text: AGM's CISO, in coordination with the AGM Technology and ERM teams, works collaboratively across AGM to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of AGM's cybersecurity risk management program, multidisciplinary teams throughout AGM are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to AGM's audit committee or AGM's Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Directors, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: MidCap Financial Investment Corp

ticker: MFIC

secItem: Item 1C


text: AGM's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Investment Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Investment Adviser and AGM), including risk mitigation, compliance and controls.


text: We assess, identify and manage material risks from cybersecurity threats through various protective policies, procedures and processes. These are embedded into our overall risk management system and extend to risks related to systems hosted by third parties.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: We utilize external standards, such as the Center for Internet Security framework, as a starting point for the design and development of our systems that assess risk and mitigation measures. Helios is committed to achieving compliance with the CIS implementation group level 2 standards. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather we use external standards as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business. An annual risk assessment is completed and presented to the executive leadership team and the Company's Board of Directors. We discuss changes to our policies, procedures and processes needed to address gaps identified through the assessment.


text: We maintain organizational safeguards that include employee training, business continuity planning and cybersecurity insurance. These safeguards are reviewed on an annual basis or more frequently as the business environment warrants and are adjusted as needed to account for changes in the Company and overall risk environment. Cybersecurity training is delivered to employees through a combination of online modules and, where role-specific needs or circumstances warrant, instructor-led classroom sessions. This approach ensures comprehensive training tailored to the requirements of various roles while maintaining flexibility and accessibility.


text: We incorporate technical safeguards such as Multi-Factor Authentication ("MFA"), principles of Zero Trust and password complexity policies for all accounts to help prevent unauthorized access to our systems and data. Additionally, we utilize XDR (Extended Detection and Response) installed on endpoints, along with our Security Operations Center ("SOC") to manage real-time endpoint protection monitoring.


text: We engage in annual corporate-wide internal and external facing penetration tests, employing a battery of hacking tools to map out our assets and to assess vulnerabilities that could be exploited. In addition, we also extend such testing to newly acquired companies and assets as part of the integration process. This penetration testing is performed by a third party and is used to evaluate our current posture towards cybersecurity threats and to make adjustments, as needed, to protect our systems. The results are reviewed with the executive leadership team and the Company's ESG Committee of the Board of Directors.


text: We have an Incident Response Policy and related processes that outline steps to be taken in the event of a cybersecurity incident that impacts Helios, our partners and third-party hosted systems. When a cybersecurity incident occurs, the IT team promptly notifies the VP, Information Technology and assesses its potential impact on operations and business continuity. Incidents that pose a potential threat to operations or business continuity are escalated to a cross-functional team comprising the VP, Information Technology, the Chief Financial Officer (CFO), and the General Counsel. This team evaluates the incident's materiality, considering factors such as the nature, scope, and timing of the event, as well as its potential financial and operational. Based on the evaluation, incidents determined to be material are reported to the ESG Committee. This escalation ensures that the Board of Directors is informed of significant cybersecurity events that could impact the company's financial health or operations.


text: No risks from cybersecurity threats nor any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, but we cannot provide any assurance that they will not be materially affected in the future by such risks or incidents. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see "Risks Relating to Our Business: Other––Increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, solutions and services" in Item 1A, Risk Factors.


text: Role of Management Helios Technologies' Information Technology organization is led by the VP, Information Technology and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation and its business units, with oversight by the ESG Committee.


text: Helios' VP, Information Technology is an active member of InfraGard and has formal education in information technology with over 25-years' experience in roles involving management of cybersecurity functions, cyber strategy, and leading and collaborating on information systems and related technologies. The VP, Information Technology receives regular updates on cybersecurity developments, results of mitigation efforts and cybersecurity incident response and remediation through monthly Advanced Threat Intelligence briefings and FBI bulletins via Infragard.


text: Helios information systems organization and its management team are responsible for developing and implementing its cybersecurity policies and is comprised of individuals with either formal education in information technology or cybersecurity or relevant experience working in information technology and cybersecurity. Additionally, leaders in Helios' information technology function receive periodic training and education on cybersecurity related topics including certifications.


text: Role of the Helios Board of Directors The ESG Committee addresses risks related to the global enterprise, including material risks facing the businesses, risks the Company may face in the future, measures that management has employed to address those risks and other information relating to how risk analysis is incorporated into the Company's corporate strategy and day-to-day business operations. As part of this oversight function, the ESG Committee is responsible for overseeing cybersecurity-related risks. The ESG Committee includes cybersecurity topics in its quarterly updates to the full Board of Directors, which provides further oversight over our cybersecurity-related risks and the Company's strategies to address such risks. Reports to the Board of Directors and ESG Committee include comprehensive updates on the current cybersecurity risk landscape, the status of ongoing mitigation efforts, and emerging incident trends. Additionally, these reports cover updates on third-party risk assessments, progress on cybersecurity initiatives such as technology upgrades, regulatory compliance measures, and employee training programs.


