text: As part of the oversight process, the Risk Committee has the following responsibilities, among others: • reviews and advises on our cybersecurity and operational risk strategy, resiliency, crisis and incident management, and security-related information technology planning processes, and reviews strategy and implementation for investing in related systems, controls, and procedures with management; • reviews our compliance with applicable global data protection and security laws and regulations, and the Company's adoption and implementation of systems, controls and procedures designed to comply with such laws and regulations; • reviews plans for periodic assessments and related findings and remediation of our cybersecurity and operational risk and incident response and disaster recovery programs by outside professionals; • reviews analyses of our cybersecurity and operational risks by management and third parties, as applicable; and • evaluates our disclosure controls and procedures related to cybersecurity to ensure timely and accurate reporting of cybersecurity and operational risks and incidents, as appropriate.


text: The Risk Committee meets at least four times a year and regularly reports to the full Board, including regarding its review and assessment of cybersecurity risk oversight matters and related recommendations. The Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of F5's business strategy.

companyName: F5, INC.

ticker: FFIV

secItem: Item 1C


text: The Risk Committee receives periodic updates from our CISO, and other persons the Risk Committee deems appropriate, on a range of cybersecurity matters, including those referenced above as well as on the status of the Company's cybersecurity posture and risk mitigation efforts. If cyber-related issues arise between Risk Committee meetings that the CISO believes could have a material adverse impact on the Company, the CISO, or another appropriate risk management leader, will report to the Chair of the Risk Committee.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program in partnership with other business leaders, including our General Counsel and Chief Operating Officer. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. In December 2023, our CISO retired after three years in the position, and a career spanning over twenty-five years as an industry-recognized leader in cybersecurity, information technology, and risk management. Her replacement has served in various roles in information technology, security and risk management for over 15 years, including having previously served as the CISO of two other publicly traded technology companies. In September 2024, our current CISO began transitioning to a new role within the Company, and as a result, we have appointed an interim CISO while we conduct a search for his permanent replacement. Our interim CISO has over 25 years of experience in technology and information security operations across a diverse range of business sectors.


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates in conjunction with our overall risk management systems and processes, covering all company risks.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team and is principally responsible for our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, monitoring, detecting and responding to cybersecurity events and incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our products and related supportive infrastructure, critical IT systems, information, and our broader enterprise IT environment; • monitoring, detection and collection and analysis of information regarding evolving, ongoing, and emerging threats and vulnerabilities, and corresponding actions to assess and remediate corresponding risks; • regular testing and assessments to identify vulnerabilities; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.


text: We also have a cybersecurity incident response plan to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, including, where appropriate, escalation to the Risk Committee and the Board. We periodically perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities, and assess team preparedness.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches. We periodically review our cybersecurity insurance program.


text: As of the date of this report, other than with respect to the Cyber Incident, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. For more information on the Cyber Incident, see Part II, Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Cyber Incident". Despite our security measures, however, there can be no assurance that we, or third parties with whom we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors," including "Security vulnerabilities or control failures in our IT infrastructure or multicloud application delivery and security products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation," and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows."


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats and is assisted in that oversight by its Risk Committee. The Risk Committee reviews and assesses the Company's cybersecurity risk exposure and evaluates the adequacy and effectiveness of related risk management processes and policies.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program in partnership with other business leaders, including our General Counsel and Chief Operating Officer. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. Our CISO has over 25 years of experience in techn ology and information security operations across a diverse range of business sectors. In addition, on October 15, 2025 Michael Montoya, a former member of our Board of Directors, was appointed as the Company's Chief Technology Operations Officer. In his role, Mr. Montoya will lead the enterprise-wide strategy and execution of our enterprise-wide cybersecurity program with our CISO, and in partnership with other business leaders, including our General Counsel and Chief Operating Officer to further embed security into every aspect of how F5 operates.


text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depends in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

companyName: FEDEX CORP

ticker: FDX


text: Cybersecurity Risk Management and Strategy FedEx has an information technology ("IT") risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management ("ERM") process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization ("ISO") 27001 and National Institute of Standards and Technology ("NIST") standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.


text: We regularly assess our cybersecurity program's capabilities and tools to help us enhance reliability and scan our environment for vulnerabilities. Our IT risk management team, including our Corporate Vice President – Chief Information Security Officer ("CISO"), communicates with senior management on the cybersecurity risk posture of our IT assets, strives to ensure consistent risk remediation activities, and monitors the effectiveness of our IT-related controls. In addition, our internal audit team performs reviews of our information security organization to help ensure controls are operating effectively and as designed.


