under applicable law.


text: To ensure that members of Registrant's Board are informed of material cyber-attacks, Registrant's CFO and IT Director have been designated as key members of management that will provide current updates to Registrant's ERM liaison and the Board. The communication will include but not be limited to, the nature and status of the cyber-attack and Registrant's plan to contain and mitigate the cyber threat and ultimately the remediation and recovery plan to return to "business as usual" state. Registrant's CFO has over 15 years overseeing the Company's risk management area. Registrant's IT Director has over 25 years in Information Technology designing, implementing and supporting various cybersecurity and technical solutions, along with ensuring compliance with multiple cybersecurity regulations.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect Registrant, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts Registrant's critical operations, service or financial systems. See "Information Technology Risk Factors" under Item 1A. In addition, any unauthorized access to sensitive information or data breaches could be detrimental to Registrant's operations, critical corporate information and reputation and relationships with its customers, vendors, employees, directors and could negatively affect the future of contract awards at ASUS and could result in a termination of one or more of its existing contracts or the assessment of penalties. The cost of responding to a cyber-attack could be significant depending on the severity of the cyber-attack and could go beyond financial costs as operations and services provided by Registrant could be delayed and coordinated resources in response could be significant. Registrant could also be assessed penalties if it is determined that applicable data privacy laws have been violated.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the Nation's critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an everchanging landscape.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which follow frameworks established by the National Institute of Standards and Technology (NIST). These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry's risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: We work to protect our business from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and review trends in the data. We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and enhanced based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. • Information Sharing and Collaboration: We share and receive threat intelligence and best practices with industry peers, government agencies, information sharing and analysis centers, industry trade organizations, and cybersecurity forums. These relationships enable the rapid sharing of information around threat and vulnerability mitigation. • Third-Party Risk Assessments: We engage third-party services to conduct assessments of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These assessments include testing both the design and operational effectiveness of security controls. • Companywide Policies and Procedures: We have companywide cybersecurity policies and procedures, such as encryption standards, antivirus protection, remote access protocols, multi-factor authentication, protection of confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process and are approved by the appropriate members of management. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform simulations and other exercises with management and incorporate external resources and advisors as needed. Our team of cybersecurity professionals collaborate with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).


text: As of the date of this Form 10-K, there have not been any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. There can be no guarantee that our policies and procedures will be followed or, if followed, will be effective. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, which should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board, in conjunction with its Audit Committee, oversees management's approach to cybersecurity risk and its alignment with the Company's risk management program. The Board and Audit Committee receive reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and vulnerabilities. Additionally, management provides the Audit Committee with updates on cybersecurity risk assessments, risk mitigation strategies, and relevant internal and industry cybersecurity matters. The Company's Chief Information Officer ("CIO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board and Audit Committee. The Company's CIO has 25 years of experience in the information technology industry. The CIO reports to the Chief Executive Officer and is supported by a dedicated cybersecurity team within our information systems department, as well as a multidisciplinary incident response team. Employees across the organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity posture.


text: In addition, the Company's Risk Management Committee ("RMC") evaluates risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The RMC is comprised of members of the executive leadership team. The RMC meets monthly and receives updates from the CIO or a member of our cybersecurity team. The RMC reviews security performance metrics, global security risks, security enhancements, and updates on our security posture.


text: We rely on information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. Our IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cyber incident that could adversely impact our ability to operate its core business functions. As a financial services firm, we do not maintain a significant level of personally identifiable information data. Accordingly, our exposure to data breaches is more limited. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. However, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. We have implemented a comprehensive cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. We prioritize data protection through data classification and access management designed to permit access only by authorized personnel. Our cybersecurity incident response plan, integrated into the enterprise risk management framework, outlines a structured process for handling information security incidents involving assets or data. It guides our computer security incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Controls and related activities are designed taking into consideration recognized third party cybersecurity frameworks.