text: Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT security, governance, and risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct privacy and cybersecurity reviews of systems, applications, and applicable data policies; perform penetration testing using external third-party tools and techniques; conduct employee training; monitor emerging laws and regulations related to data protection and information security; and implement appropriate changes. We have implemented incident response and breach management processes that are overseen by leaders from our information security, engineering, compliance and legal teams regarding matters of cybersecurity. Security threats are evaluated, ranked by severity and prioritized for response and remediation. Potential data security incidents are investigated to determine operational and business impact, applicability of regulatory or contractual data privacy requirements, including state data breach notification statutes, and materiality. We conduct tabletop exercises to simulate responses to cybersecurity incidents and collaborate with technical and business stakeholders across our business units to form detection, mitigation and remediation strategies. We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EverQuote, Inc.

ticker: EVER


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of insurance provider customers, third-party publishers, other service providers, or consumer referrals and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Item 1A. Risk Factors —Risks Related to Our Business and Industry— Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or our third-party service providers."


text: The Chief Information Officer, or CIO, leads our information security organization responsible for overseeing EverQuote's information security program. Our CIO has over 30 years of industry experience managing risks or advising on cybersecurity matters. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board oversees our enterprise risk management processes directly and through its Audit Committee. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: We rely heavily on information technology (IT) systems in all aspects of our operations, and data security plays an important role in the protection of our proprietary information and that of our customers and suppliers. For these reasons, we take a number of steps to protect Onto Innovation's IT systems from internal and external cybersecurity threats.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, and privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, utilize an expert third party to continuously monitor and respond to possible threats, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes. We regularly collaborate with leading security providers, industry groups, and industry peers to exchange information on trends and best practices to address new and evolving cybersecurity risks.


text: We have implemented incident response processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and review of an incident, 3) containment and remediation, and 4) post-incident review and analysis. Cybersecurity incident responses are managed by our Corporate Incident Response Team and overseen by our Vice President of IT.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborates with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and subject matter experts to assess our internal cybersecurity programs and compliance with applicable practices and standards. Since 2021, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.


text: Our cybersecurity program also includes third-party assessments to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk assessments during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: Our individual employees also play an important role in our information security systems. All employees are required to familiarize themselves with the Company's information security policies and, at least annually, employees are required to participate in an information security training program, which is designed to help employees identify potentially threats and train them on how to respond. Throughout the year, the IT department conducts phishing campaigns and other simulated hacking attacks with employees as a way of reminding them of their security obligations and ensuing that our SETA (security education and training awareness) has been effective.


text: As of the date of this Form 10-K, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information on the cybersecurity risks we face that could adversely impact us, please see "Part I, Item IA - Risk Factors - If our network security measures are breached and unauthorized access is obtained to a customer's data, to our data, or to our information technology systems, we may incur significant legal and financial exposure and liabilities and may experience disruptions in our operations".


text: The Company's Board of Directors has oversight of information security matters at the Company, including reviewing the Company's cybersecurity practices. At least annually, the Vice President of IT presents the Company's information security policies and programs to the Board. Our Audit Committee is tasked with overseeing risks from cybersecurity threats. Members of the Audit Committee receive updates on cybersecurity matters on a quarterly basis from one or more representatives from the Company's Cyber Security Council ("CSC"), which is composed of our business unit general managers, other members of senior management, our Vice President of IT and our IT Security Manager. These updates include a discussion of existing and new cybersecurity risks (if any), updates on how management is addressing and/or mitigating those risks, and the status of information security initiatives. Other Board members also engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs outside of the scheduled meetings.


text: The CSC is also responsible for the executive level supervision of the Company's cybersecurity risk, information security, and technology risk, as well as the IT department's actions to identify, assess, mitigate, and remediate cyber related issues. The CSC receives regular quarterly reports from the Vice President of IT on the Company's cybersecurity risk profile and enterprise cybersecurity program.


text: We have also established a process whereby potentially material cybersecurity incidents are escalated to a Cybersecurity Disclosure Committee ("CDC") consisting of our CEO, CFO, Vice President and General Counsel, Vice President of IT and Corporate Controller. The CDC is tasked with evaluating whether such incidents have material impact on the Company, and thus require disclosure, as well as any other actions that may be appropriate in response to the incident. The CDC promptly notifies the Audit Committee if it determines that an incident is likely to have a material impact on the Company and updates the Audit Committee on a quarterly basis of any incidents that it has evaluated and determined were not material.


text: The Vice President of IT acts as our head of information security in leading our information security organization. Our Vice President of IT has over 25 years of industry experience leading large technology organizations, including, most recently, as the leader of the IT organization at a large privately held company. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at other technology companies.


