text: Cybersecurity is considered a critical risk area at DXC and is integrated into the Company's overall ERM program, which includes maintaining the ERM framework, evaluating risk appetite, and monitoring evolving risks and the effectiveness of mitigations. Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating/Corporate Governance Committee oversight of cybersecurity and other information security risks. The Nominating/Corporate Governance Committee oversees management's efforts to identify, assess, mitigate, and remediate material information security risks. Similarly, the Audit Committee oversees our disclosure controls and procedures, which include cybersecurity reporting disclosure controls.


text: The Nominating/Corporate Governance Committee receives reports from the Global Chief Information Security Officer ("Global CISO") on the Company's information security program at each regular quarterly Committee meeting. In addition, management updates the Nominating/Corporate Governance Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The Nominating/Corporate Governance Committee chair then provides an overview of the information security reports to the full Board at each regular quarterly Board meeting. In fiscal 2024, the full Board also received a briefing from management on our enterprise risk management program.

companyName: DXC Technology Co

ticker: DXC

secItem: Item 1C


text: Our management team, including our Global CISO, Chief Operating Officer ("COO"), Chief Information Officer ("CIO"), General Manager of Cloud Infrastructure and ITO, and General Counsel, comprise our Security Steering Committee ("SCC") and are responsible for assessing and managing our material risks from cybersecurity threats. Our Global CISO and our General Manager of Cloud Infrastructure and ITO have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global CISO has extensive experience assessing and managing cybersecurity-related risks and implementing related policies, procedures, and strategies. Our Global CISO has served in leadership roles related to information security for over 28 years, including serving as a Deputy CISO at another company since 2005, then as its CISO since 2017 and as DXC's Global CISO since May 2019. Similarly, our General Manager of Cloud Infrastructure and ITO is a well-known industry leader with more than 20 years of experience in the technology industry and has been with DXC since 2020.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. The SCC also analyzes emerging global cyber security risks and uses the expertise of its members to review DXC's current security posture and consider steps to take to mitigate such risks and implement improvements where it deems necessary.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") program, and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments and penetration testing designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers such as forensic analysts, third party security reviewers, and other consultants such as outside counsel, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We could be held liable for damages, our reputation could suffer, and our business may be materially impacted due to service interruptions from security breaches, cyber-attacks, other cybersecurity events or incidents or disclosure of confidential information or personal data."


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: The Nominating/Corporate Governance Committee receives reports from the Global Chief Information Security Officer ("Global CISO") on the Company's information security program at each regular quarterly Committee meeting. In addition, management updates the Nominating/Corporate Governance Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The Nominating/Corporate Governance Committee chair then provides an overview of the information security reports to the full Board at each regular quarterly Board meeting.


text: Our management team, including our Global CISO, Chief Information Officer, Managing Director of Global Infrastructure Services, and General Counsel, along with other key business and functional leaders, constitute our Security Steering Committee ("SCC") which is responsible for assessing and managing our material risks from cybersecurity threats. Our Global CISO and our Managing Director of Global Infrastructure Services have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Global CISO has extensive experience assessing and managing cybersecurity-related risks and implementing related policies, procedures, and strategies. Our Global CISO has served in leadership roles related to information security for over 23 years, including serving as a CISO at another company since 2015, then as DXC's IT CISO since May 2022 and as DXC's Global CISO since August 2024. Our Global CISO reports to our Managing Director of Global Infrastructure Services who is a well-known industry leader with more than 20 years of experience in the technology industry and has been with DXC since 2020.


text: The Audit Committee oversees the cybersecurity program and receives reports from management regarding the Company's cybersecurity policies and procedures on an annual basis. The Audit Committee also receives reports from management on any cybersecurity incidents that may occur.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: As part of our cybersecurity program, our IT management reports to the Company's Chief Operating Officer and Chief Executive Officer and is responsible for assessing and managing cybersecurity risks and developing and implementing our cybersecurity program. Our current Head of Global IT has more than 15 years of experience in technology and process improvements, which includes the execution of digital business strategies within highly regulated industries. Our IT management has obtained relevant experience in various sectors such as technology firms, financial institutions, and consulting firms and have actively engaged in continuous learning and professional development initiatives to stay updated on evolving cybersecurity threats and trends. This includes participating in industry conferences, workshops, training programs, and becoming members of professional cybersecurity organizations.


text: Our cybersecurity program is designed to identify, assess, and mitigate risks from cybersecurity threats, and includes the following elements: • a risk assessment process to identify and assess cybersecurity risks; • a risk mitigation strategy to address cybersecurity risks; • an incident response plan to identify, respond to, mitigate and remediate cybersecurity incidents; • an awareness and training program to educate employees about cybersecurity risks; • a procedure to procure information technology services, including cloud computing and data storage, from third-party providers with sufficient cybersecurity provisions, and to monitor their cybersecurity process on an ongoing basis; and • periodic testing and evaluation by external parties we engage to assess the effectiveness of the cybersecurity intrusion protections and make recommendations to improve the security of our information systems.


text: As a result, we have implemented a multi-layered cybersecurity program that includes measures to protect our information systems, including firewalls, network access controls, intrusion detection systems, phishing campaigns, security awareness training and monitoring, network operation center, security operation center, and data encryption, and to monitor our information systems to detect potential cybersecurity incidents, including through the use of automated detection software. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.


text: Our company has implemented robust processes to assess, identify, and manage material cybersecurity risks effectively. These processes are an integral component of our overall risk management system, ensuring that cybersecurity concerns are comprehensively addressed within our broader risk management framework. Risk assessment, identification, and management processes are seamlessly integrated into our overall risk management system. The processes for assessing, identifying, and managing cybersecurity risks are aligned with our strategic objectives and business goals. We foster cross-functional collaboration and communication to facilitate the integration of cybersecurity risk management into various business functions and processes.


text: We also review our cybersecurity practices, their effectiveness, and the cybersecurity practices of the third-parties we rely on, on an ongoing basis and make changes as necessary to address new risks. However, we cannot guarantee that our efforts will be successful in preventing all cybersecurity incidents.


text: We are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. We are subject to a variety of cybersecurity risks, which could have a material adverse effect on our business, financial condition, and results of operations. See the "Risks Related to Intellectual Property and Data Security" section of Item 1A. Risk Factors for additional discussion on risks affecting our information systems.


text: As a result, we have implemented a multi-layered cybersecurity program that includes administrative, physical, and technical measures to protect our information systems. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.


text: As part of our overall risk management process, we have established a cybersecurity risk management program for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the Federal Information Processing Standards Publication ("FIPS").