text: Oversight of cybersecurity is a joint responsibility of our Board of Directors and Audit Committee, with each receiving at least quarterly updates from management on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. We also maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.


text: Our Chief Information Officer leads our overall cybersecurity function and is responsible for developing and implementing our information security program and managing our response to threats. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT security team, including the third party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: We utilize on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed security services providers. These external managed security service providers collect events generated by critical systems in real-time, filters non-security events, and then correlates the information using security data analytical engines so that personnel can identify and analyze threats.


text: We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete a monthly computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users to identify information security threats and what actions should be taken. Additionally, the employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Annual risk assessments of our Information Security Program are conducted to identify emerging information security and third party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks. We also conduct independent audits on both the design and operational effectiveness of security controls and consult with external advisors on best practices to address new challenges.


text: With respect to our software platforms that are hosted by third parties, we utilize an external vendor risk management platform is utilized to evaluate, rate, monitor and track vendor risk. The security practices and processes of the service providers are monitored regularly, and periodic audits are performed on the security adequacy and compliance of the service provider. For any of our hosted applications we require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third party providers is part of our overall cybersecurity risk management framework.


text: We have implemented processes for overseeing, identifying and managing material risks from cybersecurity threats and have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our management, with input from our Board of Directors, performs an annual enterprise-wide risk management ("ERM") assessment to identify and manage key existing and emerging risks for our company. Our ERM process assesses the characteristics and circumstances of the evolving business environment at the time and seeks to identify the potential impact, likelihood and velocity of a particular risk. Our senior executive management team has the overall responsibility for, and oversight of, our ERM process, and senior executives are assigned to monitor and manage top identified risks. Cybersecurity is among the top risks identified for oversight as a result of our last annual ERM assessment.


text: Systems and process monitoring are essential components of our cybersecurity risk management and information security programs. Management utilizes industry standard tools and procedures to monitor the information security of systems, networks and information assets, regardless of geographic location, and has implemented key policies and procedures, including but not limited to cybersecurity threat detection and analysis, a framework for materiality determination and a reporting-up process to assist in a disclosure of a material event, if required. In addition, management has defined key roles and responsibilities within our organization to handle material cybersecurity incidents. A comprehensive incident response plan is utilized for any threat activities identified, including timely containment, analysis, remediation, and communication, and is also applicable to third parties with access to our information systems or assets. We have implemented security programs, such as mandatory cybersecurity awareness training for all our employees, simulated phishing emails and tabletop exercises, that are strategically designed and continuously updated to address evolving cybersecurity threats and latest industry trends. These programs, which are held multiple times a year, allow our employees to both identify and address material cybersecurity incidents, utilizing our comprehensive incident response plan.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and monitoring our cybersecurity programs and assets. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity risk management, strategies and processes remain at the forefront of industry best practices.


text: Because we are aware of the risks associated with third-party service providers, we have implemented processes to oversee and manage these risks, including security assessments of all third-party providers before engagement. In addition, cybersecurity program maturity of such third parties, including incident response and disclosure, is also evaluated.


text: To date, our business strategy, results of operations or financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. For more information on our cybersecurity related risks, see "Item 1A—Risk Factors—Risks Relating to Our Business" in this Annual Report on Form 10-K.


text: Our Board of Directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit and Risk Committee assists the Board of Directors in its responsibilities of overseeing cybersecurity risk. Our Chief Operating Officer ("COO") and Chief Information Security Officer ("CISO") play a pivotal role in informing the Audit and Risk Committee on cybersecurity risks. They report to the Audit and Risk Committee on a quarterly basis on a broad range of topics, including assessments and scoring of our information security program; incident management, the incident response plan and the status of security tools; the current cybersecurity landscape and emerging threats; and the status of ongoing cybersecurity awareness and training and projects to strengthen our information security systems. Additionally, our Executive Director, Internal Audit presents a quarterly report on our enterprise risk management activities, including cybersecurity risks, to the Audit and Risk Committee. The chair of the Audit and Risk Committee, in turn, periodically reports on its review with the Board of Directors, and our COO and CISO report annually to the Board of Directors regarding our cybersecurity program and risk management.