text: We recognize the critical importance of developing, implementing, and maintaining proactive cybersecurity measures to safeguard our information and operational systems and protect the confidentiality, integrity, and availability of our data. To that end, we engage in the following cybersecurity risk management principles:

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Additionally, our proactive risk management approach is formed by a variety of established cybersecurity frameworks. The security function housed within our Technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs and in cooperation with our broader risk management team.


text: Proactive Risk Mitigation & Vulnerability Management We take a proactive approach to cybersecurity, evaluating the latest industry threats against our organization to ensure protection. This evaluation directly informs our security enhancements. For example, identified vulnerabilities or threat vectors prompt updates to firewalls, intrusion detection systems, email filtering and security training etc. We also perform real-time analyses, automate responses to suspicious activity, and maintain robust alerts. The results of these scans, along with threat intelligence, are used to prioritize vulnerability remediations and enhance long-term cyber security hardening efforts.


text: Third-Party Risk Management Advisors Recognizing the complexity and the evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program and practices. This ecosystem enables us to leverage specialized knowledge and insights, ensuring our cybersecurity program and practices remain attuned to our Company's particular needs and vulnerabilities. Our collaboration with these third-parties includes annual penetration tests on externally facing systems, annual external and internal risk assessments and subject matter expertise consultation on risk remediation and security enhancements.


text: Vendor Risk Oversight Given the risks associated with using third-party service providers, we have developed processes to oversee and manage these risks. We aim to start the assessment right from the vendor onboarding stage, by conducting security and background assessments of vendors prior to their engagement, and we endeavor to monitor ongoing relationships to ensure compliance with our cybersecurity standards. These processes are designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats As of the date of this Annual Report, though we and the third parties with whom we do business have experienced certain cybersecurity incidents, we are not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business, financial condition or results of operations. However, we recognize that cybersecurity threats are continually evolving, and there remains a risk that a cybersecurity incident could potentially negatively impact us. Despite the implementation of our cybersecurity processes, we cannot guarantee that a significant cybersecurity attack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business, including the interruption of key services that our customers depend on. While we devote resources to our security measures to protect our operations and information, these measures cannot provide absolute security.


text: The Board is aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence. As such, the Board engages with our management team, as necessary, for updates on our cybersecurity risk program and progress on remediation efforts.


text: The Board is central to the Company's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Board is composed of members with depth of experience in enterprise risk management, compliance, corporate governance, technology, finance, and the unique characteristics and vulnerabilities of the oil and gas industry, equipping them to oversee cybersecurity risks effectively.


text: Management's Risk Management Role Our VP of Technology plays a pivotal role in informing the Board on cybersecurity risks. As necessary, he provides briefings to the Board encompassing a broad range of topics, including: • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and progress on remediation efforts; and • compliance with regulatory requirements and industry standards.


text: Cybersecurity Risk Management Personnel Our VP of Technology, Shaam Farooq, has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. Mr. Farooq has over 25 years of experience in global technology leadership, having served as an enterprise CISO across multiple industries. He actively participates in the oil and gas cybersecurity community, ensuring our security strategy remains responsive to current industry threats and aligned with best practices. Shaam continues to refresh his Certified Information Systems Security Professional and Certified Information Security Manager trainings as necessary.


text: Cybersecurity Incident Monitoring The VP of Technology strives to be continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The VP of Technology has implemented industry tools and oversees the processes for the regular monitoring of our information and operational technology systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VP of Technology is equipped with an incident response plan (IRP). This comprehensive plan encompasses immediate actions like identification, containment, and eradication, mid-term objectives such as recovery, and long-term goals including forensic analysis and lessons learned. It also lists response parties as well as chain of command and reporting. We regularly test our incident preparedness through at least one annual drill and tabletop exercise. These activities simulate real-world attacks, allowing us to evaluate and refine our incident response plan. Drills focus on specific technical responses, while tabletop exercises involve key stakeholders walking through the response process to identify potential gaps. The insights gained from these exercises ensure our team is prepared to effectively respond to and recover from security incidents.


text: Reporting to Board The VP of Technology regularly informs the Chief Executive Officer regarding cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. In addition to briefings on an as-needed basis, any significant cybersecurity matters and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: We recognize that cybersecurity threats pose a risk to our business. As part of the Company's overall risk management systems and processes, we employ a risk management framework designed with the goals of identifying, assessing and managing material risks from cybersecurity threats. Key aspects of this risk management framework include, but are not limited to: • Maintaining a cybersecurity incident response plan, coordinated by the Company's IT department and Chief Information Security Officer, which includes controls and procedures for identifying, reporting and responding to cybersecurity incidents; • Partnering with outside cybersecurity vendors periodically to gain an independent view of our cybersecurity and information security program; • Providing our employees with regular training on cybersecurity and the protection of our information systems; • Maintaining and testing a business continuity and disaster recovery program; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining insurance coverage intended to address cybersecurity and data breach risks.