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: Our cybersecurity risk management program includes a control framework and operations that utilizes tools and processes designed to prevent, detect, and analyze current and emerging cybersecurity threats, and we maintain plans and strategies to address any cybersecurity threats and incidents. These tools and processes include, but are not limited to, periodic cybersecurity risk assessments and vulnerability analyses, as well as monitoring for critical risks from cybersecurity threats using automated tools. Personnel at all levels and departments are made aware of our cybersecurity policies through participation in cybersecurity risk awareness trainings during onboarding and on an annual basis thereafter.


text: As necessary and appropriate, we engage consultants, or other third parties, in connection with our cybersecurity risk assessment processes. These service providers assist us in designing and implementing cybersecurity procedures, as well as in monitoring and testing the effectiveness of our cybersecurity safeguards. For example, we engage these vendors to conduct annual risk assessments, including internal and external penetration testing, to identify cybersecurity threats, as well as to perform cybersecurity risk assessments in the event of substantial changes to our business practices that may affect our information systems. These cybersecurity risk assessments are designed to include identification of reasonably foreseeable internal and external cybersecurity risks, analysis on the likelihood and potential damage that could result from such risks, and feedback on the sufficiency of our existing procedures, systems, and safeguards to mitigate such cybersecurity risks.


text: As part of our cybersecurity risk management program, we maintain processes related to third-party vendor cybersecurity risk management. As appropriate, we contractually require certain third-parties to certify that they have the ability to implement and maintain appropriate cybersecurity measures, consistent with applicable laws, and to promptly report any suspected cybersecurity incidents that may affect our company or our data.


text: We face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has delegated this cybersecurity risk management oversight function to our audit committee. Under the purview of our audit committee, our President and Chief Operating Officer, General Counsel, and Chief Financial Officer ("CFO") collectively, the "Risk Management Committee") are primarily responsible for assessing, managing and mitigating our critical risks from cybersecurity threats. Our Head of Information Technology ("IT"), who reports directly to our CFO, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Head of IT possesses approximately 19 years of experience with information technology and cybersecurity risk management programs. Our Head of IT's responsibilities, with support from our internal IT team and external IT consultants, include assessing, monitoring, and managing our cybersecurity risks.


text: Our Head of IT periodically reports to our CFO on matters relating to our overall cybersecurity risk management program and, in the event of a cybersecurity incident, reports directly to our entire Risk Management Committee. The CFO reports on the cybersecurity risk management program to the other members of our Risk Management Committee and, alongside our General Counsel, provides quarterly cybersecurity risk management briefings to the audit committee, including discussion of cybersecurity risks, that include any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and other matters relevant to our overall cybersecurity risk management. Our audit committee provides quarterly updates, as appropriate, on the cybersecurity risk management program, to our full board of directors.


text: As part of our overall risk management process, we have established a cybersecurity risk management program for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the Federal Information Processing Standards ("FIPS") Publication.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has delegated this cybersecurity risk management oversight function to our audit committee. Under the purview of our audit committee, our President and Chief Operating Officer, General Counsel, and Chief Financial Officer ("CFO") (collectively, the "Risk and Compliance Committee ") are primarily responsible for assessing, managing and mitigating our critical risks from cybersecurity threats. Our Head of Information Technology ("IT"), who reports directly to our CFO, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Head of IT possesses approximately 20 years of experience with information technology and cybersecurity risk management programs. Our Head of IT's responsibilities, with support from our internal IT team and external IT consultants, include assessing, monitoring, and managing our cybersecurity risks.


text: Our Head of IT periodically reports to our CFO on matters relating to our overall cybersecurity risk management program and, in the event of a cybersecurity incident, reports directly to our entire Risk and Compliance Committee. The CFO reports on the cybersecurity risk management program to the other members of our Risk and Compliance Committee and, alongside our General Counsel, provides quarterly cybersecurity risk management briefings to the audit committee, including discussion of cybersecurity risks, that include any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and other matters relevant to our overall cybersecurity risk management. Our audit committee provides quarterly updates, as appropriate, on the cybersecurity risk management program, to our full board of directors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk-management program includes a cybersecurity incident response plan.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, also integrating security best practices typically used to support the Health Insurance Portability and Accountability Act, or HIPAA, and General Data Protection Regulation, or GDPR, implementations. We use the NIST CSF and such security best practices as a guide to help us monitor, identify, assess and manage cybersecurity risks relevant to our business; however, this does not imply that we meet any particular technical standards, specifications or compliance requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise-IT environment; • adoption of various cybersecurity software, including but not limited to cloud-based malware, ransomware and antivirus software, phishing monitoring and artificial intelligence-based anomaly detection; • a security team principally responsible for managing (1) our cybersecurity risk-assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • security audits and a third-party risk assessment process for key service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Data Privacy and Cybersecurity—Cyberattacks or other failures in our telecommunications or information technology, or IT, systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks as well as management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: We have an internal cybersecurity team, led by our Chief Financial Officer, who is responsible for (i) managing our overall cybersecurity risk-management program; (ii) assessing and managing our risks from cybersecurity threats; and (iii) overseeing retained cybersecurity consultants and providers for additional external expertise. This internal team's experience includes over 30 years in cybersecurity implementation, testing and management.