text: Enterprise-wide information security training (including with respect to cybersecurity), supplemented by awareness programs, is crucial for risk reduction and safeguarding customer, employee, and company information. We provide training to employees and certain third-party contractors based on access to our network, risk, roles, policies, standards, and behaviors, which is updated to address emerging technology and security issues.


text: We periodically engage with assessors, consultants, auditors, and other third parties to review and improve our cybersecurity program. Compliance with regulatory requirements involves regular third-party assessments. Our processes are also designed to address cybersecurity risks associated with third-party service providers, including risk assessment and due diligence during selection and oversight. Key third parties undergo regular assessments to gauge cybersecurity control effectiveness, with heightened review of those with access to non-public data.


text: We regularly conduct table-top simulation exercises to test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions.


text: In the last three fiscal years to date, we have not identified any risks from cybersecurity threats or become aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition.


text: While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see " Item 1A. "Risk Factors " of this Form 10-K.


text: The FedEx Board of Directors has delegated to the Cyber and Technology Oversight Committee of the Board of Directors ("CyTOC") responsibility for overseeing the company's cyber and technology-related risks, including network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as artificial intelligence and machine learning; the technologies, policies, processes, and practices for managing and mitigating such risks; and the company's cyber incident response and recovery plan. The CyTOC also oversees the cybersecurity, cyber-resiliency, and technology aspects of the company's business continuity and disaster recovery capabilities and contingency plans. Several of our Board members, including certain members of our CyTOC, have technological, digital, and/or cybersecurity experience.


text: The CyTOC receives regular updates from our CISO and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, risks associated with third-party service providers, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented at least annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, key enterprise risks, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, and any significant changes to these risks are reported to the Board and its Audit and Finance Committee.


text: Our CISO, who reports to the Chief Executive Officer, leads our information security team and has management responsibility for overseeing FedEx's cybersecurity program, including assessing and managing material risks from cybersecurity threats. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.


text: The FedEx Data and Technology Risk Council ("DTRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The DTRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.


text: Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Our CISO reports to the Chief Executive Officer, and the FedEx Executive Committee oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the DTRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate, and consideration of external reporting and disclosure requirements.


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer ("CIO") as part of our enterprise risk management ("ERM") process. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our "Cybersecurity Team").

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board of Directors. We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See "Item 1A - Risk Factors" in this Annual Report for a further discussion of specific risks related to cybersecurity threats.


text: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities to risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team and to our CIO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.


text: We maintain an insider threat program designed to identify, assess, and address potential internal risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. As a government contractor, we must comply with extensive cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. Our policies and implemented controls reflect our adherence to these requirements.


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.


text: Our Board of Directors provides oversight of our ERM process and other guidelines and policies governing the processes by which our CEO and senior management assess our exposure to risk, including risk from cybersecurity threats. Our management Compliance Committee receives briefings from our CIO, Chief Information Security Officer, and other members of senior management on cybersecurity threats and related matters and assists the Board in its oversight and review of our ERM process.


text: Our management Compliance Committee reviews our cybersecurity risk across the enterprise and our cybersecurity strategy framework and operational posture. The Compliance Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls to (a) identify, assess, monitor, and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements.


text: To date, we have not experienced any cybersecurity incidents that have had a material affect on the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer ("CIO") as part of our enterprise risk management ("ERM") process and through regularly scheduled meetings of our multidisciplinary cyber critical incident response team. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our "Cybersecurity Team").


text: We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See "Item 1A - Risk Factors" in this Annual Report for a further discussion of specific risks related to cybersecurity threats.


text: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities and risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team, and the CISO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.


text: To date, we have not experienced any cybersecurity incidents that have had a material effect on the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: As a financial services company, we face cybersecurity risks and threats, and our customers, suppliers, and third-party service providers face cybersecurity risks and threats. As part of the operation of our business, the Company uses, stores, and processes data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, MDOB, RIDBR, and NYDFS. To address these risks and regulatory requirements, the Company implemented a Cybersecurity Risk Management Program (the "Program") that is designed to identify, assess and mitigate risks from cybersecurity threats to the data and our systems. The Program adheres to regulatory requirements and the tenets of the Federal Financial Institutions Examination Council ("FFIEC") handbook and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: BROOKLINE BANCORP INC


text: Oversight and Governance Our Chief Information Security Officer ("CISO"), assisted by our Information Security team, has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Company's Board of Directors and members of executive management. Our CISO has extensive experience managing information technology systems and information security systems, previously served as the Company's Chief Information Officer, and holds the Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications. Our CISO regularly updates members of executive management on developments surrounding cybersecurity. The CISO reports to the Risk Committee of the Board of Directors and provides regular reports to the Board of Directors and Risk Committee on emerging cybersecurity issues and the Company's cybersecurity infrastructure.