companyName: Addus HomeCare Corp

ticker: ADUS


text: We have also implemented processes to help identify, assess and manage cybersecurity risks associated with our use of third-party service providers.


text: We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "A cyber-attack or security breach could cause a loss of confidential consumer data, give rise to remediation and other expenses, expose us to liability under privacy laws, consumer protection laws, common law and other legal theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, result in interruptions or delays to services, adversely impact our financial results, and otherwise be disruptive to our business" included in Part I, Item 1A of this Form 10-K.


text: Our cybersecurity risk management program is integrated into our overall risk management system and processes. Together with the Board's standing committees, the Company's Board of Directors is responsible for ensuring that material risks, including material cybersecurity risks, are identified and managed appropriately. The Board receives updates at least bi-annually from our Chief Information Officer concerning our information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness and cybersecurity risk assessments. The Chief Information Officer has extensive IT and program management experience and works closely with our Chief Information Security Officer, who oversees our cybersecurity program on a day-to-day basis. The Chief Information Security Officer has extensive cybersecurity experience, including more than 15 years working in senior IT infrastructure and IT security roles in the healthcare sector (seven of which years were spent as the Chief Information Security Officer). Our cybersecurity incident response plan provides that the Chief Information Security Officer will work with our IT Department and the impacted segment of our business to investigate and respond to any identified incident (including by escalating the incident to the Company's senior management and the Board depending on the nature and scope).


text: We have implemented policies and processes to evaluate and manage cybersecurity risks, incorporating them into our broader risk management framework. We regularly examine cybersecurity threats that could compromise our information systems' security or data.

companyName: Revolve Group, Inc.

ticker: RVLV


text: Every quarter we evaluate our cybersecurity posture and reassess whether significant changes in our business could impact our digital infrastructure. These assessments aim to identify potential internal and external threats, estimate their probability and possible impact, and gauge the effectiveness of our current policies and processes in mitigating these threats.


text: Following these risk assessments, we evaluate whether and, if so, how to re-design, implement and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our chief architect, who reports to our co-chief executive officer, to manage the risk assessment and mitigation process.


text: We regularly check and improve our security measures and educate our employees about them with the help of our information technology team. Key personnel are made aware of our cybersecurity policies through trainings.


text: We engage third parties in connection with our risk assessment processes. We require all external service providers who may impact our cybersecurity risks to certify that they can set up and maintain proper security consistent with all applicable laws, manage security effectively for their work with us, and quickly inform us if they think their security has been breached.


text: We have never experienced a cybersecurity incident that was determined to be material, although, like many technology-dependent companies operating in the current environment, we have experienced cybersecurity incidents in the past.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition, please see the section titled "Risk Factors."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors monitors and assesses strategic risk exposure, and our executive officers manage the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole and through the audit committee.


text: We have established a cybersecurity committee, composed of members of senior management, to provide guidance, management and oversight of our cybersecurity and data responsibility initiatives and risk assessment and mitigation protocols, including those described in the "Risk Management and Strategy" section above. Our chief architect, who has over 15 years of experience in software engineering and has served as our chief architect for eight years, is a member of our cybersecurity committee and works to manage our cybersecurity policies and processes. Our chief architect and cybersecurity committee stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. This is done through regular checks of our systems, tests to identify security weaknesses and maintaining our incident response plan.


text: Our chief architect and the cybersecurity committee are responsible for our cybersecurity rules and methods, like those described in the "Risk Management and Strategy" section. They stay updated and track how we prevent, identify, lessen and address cybersecurity issues. This is done through regular checks of our systems, tests to find security weaknesses and having a plan ready to respond to any incidents. In addition to regular meetings and participation on the cybersecurity committee, the chief architect and co-chief executive officer regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update our board of directors or the audit committee about these changes as well as our cybersecurity risks, so that our board of directors can administer its oversight function as part of its broader oversight and risk management.


text: We rely on IT networks and systems to process, transmit and store electronic information and to manage or support our business. We have implemented information security processes designed to identify, assess and manage risks from cybersecurity threats to our systems and data.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: These processes are supported by a multidisciplinary team, including our legal department, management and third-party information security service providers, as described further below. We leverage internal and external resources to monitor and evaluate our threat environment, including the use of our third-party managed service provider, manual and automated tools, threat intelligence reporting and analysis services, security scans and testing and internal and external audits. In addition, as part of our ongoing cybersecurity efforts, we have implemented a process for mandatory cybersecurity awareness training for new employees during onboarding and at least annually thereafter. We also conduct ongoing phishing simulations in an effort to raise awareness and support our training efforts.