text: We have an Executive Compliance Committee consisting of executive officers and members from senior management across the regulatory, quality, legal, finance and people operations functions that supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which includes updates from our internal cybersecurity team, as relevant; review of any threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our customers, business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all personnel at our company play a part in managing cybersecurity risks, as discussed in more detail under "—Governance" below, our board of directors, through delegation to the audit committee of the board of directors, or the audit committee, and our senior management team are involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our information security program is aligned to our overall enterprise risk management program and utilizes an overarching framework to address enterprise information security governance, which seeks to protect information assets and systems against attacks and incidents while establishing appropriate security as a priority throughout the product development process. It is a risk-based program that aligns with industry-standard frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework and use of a Cyber Security Incident Response Team, to incorporate security principles applicable to our regulatory and contractual obligations. This program is managed by a dedicated Chief Information Security Officer, or the CISO, who reports to the Chief Executive Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: Alteryx, Inc.


text: Our CISO has over fifteen years of experience in information security, serving in roles of increasing responsibility within public and private companies. As part of our information security program, we have an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Cyber Security Incident Response Policy. Each of these teams are managed by experienced and credentialed professionals with knowledge in their fields and the teams comprise a security operations center to detect, analyze, and escalate cybersecurity events, a cybersecurity incident response team to own containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post incident activities. These teams inform our CISO of all material events and key developments and coordinate with other teams, such as the Information Technology, Legal and Privacy teams, as appropriate for analysis and compliance with legal and contractual obligations. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and utilize third-party software to provide continuous monitoring and scanning of critical third-party infrastructure and to monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: We have in the past experienced, and may in the future experience, adverse impacts to our business strategy, operating results, and/or financial condition as a result of cybersecurity incidents. However, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business or our financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses under consumer protection laws or other laws or common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."


text: The audit committee is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. The CISO provides reports at least quarterly to the audit committee as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the audit committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our audit committee also receives prompt and timely information regarding cybersecurity threats or incidents that may be material in nature, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed. To mitigate the impact of any cybersecurity incidents, we maintain appropriate errors and omissions insurance that provides coverage for such incidents.


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and supported by our business continuity teams.


text: We conduct periodic internal and external vulnerability audits and assessments and penetration testing and provide periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. We also participate in industry-specific cybersecurity roundtables and professional groups to ensure we remain abreast of industry-wide cybersecurity developments and best practices and thereby enhance our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for our business, we conduct various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with our conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with our business requirements and risk tolerances.


text: We maintain an incident reporting and escalation process in the event of any observed, detected, or suspected events that we believe may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Our processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Our incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. We determine the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on our business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by our cybersecurity team as well as other members of management and employees with specialized technology or financial knowledge, including our CISO, CIO, and CFO, as applicable. In the event of a material breach, we have a process for escalation to appropriate members of our senior management, and, where appropriate, to our Board and Audit Committee. These groups also collaborate in determining the appropriate response to such events and disclosure of any material breach.


text: We engage third parties from time to time that assist us in the identification, assessment, and management of cybersecurity risks. We also engage cybersecurity specialists to complete assessments of our cybersecurity processes, program and practices, including our data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs our overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from dual-primary data centers in the cloud, with one located in the East US region and the other in the West US region. Either site alone is capable of running all of our essential systems. In addition, we maintain technology operations from regions in East Asia, West US and South Central US regions. Replicated instances of this technology are maintained in our East US region. All regions are built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards. Failover for the majority of our systems is automated.


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 25 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities; our CIO, whose experience includes managing the technology professionals and processes at public commercial real estate advisors, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Risks Related to Our Business—Risks Related to Our IT Systems and Cybersecurity" in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: We consider cybersecurity protection, including protection of sensitive customer, employee, and partner information, to be a priority in the Company's business, strategy, and management. Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.

companyName: CARVANA CO.

ticker: CVNA


text: The Audit Committee is responsible for ensuring sufficient oversight of our cybersecurity risk exposures and leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics. Senior leaders from our Information Security, Legal and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and experience, with over ten years in the field of information security, is primarily responsible for assessing and managing cybersecurity risk. The CISO oversees a team of dedicated information security professionals (the "Information Security Team") who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.


text: The Information Security Team leverages a variety of processes and controls to stay informed of and manage cybersecurity risk. It partners with a variety of business units, including our engineering, legal, compliance, internal audit, technology, and product teams to identify and control emerging risks. We also from time to time engage third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes. The Information Security Team additionally has adopted security control principles based on ISO 27002:2022 and uses various formalized incident management and monitoring standards and incident response plans and playbooks, which define immediate steps in the event of a cybersecurity incident, roles and responsibilities, as well as materiality criteria to allow for efficient and effective incident management. This includes a third-party vendor management procedure, under which we conduct vendor risk assessments and, when appropriate, ongoing threat monitoring. In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.


text: As of the date hereof, we have not experienced any material cybersecurity incidents. However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition. The Company maintains cybersecurity insurance to mitigate the risks of a material cybersecurity incident; however, the costs may exceed our coverage and, therefore, may not be fully insured. See Part I, Item 1A - "Risk Factors" in this Annual Report on Form 10-K for a further discussion of various cybersecurity risks to the Company.


text: We consider cybersecurity protection, including protection of customer, employee, and partner information, to be a priority in the Company's business, strategy, and management. Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.


text: While management is responsible for the day-to-day handling of our risk management program, the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to the Audit Committee, which is responsible for ensuring sufficient oversight of our cybersecurity risk exposures. The Audit Committee leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics. Senior leaders from our Information Security, Legal, Privacy, and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.