text: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy and managing our cybersecurity threat detection and response plan. With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role. Our CISO oversees our cybersecurity governance programs, monitors and assesses cybersecurity threats, monitor compliance with industry best practices and standards, and leads our ongoing employee cybersecurity training and awareness program.


text: We have implemented and maintain an ongoing cybersecurity risk management program, under the oversight of the audit committee of the board of directors, that is focused on identifying, assessing and mitigating cyber risk. We engage with multiple third-party vendors who provide a variety of services ranging from ongoing security advisory services to security monitoring and response management. In addition, we also have a process to assess and review the cybersecurity practices of third-party vendors and service providers, including through the use of vendor questionnaires and contractual security requirements, as appropriate. In addition to these efforts, we have implemented an ongoing enterprise risk management program that includes processes designed to identify, assess, and address cybersecurity risks. Our cybersecurity efforts are informed by industry standards and include periodic, targeted risk assessments supported by cybersecurity technologies, including third-party security solutions and monitoring tools, designed to monitor, identify, and address cybersecurity risks.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Additionally, as a public company, we are subject to various regulatory requirements around our internal controls, including our controls around our information technology systems and their impact on our financial statements or systems. We have engaged a third party vendor to advise us on our compliance with these requirements, including around our controls related to cybersecurity, and strategies to mitigate related risk. If we were to identify any control deficiencies that represent cybersecurity risks, those would be reported to the Chief Financial Officer and the audit committee, together with plans for corrective action, as appropriate.


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are managed by our Director of Information Technology, in consultation with the legal and human resources teams. Currently, the Director of Information Technology role is held by an individual who has over 17 years of cybersecurity, information technology, and systems engineering experience. The Director of Information Technology reports to the Chief People Officer.


text: The Director of Information Technology meets with the Chief People Officer periodically to monitor and review the outcomes of our cybersecurity risk management processes and to discuss and address matters related to cybersecurity risk management strategy. The Director of Information Technology, working with the Chief Legal Officer and Chief People Officer, provides periodic reports to the audit committee, which is responsible for reviewing and overseeing the Company's risk management processes, including cybersecurity risks. The Chief Financial Officer, Chief People Officer and Chief Legal Officer and/or other senior members of the legal team, participate in audit committee meetings, which are generally led by the Chief Financial Officer, as well as meetings of the full board of directors.


text: Our enterprise risk management process is overseen by our Chief Legal Officer and Chief Financial Officer. In collecting information on enterprise risk, cyber security is specifically included as a risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis.


text: We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats. This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments. Assessment of cybersecurity risk is part of our overall enterprise risk management ("ERM") process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: We maintain technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets. If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.


text: From time to time, our processes are audited and validated by internal and external experts. We leverage third-party cybersecurity experts with the goal of minimizing disruption to our business and production operations, strengthening supply chain resilience in response to cyber-related events, and supporting the integrity of IT systems. We also engage reputable third-party consultants to help evaluate and test our vulnerability to cybersecurity threats as well as to conduct annual penetration tests to help identify exploitable cybersecurity vulnerabilities. Our IT team assesses these testing results and implements any appropriate measures to mitigate vulnerabilities identified.


text: We have not experienced any material impacts from any cybersecurity threats or incidents in the last three fiscal years. We use each cybersecurity threat or incident as an opportunity to review our protocols and implement enhancements as applicable. For more information about our risks from cybersecurity threats, see Item 1A—Risk Factors—A failure of one or more of our key information technology ("IT") systems, networks, processes, associated sites, or service providers could have a negative impact on our business.