text: Our cybersecurity risk assessment process includes quarterly reviews of our cybersecurity controls, annual third-party penetration tests and annual internal assessments of our cybersecurity program as informed by the NIST Cybersecurity Framework. The results of our assessments are discussed with management and the audit committee of our board of directors. We have also established incident response processes for reporting to the audit committee for certain cybersecurity incidents, as appropriate.


text: We utilize certain third-party service providers to perform a variety of functions relating to the acquisition, development and management of our properties. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include a review of the cybersecurity practices of such provider, including through security questionnaires and applicable security certifications or reports, as appropriate.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Our board of directors is responsible for overseeing our strategy and risk management process and discharges its duties both as a full board and through its committees. As reflected in the audit committee charter, our board has delegated to the audit committee oversight of our risk assessment and management process, including processes related to cybersecurity. The audit committee meets at least annually with management, our internal auditor and our contracted Chief Technology Officer to discuss our cybersecurity program in regards to potential significant financial or operational risk exposures and the measures implemented to monitor and address those risks, including those that may result from cybersecurity threats. As necessary or appropriate, these discussions may include our risk assessment and risk management policies. In addition to our multidisciplinary management team, we rely on our internal audit function in collaboration with a third-party information security service provider to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. We have a longstanding relationship with our third-party information security service provider, which includes services from our contracted Chief Technology Officer. The contracted Chief Technology Officer has approximately 16 years of information technology experience, including nine years in the finance and real estate sectors, and our Head of Internal Audit, has approximately 31 years of audit experience, including 21 years in the real estate and financial services sectors.


text: Management is responsible for hiring personnel to support our cybersecurity strategy, as appropriate, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving technology budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: The Company has an enterprise-wide cybersecurity program that is informed by the U.S. Department of Commerce National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity program encompasses the following key capabilities: 24x7 security monitoring, next-generation network security, advanced email and endpoint security, a dedicated enterprise cybersecurity team, third-party managed security services, third-party security assessment services, incident response retainer services, and external risk monitoring services. The Company also maintains cybersecurity risk insurance coverage to defray the costs of potential information security breaches.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: The Company maintains an incident response plan. Our incident response plan coordinates the actions we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to address potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan is updated as appropriate in response to changes within our organization or in response to external factors that may impact us. We test our incident response plan by conducting tabletop exercises on an annual basis.


text: Our associates receive annual cybersecurity training, and we conduct mock phishing campaigns to better enable our associates to recognize phishing emails and other social engineering tactics. We have established reporting processes for our associates if they encounter suspicious activity that may give rise to a cybersecurity incident.


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer ("CIO") and are supported by the Senior Director of Enterprise Cybersecurity. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current interim CIO has over 30 years of experience in information technology matters. Our Senior Director of Enterprise Cybersecurity has over 30 years of expanding leadership experience in information technology and 18 years of experience in information security leading and developing security programs. Our CIO provides regular updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company's enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly updates on these risks.


text: The CIO typically provides the Audit Committee with cybersecurity updates on a quarterly basis. During such updates, the CIO generally covers topics such as data security positions, results from third-party assessments, our incident response plan, and any material cybersecurity threats and developments. In 2024, the CIO reported to the full Board of Directors on the Company's cybersecurity programs and risk mitigation efforts.


text: As part of the above processes, we engage with assessors, consultants, auditors and other third parties, including by (i) engaging third-party managed security services to assist with the operation of certain aspects of our cybersecurity program, (ii) engaging security assessment services to provide assessments on our cybersecurity program, (iii) engaging an incident response retainer service to provide timely cyber incident response support and digital forensics analysis services, (iv) engaging risk monitoring services to help identify emerging cybersecurity risks, and (v) engaging with other information technology and legal subject matter experts to review our cybersecurity program to help identify areas for continued focus, improvement, and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including risks to our customer, vendor, and employee data and our systems. We conduct due diligence of third parties' information security programs, and cybersecurity considerations may inform our selection of third-party service providers. In certain circumstances, including in those where we believe a third party could introduce cybersecurity risk to us, we generally seek to contractually require such third parties to manage their cybersecurity risks in certain proscribed manners. We also receive the results of cybersecurity and data privacy audits conducted on certain vendors to determine if those vendors meet our cybersecurity standards.