text: O ur Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and experience, with over 15 years in the field of information security, including over seven years of experience leading information security departments within financial services and technology organizations as a cybersecurity executive, is primarily responsible for assessing and managing cybersecurity risk. The CISO oversees a team of dedicated information security professionals (the "Information Security Team") who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.


text: The Information Security Team leverages a variety of processes and controls to stay informed of and manage cybersecurity risk. It partners with a variety of business units, including our engineering, legal, privacy, compliance, internal audit, technology, and product teams to identify and control emerging risks. The Information Security and privacy teams also from time to time engage consultants and other third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes. The Information Security Team additionally has adopted security control principles based on ISO 27002:2022 and partners with counterparts in our legal department to use various formalized incident management and monitoring standards and incident response plans and playbooks, which define immediate steps in the event of a cybersecurity incident, roles and responsibilities, as well as materiality criteria to allow for efficient and effective incident management. This includes a third-party vendor management procedure, under which we conduct vendor risk assessments and, when appropriate, ongoing threat monitoring. In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.


text: As of the date hereof, we have not experienced any material cybersecurity incidents. However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to mitigate the risks of a material cybersecurity incident; however, the costs may exceed our coverage and, therefore, may not be fully insured. See Part I, Item 1A - "Risk Factors" in this Annual Report on Form 10-K for a further discussion of various cybersecurity risks to the Company.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. We have in place and continuously monitor and improve cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We continue to make investments in people, processes and technology to enhance our cybersecurity risk assessment, identification and management capabilities and to strengthen our cybersecurity risk response posture. Additionally, as part of the Company's Information Technology controls framework, management has established a suite of preventative and detective controls which enhance and strengthen the Company's cybersecurity program.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: We rely on information systems and networks as well as various other technologies to conduct and support our business. We have implemented security protocols, controls, and systems with the intent of maintaining the physical and electronic security of our operations and protecting our and our counterparties' confidential information and information related to identifiable individuals against unauthorized access. Some of these systems and networks are managed, hosted, and provided by third parties, and as a result, are also sources of cybersecurity risk. Third party cybersecurity incidents could affect a provider's ability to deliver a product or service to the Company or result in lost or compromised information of the Company or its customers. We have implemented measures intended to secure our information systems and networks and prevent unauthorized access to or loss of sensitive data. Where third parties house financially significant or sensitive data, the Company obtains and reviews attest reports covering cyber-related controls at these third parties, designs and implements complementary user entity controls, maintains open lines of communication for cyber incident notifications, and has contractual safeguards in place in the event a cyber incident occurs.


text: We evaluate cybersecurity risk independently, and we have integrated cybersecurity risk into the Company's overall Enterprise Risk Management ("ERM") process. The IT function is responsible for cybersecurity risk and reports to our Chief Administrative Officer. The Chief Financial Officer and the Director of Treasury and Risk Management are responsible for our ERM process, which is performed annually and updated throughout the year and involves a cross-functional group of management, including our Director of IT who has over 20 years of information technology experience. Pursuant to our ERM process, cybersecurity risk is evaluated based on likelihood, severity, speed of onset and persistence (the duration of time during which the organization could be impacted). The Company also leverages third parties, where needed, in connection with cybersecurity risk management, strategy and incident response.


text: In the event that management identifies significant risk exposures with respect to cybersecurity, it will present such exposure to our Audit Committee. Our Cyber Security Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. This would include notifying the appropriate individuals, investigating the incident, evaluating materiality, and responding to the incident. We have in the past and may continue to retain outside legal counsel, where necessary, to guide incident response efforts and perform a confidential and privileged review of the facts and circumstances surrounding suspected or confirmed cybersecurity incidents. If an incident were to occur, the Company may engage other service providers, where needed, to assist with the collection of forensic artifacts and perform additional procedures necessary to resolve and report any material cybersecurity incidents. Although we have cyber insurance and believe that our cybersecurity processes and controls are adequate, cybersecurity risk has increased due to remote access and increased sophistication of cybersecurity adversaries, as well as the increased frequency of malware attacks. As such, technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers.


text: We have been and may be subject to security breaches, which have resulted in and could result in unauthorized access to our facilities or the information that we are trying to protect. When these incidents occur, we have taken appropriate remediation steps and, through investigation, determined that the events or incidents did not have a material effect on our business, results of operations, or financial results. Although we are not aware of any material cybersecurity incidents, because of the past cybersecurity threats and what we have learned in responding to those threats, we have enhanced our cybersecurity protection efforts.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Terrorist attacks and cyber-attacks or other security breaches may negatively affect our business, financial condition and results of operations and cash flows" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Though management is responsible for the day-to-day management of risks the Company faces, including cybersecurity risks, the Board, as a whole and through its committees, has the ultimate responsibility for oversight of the Company's risks and risk management strategy. The company performs assessments to evaluate its cybersecurity risk as it relates to the organization and assets.


text: The Board has delegated to certain committee's oversight responsibility for risks that are directly related to each such committee's area of focus. The Audit Committee oversees our major financial risk exposures, including cybersecurity. The Audit Committee receives periodic reports from management regarding cybersecurity and management's assessment of current and future cybersecurity risks. The ERM process, which includes cybersecurity, is performed annually and updates are discussed quarterly, both internally and with the Audit Committee. The Audit Committee communicates the results of the annual process and quarterly updates to the full Board. The Board and committees thereof, including the Audit Committee, regularly receive reports from the Company's management and the Company's outside counsel, as appropriate, regarding the risks faced by, or anticipated to be faced by, the Company, including risks from cybersecurity threats. When such reports relating to cybersecurity are delivered to the Audit Committee, the Audit Committee's review of such reports, and discussions with management, informs the Audit Committee in detail of the material risks facing the Company related to cybersecurity.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. Our enhanced approach is grounded in industry-leading practices, including the National Institute of Standards and Technology Cybersecurity Framework version 2.0, and is designed to actively manage cyber risks while embedding cybersecurity into our Company's workplace culture. We have in place and continuously monitor and improve cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We continue to make investments in people, processes and technology to enhance our cybersecurity risk assessment, identification and management capabilities and to strengthen our cybersecurity risk response posture. Additionally, as part of the Company's Information Technology controls framework, management has established a suite of preventative and detective controls which enhance and strengthen the Company's cybersecurity program.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan, employee training, testing and assessments and a third party risk management process.