text: Our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks, and is assisted in these efforts by the Audit Committee of the Board. Our IT team is responsible for assessing and managing our risks from cybersecurity threats. Our IT team is led by our Vice President of Information Technology and Security, who reports directly to our Chief Financial Officer. During 2023, our Chief Information Officer (who has been serving as our Chief Commercial Officer since January 2024) provided updates on cybersecurity threats and risks to our Board of Directors and to the Audit Committee of our Board of Directors. In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2023, as part of their oversight of our enterprise risk management process.


text: Our Vice President of Information Technology and Security has over 25 years of experience in IT and has held a variety of IT roles across multiple business lines within the financial services, aviation, and hospitality industries. He received both his bachelor's and master's degrees in information management and holds Certified Information Systems Security Professional ("CISSP") certification.


text: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Chief Executive Officer and Chief Financial Officer, as appropriate.


text: With respect to cybersecurity risks, we have invested and continually invest in new cybersecurity services, technologies, and capabilities. On an ongoing basis we provide our employees with comprehensive cybersecurity awareness training around phishing, malware and other cybersecurity risks, all in a manner reasonably intended to educate employees to safely avoid cyber attacks and mitigate the risk of employee related security breaches. In support of our cybersecurity program, our systems and services undergo regular reviews by management to determine if any insufficiencies in cybersecurity exist.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: If an incident is detected, the Cybersecurity team follows the incident response policy to investigate, review and determine the potential impacts of such an incident. If the Cybersecurity team determines that an incident could reasonably be expected to have an impact on the financial condition or operations of the Company, it escalates the incident to the crisis management team, which includes executive management. The crisis management team further evaluates the potential impact and materiality of an event and the appropriate response required. The crisis management team coordinates the appropriate response effort and communicates, as applicable, to the Audit Committee. To the extent that Cybersecurity incident is determined to be material, the appropriate public disclosures are made.


text: We monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and reevaluate these risks periodically. We also perform third-party cybersecurity audits at least annually and conduct third-party security reviews and testing of our network, processes and systems periodically.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition We rely on our computer networks and systems, some of which are managed by third-parties, to manage and store electronic information (including sensitive data such as confidential business information, personally identifiable data and personal health information), and to manage or support a variety of critical business processes and activities. We may face threats to our networks from unauthorized access, security breaches and other system disruptions. Despite our security measures, our infrastructure may be vulnerable to external or internal attacks. Any such security breach may compromise information stored on our networks and may result in significant data losses or theft of sensitive or proprietary information. A cybersecurity breach could hurt our reputation by adversely affecting the perception of customers and potential customers about the security of their orders and personal information, as well as the perception of our manufacturing partners of the security of their proprietary information. In addition, a cybersecurity attack could result in other negative consequences, including disruption of our internal operations, increased cybersecurity protection costs, lost revenue, regulatory actions or litigation. Any disruption of internal operations could also have a material adverse impact on our results of operations, financial condition and cash flows.


text: As of the date of this report, we have not experienced any known cybersecurity incidents, or a series of related incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our Board actively oversees our corporate strategy and enterprise risk management ("ERM") programs, including those relating to cybersecurity and data privacy risks.


text: Our Audit Committee and Nominating and Corporate Governance Committee are primarily responsible for, among other things, overseeing our compliance and ERM programs, information technology systems, and our processes and data, including cybersecurity and data privacy. These responsibilities include reviewing and discussing with management our policies and processes relating to risk assessment and risk management. Cybersecurity and data privacy are regular topics on the Audit Committee's agenda and management reviews at least quarterly the results of cybersecurity monitoring and discusses performance metrics, any incidents identified and potential recommended modifications to our technology, organization training, awareness and governance with our Audit Committee. A summary of these results are also reported by the Audit Committee to the Board at least annually.


text: Management, including our Chief Information Officer ("CIO"), who has over 25 years of experience serving primarily in the life science industry and is a recognized industry leader, is responsible for monitoring and assessing cybersecurity risks. Management reviews and determines the effectiveness of both internal and third-party leveraged expertise to ensure we have the appropriate knowledge base for risk coverage.