text: Our Program is overseen by the Company's Board of Directors, which has delegated certain responsibilities to the Audit Committee and the Risk Committee. The Chairs of the Audit Committee and Risk Committee, in turn, report to the Board of Directors a summary of the presentations they have received relative to the Program. The Board of Directors oversees management's processes for identifying and mitigating risks, including cyber risks, to assist in the alignment of our risk exposure with our overall strategic business objectives. The Board of Directors has also engaged an experienced information security advisor to assist them with cybersecurity and data privacy oversight responsibilities. This advisor provides the Board of Directors with independent updates on external market cybersecurity threats and emerging risks on a regular basis.


text: The Risk Committee, Audit Committee, and the Board of Directors are active in understanding and evaluating cybersecurity risks. The Risk Committee receives and reviews a quarterly Enterprise Risk Management ("ERM") report from the Chief Risk Officer that is the cumulation of a process that involves discussions with leaders across the Company and incorporates a number of enterprise risk factors, including those related to cybersecurity threats. The Audit Committee receives the results of internal and external penetration testing as well as any other audits applicable to the Company's information security programs. The Audit Committee actively engages management in discussions surrounding the outcome of these audits.


text: At least annually, the Board of Directors receives a report from the CISO covering the Company's information security program. This report includes a review of enhancements to the Company's programs, a discussion of management's actions to identify and detect threats and planned action steps in the event of an incident, and an overview of employee training and engagement efforts. In addition, separately, on at least an annual basis, the Board of Directors receives updates from the CISO on the Company's Incident Response Plan, which outlines steps to be followed in the event of an incident including detection, mitigation, recovery, and notification (including notification to senior management, the Board of Directors, and functional business areas), and remediation.


text: The Program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner. Our Program consists of a layered cybersecurity approach and is incorporated into our overall ERM program.


text: Our Information Security team, led by our CISO, is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. The Information Security team works collaboratively across the Company to understand the potential impacts of a cybersecurity incident and prioritize mitigation and other measures based on, among other things, the materiality to our business. The Information Security team has established processes designed to monitor threats in the cybersecurity landscape which include interacting with intelligence networks, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending industry specific security conferences and trainings. The team regularly monitors our internal network and customer-facing network to identify any security issues. In addition, the Company augments the team's monitoring via the engagement of external vendors who provide continuous threat monitoring services of the Company's environment.


text: As part of our assessment of the risks to our Company, the Information Security team conducts annual cybersecurity risk assessments to evaluate the inherent risk of our applications and the strength of our controls, and identify the residual risk for each application. In addition, we conduct regular reviews and testing of critical network and application systems to monitor their security. We have adopted internal Company-wide Information Technology and Information Security policies which are reviewed and updated annually and approved by our Board of Directors. Our employees and the Board of Directors attend annual trainings that are designed to raise awareness about cybersecurity threats, reduce our vulnerability, and encourage consideration of cybersecurity threats across the Company. Additional trainings are required for employees in certain roles; these additional trainings are tailored to the employees' specific duties.


text: We regularly review and update our investments in information technology security to identify and protect critical assets, provide monitoring and alerts, and, as needed, engage third-party experts. To assess the effectiveness of our Program, we have engaged consultants to conduct penetration testing and other vulnerability assessments. Additionally, our Internal Audit department and external auditors conduct assessments of different systems to provide the Audit Committee with information on our risk management processes, including cybersecurity risk management. We also test our defenses internally and conduct regular cybersecurity simulations and tabletop exercises with members of executive management present. These tests and assessments provide useful insights into the strengths and weaknesses of our cybersecurity framework.