text: We describe the risks that cybersecurity threats, including as a result of any previous cybersecurity incidents, pose to us that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may experience delays or outages in our information technology systems and computer networks and the third-party information technology systems and computer networks that we use. We may be subject to breaches of our information technology systems, the third-party information technology systems that we use or other cybersecurity incidents, which could damage our reputation and consumer relationships. Failures in our information technology systems or in the third-party information technology systems that we use and the costs of increasing information security regulation could also subject us to significant financial, legal and operational consequences" included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, to our knowledge, we have not had any cybersecurity incidents in the past three years that have had a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As part of our risk management program, we reference various security industry frameworks and other guidance, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), HIPAA, Service Organization Control Type 2 (SOC 2 Type II), and Sarbanes-Oxley IT General Controls (SOX ITGC), to help us assess, identify and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, HIPAA, SOC 2 Type II, and SOX ITGC as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Ceribell, Inc.

ticker: CBLL


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments are performed and designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers or third party software, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel; • an incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party vendor risk management process for key service providers based on the security teams assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk factor titled, "Our business and operations may suffer in the event of information technology system failures, cyber attacks, or deficiencies in our cybersecurity." for additional information.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also periodically receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from our Executive Director Information Security as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including the Executive Director of Information Security and Chief Technology Officer (CTO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a cumulative 22 years of experience in assessing and managing risk throughout organizations. In addition, hold industry specific certifications such as Certified Information Systems Auditor (CISA) and Certified Data Privacy Solutions Engineer (CDPSE).


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence, other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: We design and assess our program based on established frameworks, such as the CIS Critical Security Controls ("CIS Controls"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team composed primarily of members of management, including our Director of IT Operations, that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to maintain, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training — including phishing and malware simulations — of all of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes relevant procedures for evaluating the materiality of identified cybersecurity incidents, and reporting and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats, or provide assurance that our operations, business strategy, results of operations, or financial condition will not be materially affected in the future by such risks or any future material cybersecurity incidents. For additional information about our cybersecurity related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from our management-led Enterprise Risk Management Committee on our cybersecurity risks and mitigation initiatives. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives briefings from senior management on our cyber risk management program.


text: Our information technology management team, along with our externally managed security operations center, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes background in cybersecurity and information technology operations, with a focus on cybersecurity, data privacy, information technology governance, and risk management. The team is proficient in conducting vulnerability assessments, analyzing security logs, and implementing necessary security controls, with knowledge in cloud technologies and computing, database management, DevOps, and quality engineering.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • people – security awareness education and readiness-testing throughout the year for employees; • process – incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • technology – investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts extensive ongoing reviews of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Our Director of IT Security is responsible for assessing, monitoring and managing risks from cybersecurity threats, overseeing our overall cybersecurity risk management program which includes prevention, mitigation, detection and remediation of cybersecurity incidents and supervises a team of cybersecurity personnel. Our Director of IT Security reports to our VP – Information Technology and is responsible for reporting material incidents to our Cybersecurity Risk Management Committee ("CRMC") that includes officers charged with reporting responsibilities. Cybersecurity incidents that meet a pre-determined minimum threshold are communicated upward to executive officers to determine overall materiality and disclosure obligations. Our Director of IT Security keeps the CRMC apprised of our processes to prevent, detect, mitigate and remediate cybersecurity incidents at least annually. Our internal cybersecurity team led by our Director of IT Security has over 75 years of combined experience in information security and maintains several cybersecurity certificates.


text: We conduct security assessments, manage user access, perform vulnerability scanning and patching, oversee monitoring and carry out annual penetration testing, in addition to other critical security functions. In conjunction with our internal team, we utilize an independent third-party operations center that is focused on, but not limited to, monitoring alerts, logs, behavior analytics, vulnerability notifications and remediation guidance. Critical infrastructure is continuously monitored to ensure accessibility and appropriate security posture. We also perform reviews and risk analysis for third-party software and platforms which sets a standardized security baseline. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors, allowing us to increase security of our technology assets and our data. In addition, we perform an annual cybersecurity risk assessment of critical third-party systems.


text: Our board of directors oversees our cybersecurity risk and receives, at a minimum, a quarterly cybersecurity report and a bi-annual update from IT leadership, which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and ongoing cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.


text: To date, there have been no risks from cybersecurity threats because of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity is the responsibility of our Chief Information Security Officer ("CISO") who oversees an information security team responsible for maintaining the confidentiality, integrity, and accessibility of data within CCC while continuously monitoring for and responding to cybersecurity threats, with oversight by our EVP, Chief Product and Technology Officer who is responsible for all of our IT systems. Our CISO has 18 years of experience managing risks from security threats and developing and implementing security policies and procedures, as well as relevant degrees and certifications, including a bachelor of science in information systems and cybersecurity and being a Certified Information Security Manager and a Certified Information Systems Security Professional. Our EVP, Chief Product and Technology Officer has over three decades of experience in the technology industry and holds a bachelor of science in computer science.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Our Board has tasked the Audit Committee with oversight of enterprise risk management, including cybersecurity risk management. Our CISO or EVP, Chief Product and Technology Officer briefs the Audit Committee on cybersecurity risks at each of the quarterly meetings of the Audit Committee. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. The Audit Committee and/or the EVP, Chief Product and Technology Officer also regularly briefs the entire Board on cybersecurity matters.