text: Our cybersecurity program is designed to detect known and anticipated threats, and contemplate various types of unexpected but possible threats. We have developed processes to identify, assess, mitigate, analyze and respond to threats, and continue to mature our cyber resiliency solutions.

companyName: Spirit AeroSystems Holdings, Inc.


text: We continuously monitor the cybersecurity landscape and identify active and potential threats through a combination of tools and processes. Our Global Information Security ("GIS") team has day-to-day responsibility for Spirit's cybersecurity program. This group is led by a Chief Information Security Officer ("CISO") with more than twenty years of audit and cybersecurity experience. The CISO collaborates across the business, participates in internal audits, and is active in several leading industry groups to help benchmark our efforts with third parties. GIS receives and analyzes information from various resources to inform our cybersecurity program needs. An Enterprise Security Council comprised of GIS, Information Technology, Legal, Compliance, Internal Audit, and Enterprise Risk Management meets regularly to discuss emerging cyber risks and corresponding mitigations as part of our overall Enterprise Risk Management program. Significant risks are escalated to the Enterprise Risk Council which is chaired by our President and CEO, who was the Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy. We implement appropriate controls to protect our information or information we have control of on our systems, and our operations. We evaluate our controls and systems against industry-recognized standards, and contractual requirements, as applicable.


text: The CISO monitors and reviews our process of patching compliance, which is managed and executed via a combination of internal resources and third-party service providers. We also use third parties to supplement monitoring of cyber activity and for various special projects, which may include projects related to cybersecurity.


text: As part of our cybersecurity risk management program, we have planned "tabletop" exercises designed to simulate various cybersecurity threats or intrusions and help identify gaps in our preparedness, and help provide clarity in how to respond to any potential incidents. These exercises are designed to test the working level and senior leadership level, including participation by Executive Leadership Team. All employees are required to take mandatory cybersecurity training courses throughout the year. We execute simulated phishing exercises and provide direct feedback to employees who fail such simulations to help them understand how to recognize phishing attempts. Our overall program is designed to help us prevent and effectively respond to cybersecurity incidents.


text: GIS maintains an Incident Management and Response Policy that provides a classification framework for cybersecurity incidents and defines critical roles and responsibilities during a cybersecurity incident. The Incident Response Policy specifies ownership and timing of key actions and prescribes the engagement of functional leaders, senior Executives, and the Board of Directors, depending on the incident. We have developed playbooks to guide specific actions related to different incident types. Finally, we have a cyber insurance policy underwritten by a global leader in commercial insurance solutions.


text: Part of our Enterprise Risk Management program involves understanding risks that third parties, including those that our supply chain introduce to our organization. Our cybersecurity program is in the process of maturing how we assess third-party cyber risks, particularly in situations where we share confidential or sensitive information, or in situations where our operations may be impacted through a cybersecurity incident at a third party.


text: The Board of Directors' Risk Committee has the responsibility for oversight of our cybersecurity program. This committee's membership includes subject matter experts in both cybersecurity and national security. Spirit's CISO reports to the Risk Committee quarterly on the state of our cybersecurity program.


text: Although cybersecurity risks have not materially affected us, including our business strategy, results of operations, or financial condition, during the period covered by this report, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors – Risks Related to Our Operations"


text: We have a cybersecurity risk management program consisting of policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these policies and procedures into our overall risk management systems and processes. Our cybersecurity policies and procedures are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We routinely assess material risks from cybersecurity threats and regularly assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations.

companyName: Block, Inc.

ticker: XYZ


text: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel.


text: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures. Our employees participate in cybersecurity training and awareness upon hire and at least annually thereafter.


text: We engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.