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security and Information Technology teams complete security reviews on the vendors. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with our Vendor Management team to review System and Organization Controls ("SOC") 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.


text: Our Company faces a number of cybersecurity risks in connection with the operation of our business which could have a material adverse effect on our business financial condition, results of operations, cash flows, or reputation. Although, to date, such risks have not materially affected us, we have, from time to time, experienced threats and breaches to our data and systems. For more information about the cybersecurity risks we face, see the risk factors entitled "We face continuing and growing security risks to our information base, including the information we maintain relating to our customers." and "We rely on other companies to provide key components of our business infrastructure." in Item 1A- Risk Factors.


text: As a financial services company, we face cybersecurity risks and threats, and our customers, suppliers, and third-party service providers face cybersecurity risks and threats. As part of the operation of our business, the Company uses, stores, and processes data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, MDOB, RIDBR, and NYDFS. To address these risks and regulatory requirements, the Company implemented the Program that is designed to identify, assess and mitigate risks from cybersecurity threats to the data and our systems. The Program adheres to regulatory requirements and the tenets of the FFIEC handbook and the NIST Cybersecurity Framework.


text: Oversight and Governance Our CISO, assisted by our Information Security team, has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Company's Board of Directors and members of executive management. Our CISO has extensive experience managing information technology systems and information security systems, previously served as the Company's Chief Information Officer, and holds the Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications. Our CISO regularly updates members of executive management on developments surrounding cybersecurity. The CISO reports to the Risk Committee of the Board of Directors and provides regular reports to the Board of Directors and Risk Committee on emerging cybersecurity issues and the Company's cybersecurity infrastructure.


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security and Information Technology teams complete security reviews on the vendors. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with our Vendor Management team to review SOC 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.


text: Within the overarching enterprise risk management framework, we have an information security program designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy.


text: Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees and management.


text: The Board is responsible for the oversight of cybersecurity risk management, as well as the selection of a Chief Information Security Officer ("CISO"), the management official responsible for administering and executing the information security program. The Board's Technology Oversight Committee ("TOC") assists the Board in its oversight of the information security program. The TOC reviews information security metrics, oversees significant instances of non-compliance with the information security policy and monitors remediation of those instances, and reviews the appointment of the CISO for recommendation to the Board.


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. As it pertains to the information security program, the ERMC assesses and monitors information security risks and approves the information security policy on at least an annual basis. Certain instances of non-compliance with the information security policy are escalated to the EMRC, which may further escalate to the TOC as appropriate. Once escalated to a committee, the committee is responsible for overseeing related remediation.


text: Our CISO is responsible for the overall administration and execution of the information security program and reports to our Chief Risk Officer ("CRO"). Our CISO has over thirty years of experience working in information security for a variety of companies and organizations, including multiple financial institutions. The CISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The CISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually.


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.


text: On a regular basis, the CISO reports to the CRO information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The CISO also reports the status of information security-related key risk indicators to the CRO. The CISO reports to the TOC monthly on information security developments and emerging risks, both in the industry and specific to the Company. The CISO and CRO report on the information security program to the TOC and the ERMC and review and propose updates to the information security policy to the ERMC.


text: The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we engage third parties to assess the information security risks related to new products, and we utilize third parties to conduct certain security operations and maintain certain information security infrastructure. We have adopted a Contract and Vendor Management Policy, which addresses the identification, measurement, monitoring, and management of our third-party service provider relationships, including those related to information security. The CISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third party service providers, the CISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to the CRO, ERMC, TOC, and, if applicable, the Board.


text: To date, we have not incurred any material losses related to cybersecurity incidents. However, the risk management and governance processes described above may not be sufficient to prevent cybersecurity incidents, and we could incur substantial costs and suffer other negative consequences from cybersecurity incidents. See "Part 1, Item IA. – Risk Factors" for more information on the cybersecurity risks facing the Company.


text: The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate and monitor the risks faced by the Company, including cybersecurity risk.


text: The Board is responsible for the oversight of cybersecurity risk management, as well as the selection of a Chief Information Security Officer ("CISO"), the management official responsible for administering and executing the information security program. The Board's Technology Oversight Committee (the "TOC") assists the Board in its oversight of the information security program. The TOC reviews information security metrics, oversees significant instances of non-compliance with the information security policy and monitors remediation of those instances, and reviews the appointment of the CISO for recommendation to the Board.


text: At the management level, the Enterprise Risk Management Committee (the "ERMC") is primarily responsible for cybersecurity risk management. As it pertains to the information security program, the ERMC assesses and monitors information security risks and approves the information security policy on at least an annual basis. Certain instances of non-compliance with the information security policy are escalated to the EMRC, which may further escalate to the TOC as appropriate. Once escalated to a committee, the committee is responsible for overseeing related remediation.


text: Our CISO is responsible for the overall administration and execution of the information security program and reports to our Chief Risk Officer ("CRO"). Our CISO has over fifteen years of experience working in information security and risk for a variety of companies and organizations, including multiple financial institutions. The CISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The CISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually.