companyName: Lemonade, Inc.

ticker: LMND


text: Our program is informed by best practice approaches relevant to the technologies we use, the environments in which our services are designed and deployed, our business needs, and relevant regulatory requirements. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the various standards and frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common approaches, reporting channels, and governance processes that apply the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Security tools deployed in the IT environment for protection against and monitoring of suspicious events; • Security awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors who access our data and/or systems.


text: We have not identified known cybersecurity threats to date that could have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, disruptive attacks from financially motivated bad actors, and third party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Relating to Our Business."


text: Our Board considers cybersecurity risk as a critical part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management.


text: The Audit Committee periodically receives reports on our cybersecurity risks from our Chief Information Security Officer ("CISO") or his designee at least twice annually. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents or incidents with lesser impact potential.


text: The Audit Committee regularly reports its activities, including those related to cybersecurity, to the full Board. The full Board also receives briefings from management on our cyber risk management. As part of the Board's continuing education on topics that impact public companies, Board members receive presentations on cybersecurity topics from our CISO or his designee.


text: The management team delegates responsibility for assessing and managing our cybersecurity risks to the CISO. The CISO has primary responsibility for our overall cybersecurity risk management and supervises both our internal cybersecurity personnel and any external cybersecurity consultants. The CISO has over two decades of security work that includes work for large global enterprises, managing global security teams, and establishing and running security programs for both conventional and high-tech companies, including publicly traded and regulated companies. The CISO reports to an internal security team periodically regarding current security posture, risk, and trending security incidents and threats relevant to the Company. The security team comprises key management personnel, department heads, and business unit leaders.


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes managing a security team and security tools, and as appropriate may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The management team delegates responsibility for assessing and managing our cybersecurity risks to the CISO. The CISO has primary responsibility for our overall cybersecurity risk management and supervises both our internal cybersecurity personnel and any external cybersecurity consultants. The CISO has over two decades of security work that includes work for large global enterprises, managing global security teams, and establishing and running security programs for both conventional and high-tech companies, including publicly traded and regulated companies. The CISO reports to an internal security committee periodically regarding current security posture, risk, and trending security incidents and threats relevant to the Company. The security committee comprises key management personnel, department heads, and business unit leaders.


text: As a large, multinational transportation and logistics company, we face a range of risks from cybersecurity threats in connection with our operations due to our inherent dependence on interconnected advanced information systems, software, and digital technologies to operate safely, efficiently, and effectively. Such risks include, but are not limited to, those related to cyberattacks, network breaches, ransomware, malware or denial-of-service attacks, phishing and other scams, theft, and unauthorized disclosure, any of which, if successful, could result in the disclosure of confidential customer or commercial data, loss of valuable intellectual property, or systems disruption, and subject us to civil liability, fines, penalties, damage of our brand or reputation, or otherwise harm our business, any of which, could be material. We are exposed to such risks both through direct attacks on our own information systems and, indirectly, as a result of our engagement of third-party service providers, software vendors, and independent contractors, such as cloud computing providers. Certain of our third-party service providers or software vendors provide us with computing services which, in certain cases, involve hosting our data or processes on third-party servers, which exposes us to the risk that our data may be compromised or our operations disrupted if such third-party servers are compromised. Other third-party service providers provide us with contracted labor to whom we necessarily grant access to certain of our information systems, which indirectly exposes us to additional risks of network breaches and cybersecurity threats. In addition, because the trucking industry has been designated by the federal government as part of the critical U.S. infrastructure, as a leading provider of truckload, intermodal, and logistics services, we face increased risks from cybersecurity threats, cybercriminals, and bad actors, both foreign and domestic.

companyName: Schneider National, Inc.

ticker: SNDR


text: Cyber risk management has become a vital part of our broader ERM efforts. To manage and mitigate cyber risks, we have a dedicated information security team that has been charged with monitoring and managing cyber threats to our information systems, and the data that is stored on those systems, using our cyber risk management methodology. Our information security team is led by our SDIS and overseen by our CITO. Our cybersecurity risk management framework encompasses, among other things, ongoing systematic processes to identify, analyze, prioritize, manage, and monitor potential cyber risks to the information systems that we own or use and the cybersecurity threats to which we are exposed as a result of our reliance on third-party service providers and third-party software. Our cyber risk management methodology is comprised of the following core tasks: • Risk identification. Our internal information security team works with a MSSP and other external security partners to identify existing and new threats to our information systems. Our information security team, working in partnership with our MSSP, monitors our information systems to identify malicious and anomalous activity, uncover potential cybersecurity threats, and assess risks to information systems. • Risk analysis. Our information security team, working in partnership with relevant cybersecurity and technology experts, analyzes identified threats to determine the likelihood of the actualization of a threat and the potential business impacts, including evaluating the potential for data loss, data corruption, disruption to business operations, and financial impact. • Risk evaluation. Identified risks are evaluated to determine whether gaps in our controls or risk mitigation strategies exist that could result in material risk to the Company. If it is determined that our existing processes, strategies, or technology may be insufficient to effectively mitigate or manage an identified risk, it is escalated to our CITO and SDIS to assess and implement potential responsive or corrective actions in our processes, strategies, or technology to address the risk. • Risk mitigation. Our senior executive team, which includes our CITO, using input from our information security team and our broader information technology (or IT) department, develop and approve budgets, strategies, technology roadmaps and programs which are designed to effectively manage our cyber risks, safeguard our information resources, and reduce the likelihood or impact of cybersecurity incidents.