text: We have processes in place to identify, review and evaluate cybersecurity risks associated with our use of third-party service providers. These reviews are conducted at onboarding and periodically throughout the tenure of the service provider based on risk tier rating of each service provider. We believe these processes enable us to evaluate a third-party service provider's security posture, identify risks that may arise out of our use of the third party's service, and make decisions regarding acceptable levels of risk and risk mitigation.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Board and Management's Role in Data Privacy and Cybersecurity Oversight Our board of directors recognizes the oversight of risk management as one of its primary responsibilities and central to maintaining an effective, risk-aware and accountable organization. While the board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program and risks, it has delegated certain oversight responsibilities to our audit and risk committee. Our board of directors and audit and risk committee's principal role is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The audit and risk committee assists the board of directors in enhancing its understanding of data privacy and cybersecurity issues by overseeing our data privacy and information security programs, strategy, policies, standards, architecture, processes, and significant risks, as well as overseeing responses to security and data incidents, as appropriate.


text: The full board of directors undergoes annual information security and privacy training by our Chief Information Security Officer ("CISO") and our Chief Privacy Officer ("CPO"), which covers, among other matters, our privacy and cybersecurity programs and risks. Our audit and risk committee receives updates, at least quarterly, from our CISO and CPO on significant data privacy and security risks, including any significant incidents, relevant industry developments, threat vectors and significant risks identified in periodic penetration tests or vulnerability scans. The updates also include significant legal and legislative developments concerning data privacy and security, our approach to complying with applicable law, and significant engagement with regulators concerning data privacy and cybersecurity. Our audit committee provides regular updates to the board of directors on such reports.


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our foundational engineering, data security governance, infrastructure security, product security and security operations teams report directly to our CISO and provide regular updates on significant or potentially significant threats and incidents. Additionally, we have an incident response team and an incident response plan that outlines the roles and responsibilities of key personnel, including representatives from information security, compliance, and counsel, that are involved in responding to, remediating and escalating such incidents to the CISO, as appropriate. Our CISO reports directly to our Chief Financial Officer and Chief Operating Officer and indirectly to our audit and risk committee. Our CISO provides updates on significant or potentially significant threats and incidents to our Block Head and leadership team, in addition to the audit and risk committee and our board of directors as appropriate and in accordance with the processes detailed in the prior paragraph.


text: Our CISO and Deputy CISO are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has served in various roles building and securing enterprise platforms across retail, corporate and investment banking financial services as well as consumer experiences and data at multiple Fortune 500 companies for over 25 years. Our Deputy CISO has over 20 years of experience in information security, including serving as head of cybersecurity and privacy response at a global public company and information security leadership positions with the United States government. Our Deputy CISO holds undergraduate and graduate degrees in computer information systems and computer science with an information security focus and possesses various certifications, including the Information Systems Security Professional (NSTISSI No. 4011) and Information Systems Security Officer (CNSSI No. 4014) certifications.


text: We have an enterprise-wide approach to addressing cybersecurity risk, including input and participation from management and support from our Information Technology ("IT") Steering Committee that is comprised of our Senior Vice President Electronic and Structural Systems, Chief Financial Officer, General Counsel, Chief Human Resources Officer, Vice President Supply Chain Management, and Chief Information Security Officer (Head of IT and Cybersecurity or "CISO"). Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Framework which augmented with Cybersecurity Maturity Model Certification ("CMMC") components to meet our particular needs. We regularly assess the threat landscape and take a holistic view of the cybersecurity risks, with a layered cybersecurity strategy based on protection, detection, and mitigation. Our IT security team, which is comprised of internal resources, reviews enterprise risk management-level cybersecurity risks at least annually.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Our CISO is responsible for developing, implementing, and maintaining our information security strategy and program, as well as reporting various cybersecurity risk matters to our IT Steering Committee, and the Board's Innovation Committee. The Innovations Committee is a subset of the full Board of Directors which receive regular updates on our cybersecurity program.