text: On a regular basis, the CISO discusses with the CRO information security risk issues, risk mitigation progress and developments and information security enhancement initiatives. The CISO reports to the TOC quarterly on information security developments and emerging risks, both in the industry and specific to the Company. The CISO and CRO report on the information security program, including the status of information security-related key risk indicators, to the TOC and the ERMC. The Information Security Policy is also approved by the TOC on an annual basis.


text: The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we utilize third parties to conduct certain security operations and maintain certain information security infrastructure. We have adopted a Third Party Risk Management Policy, which addresses the identification, measurement, monitoring, and management of our third-party service provider relationships, including those related to information security. The Director of Third-Party Risk Management, along with the CISO, assess and monitor information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the Director of Third-Party Risk Management works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to the CRO, ERMC, TOC, and, if applicable, the Board.


text: Our management team is responsible for identifying, assessing and managing the material risks facing Columbia, supported by an enterprise risk management program. This program includes an annual enterprise risk assessment, during which interviews are conducted with independent directors and members of senior management seeking participants' judgement and assessment of the material risks facing Columbia. The enterprise risk management program then monitors the risks identified and mitigation efforts underway through periodic meetings with senior management.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: Our enterprise risk management program addresses risks facing Columbia from cybersecurity threats impacting our internal systems and/or systems supported by third-party software providers. Our Chief Digital Information Officer ("CDIO") and Chief Information Security Officer ("CISO") are responsible for identifying, assessing and managing these risks. Our CDIO has served in various information technology and digital engineering roles for nearly 30 years. See Item 1 in this Annual Report on Form 10-K for further discussion of our CDIO's background. Our CISO has served in various information technology and information security roles for over 20 years, including management of information security programs in the Department of Defense, private and public companies, as well as holds multiple industry certifications in information security. We leverage certain third-party providers and our internal Incident Response Team to alert us when a cybersecurity event occurs. Cybersecurity events may include unauthorized access, attacks on our resources, compromised accounts, malware, or ransomware. Upon alert of an event, we estimate the level of severity, create a response plan, and communicate to management as needed. Based on the estimated level of severity, timing of incident communication to management may range from immediate to quarterly. Our risk assessment process related to cybersecurity threats is subject to change in the future as threats may evolve over time.


text: Our Information Security committee oversees this cybersecurity program and consists of senior management, including our CDIO, Chief Financial Officer and Chief Administrative Officer and General Counsel. At least quarterly, this committee reviews updates regarding cybersecurity threats and incidents that have occurred. Periodically, this committee approves cybersecurity strategy and initiatives proposed by our CISO.


text: Our Board of Directors ("Board") generally oversees Columbia's risk management practices and processes. Annually, the Board reviews the results of the annual enterprise risk management program, including updates from our CISO related to cybersecurity matters. The Audit Committee also receives an update on the enterprise risk management program annually. The Board has delegated primary oversight of the management of cybersecurity risk to the Audit Committee. The Audit Committee annually reviews the strategies, investments and risk related to Columbia's information technology systems, including a review of Columbia's cybersecurity programs, and also receives quarterly updates from our CISO. The Board is informed of cybersecurity events to the extent they may materially impact Columbia or management otherwise believes they should be escalated.


text: See Item 1A of this Annual Report on Form 10-K for more information of risks relating to cybersecurity, including the risk factors "We Rely on Information Technology Systems, including Third-Party Cloud-based Solutions, and Any Failure of These Systems May Result in Disruptions or Outages in Our E-Commerce and In-Store Retail Platforms, Loss of Processing Capabilities, and/or Loss of Data, Any of Which May Have a Material Adverse Effect on Our Financial Condition, Results of Operations or Cash Flow" and "A Security Breach of Our or Our Third-


text: Parties' Systems, Exposure of Personal or Confidential Information or Increased Government Regulation Relating to Handling of Personal Data, Could, Among Other Things, Disrupt Our Operations or Cause Us to Incur Substantial Costs or Negatively Affect Our Reputation".


text: Our enterprise risk management program addresses risks facing Columbia from cybersecurity threats impacting our internal systems and/or systems supported by third-party software providers.


text: On January 6, 2025, Skip Potter, Executive Vice President, Chief Digital Information Officer, departed the Company. Jim Swanson, Executive Vice President and Chief Financial Officer, is overseeing the digital technology department at the Company in an interim capacity. Our Chief Information Security Officer ("CISO") reports to Mr. Swanson and is responsible for identifying, assessing and managing risks facing the Company from cybersecurity threats impacting our internal systems and/or systems supported by third-party providers. Our CISO has served in various information technology and information security roles for over 20 years, including management of information security programs in the Department of Defense, private and public companies, and holds multiple industry certifications in information security. We leverage certain third-party providers and our internal Incident Response Team to alert us when a cybersecurity event occurs. Cybersecurity events may include unauthorized access, attacks on our resources, compromised accounts, malware, or ransomware. Upon alert of an event, we estimate the level of severity, create a response plan, and communicate to management as needed. Based on the estimated level of severity, timing of incident communication to management may range from immediate to quarterly. Our risk assessment process related to cybersecurity threats is subject to change in the future as threats may evolve over time.