text: Our cybersecurity risk management framework is integrated into our overall ERM process which is managed, administered, and governed by our senior executive team under the oversight of the Board. As part of our ERM program, our senior executive team has delegated the initial identification and assessment of the Company's leading risks to an ERC which is comprised of executives from various operating segments and functional departments across the Company, inclusive of information security.


text: Although both we, and the third parties who provide services to us, commit resources to the design, implementation, monitoring, and protection of the information systems we own or use, there is no guarantee that either our or those third parties' cybersecurity measures will effectively manage the multitude of cyber risks to which we are exposed. For more information regarding the risks from cybersecurity threats that may impact our business strategy, results of operations, or financial condition, see Part I, "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Board Oversight of Risks from Cybersecurity Threats Our Board believes that evaluating management's oversight, administration, and governance of the risks confronting the Company, including risks related to cybersecurity, is one of its most important areas of oversight. In carrying out this responsibility, the Board is assisted by each of its standing committees, which each considers risks that are within its areas of chartered responsibility, and each of which apprises the full Board of any significant risks which are considered by the committee and management's response to those risks. The Audit Committee of the Board ("Audit Committee") is charged with the primary responsibility for overseeing our design, execution, and administration of our ERM process and, with regard to cybersecurity risks, setting expectations and accountability for management and reviewing our internal auditors' assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks, and overseeing the Company's cybersecurity disclosures. The Audit Committee receives semiannual updates, and the Board receives annual updates, from our senior executive team (including our CITO and the SDIS) on our cybersecurity risks, threats, and initiatives including evolving cybersecurity threats and trends, cybersecurity technologies and solutions that have been deployed internally, policies and procedures to address major cyber risk areas and threats to the Company, third-party assessments of the adequacy of our cybersecurity resources, and attendance by members of our information security team at various seminars and conferences on emerging cybersecurity risks and threats. In addition to these regular updates, the Audit Committee or the Board may receive additional updates if deemed appropriate.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Cybersecurity is a key component of our technology strategy, which is architected and managed by our CITO and reviewed and monitored by our senior executive team, with oversight from our Board and the Audit Committee, as described above. Our CITO's experience and expertise in cybersecurity includes 20 years of practitioner experience as an information security advisor across multiple industry verticals where he has served in security analyst, architect, and security program leadership roles, and has led information security teams to deliver large scale information security programs for multiple Fortune 500 companies. Our cybersecurity risk management program is managed by our SDIS, who reports directly to the CITO. Our SDIS's experience and expertise in cybersecurity includes 32 years of working in the information technology field as an analyst, architect, and leader and 14 years leading information security teams at multiple enterprises. The processes by which the CITO and SDIS are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents are described above under "Risk Management and Strategy."


text: As a large, multinational transportation and logistics company, we and our subsidiaries each face a range of risks from cybersecurity threats in connection with our operations due to our inherent dependence on information systems, software, and digital technologies to operate safely, efficiently, and effectively. Such risks include, but are not limited to, those related to cyberattacks, network breaches, ransomware, malware or denial-of-service attacks, phishing and other scams, theft, and unauthorized disclosure, any of which, if successful, could result in the disclosure of confidential customer or commercial data, loss of valuable intellectual property, or systems disruption, and subject us to civil liability, fines, penalties, damage of our brand or reputation, or otherwise harm our business, any of which, could be material. We and our subsidiaries are each exposed to such risks both through direct attacks on our own information systems and, indirectly, as a result of our engagement of third-party service providers, software vendors, and independent contractors, such as cloud computing providers. Certain of our third-party service providers or software vendors provide us with computing services which, in certain cases, involve hosting our data or processes on third-party servers, which exposes us to the risk that our data may be compromised or our operations disrupted if such third-party servers are compromised. Other third-party service providers provide us with contracted labor to whom we necessarily grant access to certain of our information systems, which indirectly exposes us to additional risks of network breaches and cybersecurity threats. In addition, because the trucking industry has been designated by the federal government as part of the critical U.S. infrastructure, as a leading provider of truckload, intermodal, and logistics services, we face increased risks from cybersecurity threats, cybercriminals, and bad actors, both foreign and domestic.


text: Cyber risk management has become a vital part of our broader ERM efforts. To manage and mitigate cyber risks, we have a dedicated information security team that has been charged with monitoring and managing cyber threats to our information systems, and the data that is stored on those systems, using our cyber risk management methodology. Our information security team is led by our SDIS and overseen by our CITO. Our cybersecurity risk management framework encompasses, among other things, ongoing systematic processes to identify, analyze, prioritize, manage, and monitor potential cyber risks to the information systems that we own or use and the cybersecurity threats to which we are exposed as a result of our reliance on third-party service providers and third-party software. Our cyber risk management methodology is comprised of the following core tasks: • Risk identification – Our internal information security team works with an MSSP and other external security partners to identify existing and new threats to our information systems. Our information security team, working in partnership with our MSSP, monitors our information systems to identify malicious and anomalous activity, uncover potential cybersecurity threats, and assess risks to information systems. • Risk analysis – Our information security team, working in partnership with relevant cybersecurity and technology experts, analyzes identified threats to determine the likelihood of the actualization of a threat and the potential business impacts, including evaluating the potential for data loss, data corruption, disruption to business operations, and financial impact. • Risk evaluation – Identified risks are evaluated to determine whether gaps in our controls or risk mitigation strategies exist that could result in material risk to the Company. If it is determined that our existing processes, strategies, or technology may be insufficient to effectively mitigate or manage an identified risk, it is escalated to our CITO and SDIS to assess and implement potential responsive or corrective actions in our processes, strategies, or technology to address the risk. • Risk mitigation – Our senior executive team, which includes our CITO, using input from our information security team and our broader information technology (or IT) department, develop and approve budgets, strategies, technology roadmaps and programs which are designed to effectively manage our cyber risks, safeguard our information resources, and reduce the likelihood or impact of cybersecurity incidents.