text: Our CISO has over 17 years of experience leading cybersecurity oversight for several companies and is updated on cyber events related to the monitoring, prevention, detection, mitigation, and remediation efforts from our IT security team. The IT security team have broad cybersecurity expertise or industry certifications and are knowledgeable in the use of cybersecurity tools and software. In addition, third-party cybersecurity services are used to augment our in-house capabilities, as needed.


text: We continue to expand investments in IT security, including additional end-user security awareness training, using layered defenses, identifying and protecting critical systems, strengthening monitoring and alerting, and engaging experts as needed. We also use an industry standard risk quantification model to identify, measure, and prioritize cybersecurity risks. This in turn, helps us develop and implement effective security controls and technology defenses. In addition, all employees are required to complete various cybersecurity trainings on a regular basis. Further, we perform periodic simulations and tabletop exercises with the IT security team and will continue to expand its participants as appropriate. Our assessment of risks associated with the use of third party providers on a limited basis is part of our current overall cybersecurity risk management approach. As the threats and attacks are becoming more sophisticated, we will modify and enhance our cybersecurity program as needed.


text: As a defense contractor, we must also comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI"). The Department of Defense ("DoD") will require defense contractors to comply with its CMMC program in the future. We are incorporating the requirements of the CMMC program into our overall cybersecurity program and anticipate we will be in position to meet such requirements when it becomes effective.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents have not materially affected or are not reasonably likely to materiality affect us, including our business strategy, results of operations or financial condition. See "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with third-parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures. For more information regarding the risks we face from cybersecurity threats, please see Risk Factors included in Part I, Item 1A of this Form 10-K.


text: Our Board of Directors is responsible for ensuring that the Company has effective procedures for assessing and managing risks to the Company's operations, financial position, and reputation. The Board has charged the Audit Committee with responsibility for monitoring the Company's processes and procedures for risk assessment and risk management. Cybersecurity represents an important component of our overall approach to enterprise risk management. The Audit Committee receives regular reports, including twice annually from our Chief Information Security Officer ("CISO"), on a wide range of cybersecurity topics, including our cybersecurity program's performance, emerging threats, capability enhancements, recent developments, evolving standards, technological trends and other relevant topics. The Audit Committee also receives an update at least quarterly on the Company's cybersecurity metrics and key performance indicators. Executive leadership is continually apprised of developments pertaining to our cybersecurity program through electronic communications and senior leadership meetings.

companyName: Crane NXT, Co.

ticker: CXT


text: Roles and Capabilities Our CISO, in coordination with members of our senior leadership team such as our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel ("GC"), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats. Through ongoing communications with these teams, our CISO and senior leadership team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.


text: Our CISO is responsible to communicate potential and actual cybersecurity incidents to our senior leadership team in a prompt manner. We have established internal reporting processes so that the Board of Directors and the Audit Committee promptly will receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Such processes are evaluated on a regular basis. In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including outside advisors to the extent appropriate.


text: Our CISO, reporting to our CFO, leads our cybersecurity program. Our CISO has more than 20 years of cybersecurity experience and holds CISSP (2002) and CISM (2009) certifications. The cybersecurity team reporting to our CISO is staffed by highly skilled cybersecurity professionals, including both internal staff and external partners. Many team members have one or more industry recognized cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager/Auditor (CISM/CISA). In addition, our CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have extensive experience managing risks at Crane NXT and at similar companies.


text: Our security operations team is responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis. This team consists of both internal employees located in several countries as well as a partner organization who supports our security operations team 24/7.


text: Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management programs and are based on recognized frameworks and other applicable standards. Our cybersecurity program has comprehensive processes for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity program utilizes a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. Our program has adopted and implemented an approach to identify and mitigate cybersecurity risks that include commercially reasonable technologies for companies with similar risk profiles.