text: Our Information Security committee oversees this cybersecurity program and consists of senior management, including Mr. Swanson and our Chief Administrative Officer and General Counsel. At least quarterly, this committee reviews updates regarding cybersecurity threats and incidents that have occurred. Periodically, this committee approves cybersecurity strategy and initiatives proposed by our CISO.


text: Our Board of Directors ("Board") generally oversees Columbia's risk management practices and processes. Annually, the Board reviews the results of the annual enterprise risk management program, including updates from our CISO related to cybersecurity matters. The Audit Committee also receives an update on the enterprise risk management program annually. The Board has delegated primary oversight of the management of cybersecurity risk to the Audit Committee. The Audit Committee annually reviews the strategies, investments and risks related to Columbia's information technology systems, including a review of Columbia's cybersecurity programs, and also receives quarterly updates from our CISO. The Board is informed of cybersecurity events to the extent they may materially impact Columbia or management otherwise believes they should be escalated to the Board.


text: See Item 1A of this Annual Report on Form 10-K for more information of risks relating to cybersecurity, including the risk factors "We Rely on Information Technology Systems, including Third-Party Cloud-based Solutions, and Any Failure of These Systems or Interruption in Services Provided by the Systems May Result in Disruptions or Outages in Our E-Commerce and In-Store Retail Platforms, Loss of Processing Capabilities, and/or Loss of Data, Any of Which May Have a Material Adverse Effect on Our Financial Condition, Results of Operations or Cash Flow" and "A Security Breach of Our or Our Third-Parties' Systems, Exposure of Personal or Confidential Information or Increased Government Regulation Relating to Handling of Personal Data, Could, Among Other Things, Disrupt Our Operations or Cause Us to Incur Substantial Costs or Negatively Affect Our Reputation".


text: We use a combination of people, processes, and technologies to monitor and mitigate cybersecurity threats, which include end-point monitoring, vulnerability assessments and penetration testing. We leverage a variety of cybersecurity services, tools and techniques designed to identify and assess cybersecurity threats and take preemptive action to reduce and, where possible, eliminate the potential impacts.

companyName: STEELCASE INC


text: Our cybersecurity processes are based on the cybersecurity standards set by the Center for Internet Security and the National Institute of Standards and Technology ("NIST"). We regularly engage outside assessors and consultants to identify potential cybersecurity risks and suggest best practices.


text: Our efforts to safeguard the confidentiality, integrity and availability of our systems and data, maintain regulatory compliance and manage our risk from cybersecurity threats include: • maintaining a Security Operations Center to monitor and investigate activity that may be suspicious, • staffing and managing a cybersecurity team to safeguard systems and applications, • routinely auditing the security of critical information technology systems and services, and • conducting regular training and simulations for all employees and contractors with access to our systems to enhance awareness and responsiveness to possible threats.


text: We maintain a Cybersecurity Incident Response Plan, based on NIST's incident handling framework, to guide our response to cybersecurity threats. The plan includes procedures to triage, assess severity and remediate events in our information technology infrastructure. Annually, we engage third-party experts to conduct penetration testing inside our network.


text: For data and information that is maintained for us outside our network, we conduct security and privacy assessments of vendors who hold sensitive data and manage critical platforms. We maintain written agreements that govern third-party access to our network and protection of our information, and we conduct annual reviews of appropriate access. We require our suppliers to agree to our Supplier Code of Conduct which includes cybersecurity requirements. We include the assessment of cybersecurity risk as part of our overall enterprise risk management strategy.


text: Refer to Item 1A. Risk Factors under the heading "We rely on the integrity and security of our information technology systems, and our business could be adversely impacted by extended disruptions, significant security breaches or other compromises of these systems" for further information on the risks we face from cybersecurity threats. We believe that to date, such risks have not materially affected and are not believed to be reasonably likely to materially affect us, our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors is responsible for the oversight of our cybersecurity risk management. At least twice per year, our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") provide a cybersecurity update to our Audit Committee, which includes the results of penetration testing, cybersecurity simulations and training, as well as key initiatives and the progress against those initiatives, updates on the changes in trends of cybersecurity threats and the steps management is taking to address cybersecurity risks.