text: Our cybersecurity risk management framework is integrated into our overall ERM process which is managed, administered, and governed by our senior executive team under the oversight of the Board. As part of our ERM program, our senior executive team collaborates with the ERC, which is comprised of executives from various operating segments and functional departments across the Company, in the initial identification and assessment of the Company's leading risks to an ERC, inclusive of information security.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property and proprietary business information theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; physical damage to utility and transmission infrastructure; and reputational harm. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks. As part of our enterprise risk management program, we consider cybersecurity risks alongside other risks in our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying material cybersecurity threats, assessing their severity, and deploying potential mitigations. We have implemented cybersecurity programs at both Southwest and Centuri that are tailored to the distinct businesses of our two segments.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Southwest's cybersecurity program focuses on people, processes, and technology, and takes a defense-in-depth approach by seeking to align with industry best practices. We invest in annual cybersecurity awareness training and testing for employees. We teach employees about remaining vigilant in daily work activities and practicing good security awareness. Specialized cybersecurity training is provided to those in specific job functions particularly susceptible to cyber incidents and phishing simulations are conducted monthly. Annually, a cybersecurity fair is held, and every employee is encouraged to participate. During this fair, outside experts present current and relevant information in an engaging and educational atmosphere. Tabletop exercises are periodically conducted to evaluate controls, processes, and procedures within Southwest and with our partners in the handling of a cybersecurity incident. Southwest maintains partnerships with law enforcement and other participants within the natural gas and electric utility industries. We also participate in the Information Sharing and Analysis Center to share threat intelligence and collaborate on cybersecurity issues affecting our industry.


text: As a natural gas local distribution company, Southwest's objective is to comply with the U.S. Department of Homeland Security Transportation Security Administration ("TSA") security directives for our gas monitoring and control systems. Pursuant to these directives, Southwest engages outside consultants to regularly review our technical architecture and alignment with the TSA security directives. In addition to complying with these regulations, Southwest takes a quantitative approach to cybersecurity risk to identify areas for future cybersecurity investment and periodically engages experts to attempt to infiltrate our information systems to further strengthen our security posture. We invest in a range of cybersecurity technologies within the perimeter, network, and endpoints, creating a defense-in-depth architecture designed for prevention and response to cybersecurity events and to help minimize exposure to risks.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, Southwest undertakes the following activities: • deploys a defense-in-depth approach with security measures in place at multiple layers; • closely monitors information systems using a suite of technologies and a specialized cybersecurity team; • reviews emerging data protection laws and implements changes to our processes designed for compliance; • trains each new employee who handles individual customer data on handling and use requirements for such data; • avoids, where possible, storing sensitive customer information like social security numbers or banking information for individual customers on our information systems; • conducts regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice, and contracts (as applicable) encourages employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • runs tabletop exercises to simulate response activities to a cybersecurity incident and use the findings to improve our processes and technologies; • leverages the National Institute of Standards and Technology ("NIST") Computer Security Incident Handling Process as a framework to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • conducts vulnerability and penetration assessments, with associated remediation activities.


text: Southwest's incident response plan is designed to coordinate the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents. These activities include processes to triage, assess severity, communicate, contain, investigate, and remediate the incident, as well as comply with any applicable legal obligations and mitigate reputational damage.


text: Southwest's processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to customer and employee data or our systems. Third-party risks are included within our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through our diligence review. Our due diligence process involves the use of questionnaires that are completed by third-party service providers and reviewed by business unit representatives and cybersecurity specialists to identify risks associated with third-party service providers. We use the responses provided in the questionnaires to assist in finding ways to mitigate risks presented by a particular third-party service provider consistent with the services provided. Additionally, contracts with third parties that could introduce significant cybersecurity risk to Southwest include terms to assist in the mitigation of cybersecurity risks, including but not limited to, requiring counterparties to report data privacy or cybersecurity incidents to us and to agree to be subject to periodic cybersecurity audits as appropriate.


text: Centuri conducts quarterly cybersecurity reviews with its Executive Leadership Team. The review outlines the state of cybersecurity practices at Centuri through the lens of the NIST Cybersecurity Framework ("NIST CSF"). Details relative to the progress of specific goals and objectives are communicated to ensure alignment with leadership expectations. Centuri has developed policies and implemented procedures to meet the security control objectives provided within the NIST CSF, as well as applicable Centuri policies. Centuri's cybersecurity team performs a variety of internal operational risk assessment activities to track and mitigate risks to the organization. These operational practices cross a variety of management activities and a list of these activities is maintained in a Cybersecurity Risk Register for tracking the status of risk mitigation activities, as well as the overall maturity of the organization relative to the NIST CSF. Centuri further engages third parties to perform both targeted and holistic evaluations of Centuri cybersecurity practices on a regular basis.


text: Centuri's cybersecurity team performs independent reviews of new vendors whose services may be potentially integrated within the Centuri enterprise. As part of a standardized review process, Centuri's cybersecurity team maintains a Control Assurance Toolkit to review vendor activities, practices, and controls for alignment with Centuri's policies and procedures. Resulting control recommendations are coordinated to ensure appropriate implementation during integration activities.