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework and contractual, industry and regulatory best practices and requirements.


text: Our written Cybersecurity Incident Response Program coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to prepare for, assess severity of, escalate information about, contain, eradicate, and recover from the incident, as well as to conduct post-incident activities, including reporting and conducting root cause analysis and remediation activities. Our incident response policies and the cybersecurity posture are subject to annual testing to evaluate our adherence to policies and compliance requirements. Policies and practices are reviewed periodically to improve processes and practice. We carry cybersecurity insurance to provide a level of financial protection should a covered incident occur.


text: Our cybersecurity and privacy program includes mandatory annual training for all employees and contractors reinforced by targeted phishing tests. The annual training includes training on how to identify potential cybersecurity and privacy risks and protect our resources and information. Additionally, we provide additional specialized security training for employees in roles relating to product development or information technology.


text: While we believe our cybersecurity and privacy program to be appropriately designed in light of the risks we have identified, we have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations or financial condition. See "Risk Factors—Our solutions or our third-party cloud providers have experienced in the past, and could experience in the future, data security breaches, which could adversely impact our reputation, business, and ongoing operations."


text: We operate in the transportation and logistics sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. We have implemented a risk-based approach aligned with industry standards to identify and assess the cybersecurity threats that could affect our business and information systems. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive Incident Response Protocol that is tested on a regular cadence and an information security training and awareness program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hub Group, Inc.

ticker: HUBG


text: Our business depends on the availability, reliability, and security of our information systems, networks, data and intellectual property. Any disruption, compromise or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships or loss of market share. In the last three years prior to filing of this Form 10-K, we have not experienced any significant information security breach.


text: Our Board of Directors (the "Board") has direct oversight of cybersecurity risks and strategy and receives quarterly updates from our Chief Information Officer (CIO). The Board has also delegated to our Audit Committee responsibilities related to cybersecurity and other risks of our Company. Our CIO has spent over 20 years in engineering and product development roles and our VP of Information Security and Operations has spent over 25 years in infrastructure and cybersecurity roles including in the finance and insurance industries. Additionally, one of the independent directors on our Board and a member of our Audit Committee has significant experience leading technology and information systems at some of the country's leading healthcare organizations and adds to our Board substantial expertise and knowledge in information technology, privacy, data governance and cybersecurity. A cross-functional incident response team, which includes members of our management team, determines the apparent severity of reported potential incidents and operationalizes the cybersecurity incident response protocol.


text: To reduce the likelihood and severity of cybersecurity incidents, we established a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our technology systems and business operations more broadly. For a discussion of the risks associated with cybersecurity threats, see Item 1A. Risk Factors.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • Ongoing Assessment—The Cybersecurity department, led by the VP, Chief Information Security Officer (CISO), and reporting to the SVP, Chief Information and Digital Officer (CIDO) is staffed with cyber professionals tasked with the day-to-day responsibility of assessing material risks from cybersecurity threats. In addition, the Cybersecurity Council, comprised of senior management, is kept apprised of the state of PSEG's cybersecurity program, including any emerging risks, and provides guidance on the strategic directions of the program. • Engagement of Nth Parties—We engage Nth parties (third parties and other business relationships, including fourth parties, etc.), such as cybersecurity service providers, risk management firms, and external legal counsel, to assess material risks from cybersecurity threats and assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including but not limited to the NRC and Transportation Security Administration (TSA), as well as NERC, inspect applicable components of our cybersecurity program. • Nth-Party Service Provider Management— We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers. This includes a risk-based vendor management program, which incorporates robust cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits. • Technical Safeguards—We manage controls to protect our network perimeter, internal IT and Operational Technology (OT) environments, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, endpoint security and access controls. • Training and Awareness—We provide mandatory annual cybersecurity training for all personnel with network access, and additional education for personnel with access to industrial control systems and/or customer information systems; and conduct phishing exercises with progressive consequences for failures. Employees also receive periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, are invited to presentations throughout October from internal and external cyber experts covering diverse cyber topics. These efforts better enable all employees to identify potential cybersecurity risks and escalate them appropriately. • Incident Response Plans—We maintain and periodically update a cyber incident response plan that addresses the life cycle of a cybersecurity incident from a technical perspective (i.e., detection, response, and recovery), and a data breach response plan (with a focus on external communication/disclosure and legal compliance); and conduct regular tabletop exercises to test plan effectiveness (both internally and through external exercises). • Mobile Security—We maintain controls to prevent loss of data through mobile device channels.


text: • Physical Security—We also maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (such as fencing, walls, and bollards). Additional features of PSEG's physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG's critical facilities.


text: These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO's other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents, including as a result of prior cybersecurity incidents.


text: – PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.


text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC, and Audit Committee are informed of cybersecurity risks through frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate. – Management's Role in Assessing and Managing Material Cybersecurity Risks:


text: The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below.