text: Our CTO and CISO manage our cybersecurity strategy. Our CTO has over 13 years of experience in information security and risk management and reports directly to our President and Chief Executive Officer. Our CISO has over 10 years of experience in information security and risk management, including at a federal law enforcement agency, and has a Master of Science degree in Cybersecurity.


text: Our CTO and CISO lead our Cybersecurity Incident Response Plan management of cybersecurity incidents with a cross-functional team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, containment and eradication of and recovery from such events. As the severity of events meet certain criteria, as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to our Disclosure Committee and the Audit Committee. Our Disclosure Committee is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.


text: Refer to Item 1A. Risk Factors under the heading "We rely on the integrity and security of our information technology systems, and our business could be materially adversely impacted by extended disruptions, significant security breaches or other compromises of these systems" for further information on the risks we face from cybersecurity threats. We believe that to date, such risks have not materially affected and are not reasonably likely to materially affect us, our business strategy, results of operations or financial condition.


text: Our CTO and CISO manage our cybersecurity strategy. Our CTO has over 14 years of experience in information security and risk management and reports directly to our President and Chief Executive Officer. Our CISO has over 11 years of experience in information security and risk management, including at a federal law enforcement agency, and has a Master of Science degree in Cybersecurity.


text: Our CTO and CISO lead our Cybersecurity Incident Response Plan management of cybersecurity incidents with a cross-functional team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, containment and eradication of and recovery from such events. If the severity of events meet certain criteria, as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to our Disclosure Committee and the Audit Committee. Our Disclosure Committee is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, sharing common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. While we may not meet any particular standard, specification or requirement of the Center for Internet Security Critical Security Controls, we utilize such controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: Our cybersecurity risk management program includes, among other things: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information services; • a team comprising information technology (IT) security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: During the year ended December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected our operations, business strategy, results of operations or financial condition. However, we expect to continue to face certain risks from ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See "Risk Factors – Disruptions to our information technology systems or our failure to adequately protect critical data, sensitive information and technology systems could materially affect our business or result in harm to our reputation."


text: Our Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of Quanta. The Board oversees management's implementation of our cybersecurity risk management program, receiving regular reports from management (including our Vice President of IT) on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.


text: Our Vice President of IT reports to the Chief Financial Officer and leads our IT and cybersecurity functions and has primary responsibility for leading our overall cybersecurity risk management program, supervising both our internal cybersecurity personnel and our external cybersecurity service providers. Our cybersecurity function is responsible for assessing and managing our material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment. Our Vice President of IT has significant global experience in managing and leading information systems and deploying cybersecurity technologies and holds a cybersecurity certification from a leading cybersecurity training and research institute.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, sharing common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. While we may not meet any particular standard, specification or requirement of the Center for Internet Security Critical Security Controls, we utilize such controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. Additionally, we are required by certain customers to maintain controls and processes pursuant to applicable cybersecurity regulations and frameworks.


text: Our cybersecurity risk management program includes, among other things: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information services; • a team comprising information technology (IT) security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assist with development, testing and compliance in regards to our security controls and processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; • a third-party risk management process for service providers; and • procurement of insurance coverage that is intended to address certain aspects of cybersecurity risks.


text: During the year ended December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected our operations, business strategy, results of operations or financial condition. However, we will continue to face certain risks from ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Disruptions to our information technology systems or our failure to adequately protect critical data, sensitive information and technology systems could materially affect our business or result in harm to our reputation in Item 1A. Risk Factors in Part I of this Annual Report."


text: Our Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of Quanta. The Board oversees management's implementation of our cybersecurity risk management program, receiving regular reports from management (including our Senior Vice President of Technology) on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.


text: Our Senior Vice President of Technology reports to the Chief Financial Officer and leads our IT and cybersecurity functions and has primary responsibility for leading our overall cybersecurity risk management program, supervising both our internal cybersecurity personnel and our external cybersecurity service providers. Our cybersecurity function is responsible for assessing and managing our material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment. Our Senior Vice President of Technology has significant global experience in managing and leading information systems and deploying cybersecurity technologies and holds a cybersecurity certification from a leading cybersecurity training and research institute.