text: Centuri undertakes vulnerability, attack, and penetration testing via a third-party audit. As part of its general control practices, Centuri performs a review of service organizational controls reports for in-scope vendors to ensure adherence to generally accepted cybersecurity practices. Any reported weaknesses and associated responses are captured and evaluated for impact, and subsequently provided to Centuri leadership for review and response.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Operational Risks" as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. However, because Southwest operates in the area of critical infrastructure, as defined under federal law and by the TSA, we have been and will continue to be the target of cybersecurity attacks from time to time.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The responsibility for oversight of risks from cybersecurity threats rests with our entire Board, but the Audit Committee oversees certain cybersecurity related items as described below. At least twice per year the entire Board receives an overview from management on our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, and cybersecurity threat risks or incidents and developments, as well as the steps management took to respond to such risks. Additionally, our Chief Information Officer attends Audit Committee meetings to present cybersecurity information for consideration in financial reporting, as necessary, and attends private Executive Sessions with the Audit Committee. Our Director of Internal Audit reports to the Audit Committee regarding attack and penetration exercise results and remediation. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news or events and discuss any significant updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters. The Board has also recently participated in a tabletop exercise associated with cyber threats.


text: At the management level for Southwest, our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by Southwest's President and the Vice President/Information Services/Chief Information Officer, along with the Director of Information Security, Manager of Cybersecurity Services, and Manager of Information Security Compliance and Administration. A Cybersecurity Executive Committee, consisting of officer-level management appointees representing key areas of our business, exists to maintain situational awareness of cybersecurity risks, support methods of addressing cybersecurity risks, and support the Chief Information Officer's efforts to help Southwest follow natural gas sector-specific regulations and reporting. The Cybersecurity Executive Committee meets regularly with legal advisors and cybersecurity professionals. In our Information Services Department, the cybersecurity management team members hold degrees in information technology or cybersecurity and industry-recognized certifications in cybersecurity, and each has many years of relevant work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Cybersecurity team members are expected to keep their knowledge, skills, and training current by participating in industry events and continuing education programs as applicable.


text: These members of management and the Cybersecurity Executive Committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our cybersecurity playbooks and incident response plan outline our procedures, communication protocols, and information escalation processes applicable throughout the lifecycle of a cybersecurity incident. The playbooks and plans cover information flow from discovery of a possible issue through the reporting of it to Information Services management and to the Cybersecurity Executive Committee and Board as necessary. In the event of a cybersecurity event at Centuri, Centuri's leadership team informs Southwest's cybersecurity team, and the Company's Audit Committee or entire Board is briefed, as appropriate. As discussed above, members of management (our President, Chief Information Officer, and Director of Information Security) report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least twice per year, with the Audit Committee receiving more frequent updates as needed to assist in including cybersecurity items in financial reporting and monitoring attack and penetration testing results.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property and proprietary business information theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; physical damage to utility and transmission infrastructure; and reputational harm. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks. As part of our enterprise risk management program, we consider cybersecurity risks alongside other risks in our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying material cybersecurity threats, assessing their severity, and deploying potential mitigations.


text: Southwest Gas' cybersecurity program focuses on people, processes, and technology, and takes a defense-in-depth approach by seeking to align with industry best practices. We invest in annual cybersecurity awareness training and testing for employees, by means of which we teach employees about remaining vigilant in daily work activities and practicing good security awareness. Specialized cybersecurity training is provided to those in specific job functions particularly susceptible to cyber incidents and phishing simulations are conducted monthly. Annually, a cybersecurity fair is held, and every employee is encouraged to participate. During this fair, outside experts present current and relevant information in an engaging and educational atmosphere. Tabletop exercises are periodically conducted to evaluate controls, processes, and procedures within Southwest Gas and with our partners in the handling of a cybersecurity incident. Southwest Gas maintains partnerships with law enforcement and other participants within the natural gas and electric utility industries. We also participate in the Information Sharing and Analysis Center to share threat intelligence and collaborate on cybersecurity issues affecting our industry.


text: As a natural gas LDC, Southwest Gas' objective is to comply with the TSA security directives for our gas monitoring and control systems. Pursuant to these directives, Southwest Gas engages outside consultants to regularly review our technical architecture and alignment with the TSA security directives. In addition to complying with these regulations, Southwest Gas takes a quantitative approach to cybersecurity risk to identify areas for future cybersecurity investment and periodically engages experts to attempt to infiltrate our information systems to further strengthen our security posture. We invest in a range of cybersecurity technologies within the perimeter, network, and endpoints, creating a defense-in-depth architecture designed for prevention and response to cybersecurity events and to help minimize risk exposure.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, Southwest Gas undertakes the following activities: • deploys a defense-in-depth approach with security measures in place at multiple layers; • closely monitors information systems using a suite of technologies and a specialized cybersecurity team; • reviews emerging data protection laws and implements changes to our processes designed for compliance; • trains each new employee who handles individual customer data on handling and use requirements for such data; • avoids, where possible, storing sensitive customer information like social security numbers or banking information for individual customers on our information systems; • conducts regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice, and contracts (as applicable), encourages employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • runs tabletop exercises to simulate response activities to a cybersecurity incident and use the findings to improve our processes and technologies; • leverages the NIST Computer Security Incident Handling Process as a guideline to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • conducts vulnerability and penetration assessments, with associated remediation activities.


text: Southwest Gas' incident response plan is designed to coordinate the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents. These activities include processes to triage, assess severity, communicate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate reputational damage.


text: Southwest Gas' processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or those who have access to customer and employee data or our systems. Third-party risks are included within our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through our diligence review. Our due diligence process involves the use of questionnaires that are completed by third-party service providers and reviewed by business representatives and cybersecurity specialists to identify risks associated with third-party service providers. We use the responses provided to assist in finding ways to mitigate risks presented by a particular third-party service provider, consistent with the services provided. Additionally, contracts with third parties that could introduce significant cybersecurity risk to Southwest Gas include terms to assist in the mitigation of cybersecurity risks, including but not limited to, requiring counterparties to report data privacy or cybersecurity incidents to us and to agree to be subject to periodic cybersecurity audits as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Operational Risks" as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. However, because Southwest Gas' operations involve critical infrastructure, as defined under federal law and by the TSA, we have been and will continue to be the target of cybersecurity attacks from time to time.