text: Our cybersecurity program is regularly assessed through activities such as penetration tests, internal audit assessments, an annual external PCI compliance audit in the CPI business, and ISO 27001 re-certification in the Currency business. The results of these assessments are reported to our Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices to reduce cybersecurity risk based on the information provided by these exercises and assessments. Our cybersecurity team also conducts an annual incident response exercise that includes executive leaders to ensure alignment should we experience a cybersecurity incident.


text: We provide regular training and awareness for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Cybersecurity Identified Risks As of the date of the filing of this Current Report on Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to affect, us, including our business strategy, results of operations, or financial conditions.


text: We could be adversely affected in the future by any information system or technology network failure or breach in data security, including any such failure or breach involving personally identifiable or other confidential information, any non-compliance with our contractual or other legal obligations regarding such information, or any violation of our privacy and security policies with respect to such information. See also Item 1A, Risk Factors, "Information systems and technology networks failures and breaches in data security, personally identifiable and other information, non-compliance with our contractual or other legal obligations regarding such information, or a violation of our privacy and security policies with respect to such information, could adversely affect us."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: SLM Corp

ticker: SLM


text: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook and Cyber Assessment Tool, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Crisis Management Policy that guide our response to cybersecurity incidents; and • a third-party risk identification and management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure" in this Form 10-K.


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Operational and Compliance Risk Committee of the Board. The Operational and Compliance Risk Committee of our Board of Directors oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Security Officer ("CSO") reports to our Chief Operational Officer and President of the Bank and leads the Company's overall cybersecurity function. Our CSO provides periodic updates on our cybersecurity risk management program to the management-level Operational and Compliance Risk Committee ("OCRC") and Executive Committee ("EC"). The Operational and Compliance Risk Committee of our Board of Directors also receives periodic reports from our CSO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.


text: Our CSO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CSO is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for leading our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CSO has significant executive experience in managing and leading IT and cybersecurity teams in both government and the private sector and has received industry recognition in the cybersecurity area. Our CSO holds cybersecurity certifications from leading cybersecurity training and research institutes, is a Fellow at the National Security Institute, and is a member of the Board of Directors of the Financial Services Information Sharing and Analysis Center.


text: The proper confidentiality, integrity, and availability of the Company's information systems are critical to the business. Securing the Company's business information, customer, patient and employee data, and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements, and maintaining the trust of its stakeholders. As part of its enterprise risk management program, the Company has processes in place to assess, identify, and manage material business, operational and legal risks from cybersecurity threats. Such risks include business disruption, fraud, extortion, reputational harm, violations of laws and regulations, litigation, and harm to employees, patients, customers and business partners.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: The Company's cybersecurity program is structured around the cybersecurity framework ("Cybersecurity Framework") of the National Institute of Standards and Technology ("NIST"), an agency of the U.S. Department of Commerce. The Cybersecurity Framework provides best practices to prevent, detect, identify, respond to, and recover from cyber-attacks. The Company's cybersecurity program involves establishing information security policies, procedures and standards, investing in and implementing information protection processes, security measures and technologies, ongoing monitoring of systems and networks on which the Company relies, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company engages an external third-party cybersecurity assessor to perform an annual assessment or validation of the cybersecurity program in accordance with the Cybersecurity Framework and the HIPAA Security Risk Assessment Tool of the U.S. Health and Human Services Office for Civil Rights.


text: The Board of Directors of the Company provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide annual written reports and quarterly briefings on the Company's cybersecurity program to the Board of Directors. They also provide quarterly cybersecurity updates to the Audit and Compliance Committee. The reports to the Board of Directors include details and metrics on, among other things, the Company's quarterly Cybersecurity Framework assessment updates, internal and external threat intelligence, quarterly information security program progress, business associate risk assessments and ongoing monitoring, company-wide awareness training, device security compliance, routine resilience efforts including disaster recovery exercises, tabletop security incident response exercises, and cyber penetration tests.


text: The Company's management, including the Company's CIO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CIO and CISO each have more than 20 years of experience in cybersecurity. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.