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of material risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report to the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity team. The CISO served in this role since July 2024. Our CISO has over 20 years of experience in cybersecurity and served as a VP, CISO in the manufacturing/chemicals sector prior to joining PSEG. Our CISO also started her career at the Department of Defense and led cyber teams in the financial and retail sectors. Our CISO holds an MBA in strategy, an MSE in Computer Science, a BS in Computer Science, and multiple cybersecurity certifications, including Certified Information Systems Security Professional.


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and regularly meets with the IOC, without other members of management present, during executive sessions. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity team, who are tasked with these responsibilities on a day-to-day basis.


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity team, other IT domain experts, cybersecurity managing counsel and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Corporate Secretary and Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council. In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks through updates shared during Cybersecurity Council meetings and through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency and we, along with other utility companies, are the target of these frequent attacks. In addition, there is a growing reliance on third party providers which are also subject to attacks and breaches. Any unexpected failure, or unauthorized access to technology systems or third parties relied upon can result in the unavailability of systems or services, which can result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: We consider the management of cybersecurity risk in our overall enterprise risk management program. See "Item 7. Management's Discussion and Analysis - Enterprise Risk Management" for further discussion of the program.


text: We mitigate cyber risk by maintaining an enterprise security program based on the National Institute of Standards and Technology Cyber Security Framework. This program includes trainings and exercises at all levels of the Company. Our security program incorporates enterprise business continuity which facilitates a business impact analysis of core functions for development of emergency operating and disaster recovery plans and coordinates annual testing and training exercises. In addition, there are independent third party and regulatory audits of our security program.


text: The technology department, led by the Vice President, Chief Information Officer, and Chief Security Officer, is responsible for our cybersecurity program. The Vice President, Chief Information Officer and Chief Security Officer has over 20 years of experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.


text: Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. A subset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.


text: The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.


text: Flywire recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our and our client's data.

companyName: Flywire Corp

ticker: FLYW


text: Risk Management and Strategy Managing Material Risks and Integrated Overall Risk Management Flywire has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our security and risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Flywire engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments and consultation on security enhancements.


text: Oversee Third-party Risk Flywire implements stringent processes to oversee and manage the risks associated with third-party service providers. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments by our Chief Information Security Officer (CISO) and on an ongoing basis by our security and risk management team and our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Our Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology and finance, which we believe equips them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The CISO, General Counsel & Chief Compliance Officer (GC & CCO), Chief Operating Officer (COO) and the Chief Executive Officer (CEO) play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Risk mitigation efforts and insurance; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CISO, GC & CCO, COO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Flywire. Our Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity, the CISO brings a wealth of expertise to her role. Her background includes extensive experience as an enterprise CISO and she is well-recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and is subject to periodic testing for effectiveness of response and remediation.


text: Reporting to Management and Board of Directors Our CISO, in her capacity, regularly informs our Chief Financial Officer (CFO), GC & CCO, COO and CEO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Flywire. Furthermore, our CISO reports to the Board of Directors at a minimum twice a year, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity matters, and strategic risk management decisions.


text: Like many large, global companies, CommScope relies heavily on digital technology to conduct operations and engage with our customers and business partners. As our engagements become more complex and interdependent, threats from security incidents like ransomware and data breaches increase. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our data and the data customers and other stakeholders entrust to us a top priority. Our Board of Directors (Board), through our Audit Committee, and our management team are actively involved in the oversight of our Enterprise Risk Management (ERM) program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. We have made investments in resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe that risks from prior cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that any such incidents will not materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding the risks associated with cybersecurity incidents, see Item 1A. "Risk Factors."

companyName: Vistance Networks, Inc.

ticker: VISN


text: CommScope's commitment to cybersecurity begins in the boardroom. The Audit Committee is responsible for oversight of cybersecurity and is actively engaged with our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) at least quarterly, in addition to ad-hoc discussions and our periodic cyber crisis management tabletop exercises. Our CIO and CISO also present on cybersecurity to our full Board at least annually. The commitment extends through our executive leadership team (ELT), who engage continually to review our cybersecurity strategy, planning and execution.


text: At CommScope, cybersecurity risk is part of our cross-functional Enterprise Risk Management (ERM) program because of the potential for negative impacts of an incident across our business. At least annually we conduct a cybersecurity risk assessment, bringing together threat intelligence, internal assessment of our control posture and third-party opinions. The risk assessment informs our Board and management team and drives the next year's security strategy and initiatives.