text: Our company maintains a comprehensive Information Security Program ("IS Program") focused on detection, assessment and mitigation of cybersecurity risks. Our dedicated enterprise security team, led by our Chief Information Security Officer ("CISO"), administers the IS Program and is responsible for identification, investigation and response to cyber threats and vulnerabilities. The enterprise security team also implements, manages, and assesses our company's cyber policies, standards and procedures, which leverage our team's expertise and the National Institute of Standards and Technology Cybersecurity Framework. We have developed an incident response plan to handle suspected loss of, or unauthorized access to, information. We regularly conduct tabletop exercises, red team exercises, simulations, and other exercises to evaluate the effectiveness of our IS Program and to position our company for a coordinated, strategic response in the event of an actual security incident. All employees are required to complete cybersecurity trainings and employees in higher-risk roles are required to complete additional customized training tailored to address their specific risk exposure. Our Security Operations Center ("SOC"), which operates 24 hours a day, 365 days a year, is designed to provide visibility of security events across the company and a mechanism for swiftly addressing cyber threats before they compromise data security. Through a combination of a threat management platform and our team of cybersecurity specialists, our SOC continuously monitors and proactively isolates and analyzes cybersecurity alerts to help us address cybersecurity risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: The identification, assessment and management of cybersecurity risks are integrated into our existing enterprise risk management ("ERM") framework. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis, which are presented to and reviewed by the Audit Committee.


text: We engage third-party providers to conduct evaluations of our security controls, including through vulnerability assessments and penetration testing, independent audits or consulting on best practices. These evaluations include testing both the design and operational effectiveness of security controls. Additionally, our internal audit team regularly evaluates the effectiveness of the IS Program, with results reported to the board of directors.


text: We also have policies and procedures in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements on our suppliers, which include maintaining a security management program, complying with information handling requirements, and notifying us in the event of any known or suspected cyber incident. Where appropriate, we assess third-party cybersecurity controls and include security and privacy addenda to our vendor contracts.


text: Our CISO reports directly to our Executive Vice President and Chief Information Officer ("CIO"), who reports to our CEO. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication with and reporting from the enterprise security team, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party assessments. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has 25 years of cybersecurity experience, including having served as Chief Technology Officer/CISO and co-founder of two cybersecurity companies, during which time he provided cybersecurity consulting services to Fortune 500 companies and taught digital and network forensics course at the National Computer Forensics Institute. Prior to joining our company, our CISO served as the Director of Security Services for a large network infrastructure company and our CIO was responsible for network security policies, technology, and operations, including intrusion detection systems and conduct penetration testing, at another large public company. The CIO (and previously, Vice President, Audit and Security) periodically reports to the Audit Committee regarding cybersecurity risk exposure and risk mitigation strategies. The board of directors also may review and assess cybersecurity risks in connection with its review of our company's mission critical risks.


text: While we have not, as of the date of this 2023 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Risk Factors" for more information on our cybersecurity risks.


text: Our company maintains a comprehensive Information Security Program ("IS Program") focused on detection, assessment and mitigation of cybersecurity risks. Our dedicated enterprise security team, led by our Chief Information Security Officer ("CISO"), administers the IS Program and is responsible for identification, investigation and response to cyber threats and vulnerabilities. The enterprise security team also implements, manages, and assesses our company's cyber policies, standards and procedures, which leverage our team's expertise and the National Institute of Standards and Technology Cybersecurity Framework. We have developed an incident response plan to handle suspected loss of, or unauthorized access to, information. We regularly conduct tabletop exercises, red team exercises, simulations, and other exercises to evaluate the effectiveness of our IS Program and to position our company for a coordinated, strategic response in the event of an actual security incident. All employees are required to complete cybersecurity trainings and employees in higher-risk roles are required to complete additional customized training tailored to address their specific risk exposure. Our Security Operations Center ("SOC"), which operates 24 hours a day, 365 days a year, is designed to provide visibility of security events across our Company and a mechanism for swiftly addressing cyber threats before they compromise data security. Through a combination of a threat management platform and our team of cybersecurity specialists, our SOC continuously monitors and proactively isolates and analyzes cybersecurity alerts to help us address cybersecurity risks.


text: Our CISO reports directly to our Executive Vice President and Chief Information Officer ("CIO"), who reports to our CEO. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication with and reporting from the enterprise security team, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party assessments. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has over 25 years of cybersecurity experience, including having served as Chief Technology Officer/CISO and co-founder of two cybersecurity companies, during which time he provided cybersecurity consulting services to Fortune 500 companies and taught a digital and network forensics course at the National Computer Forensics Institute. Prior to joining our company, our CISO served as the Director of Security Services for a large network infrastructure company, and our CIO was responsible for network security policies, technology, and operations, including intrusion detection systems and conduct penetration testing, at another large public company. The CIO periodically reports to the Audit Committee regarding cybersecurity risk exposure and risk mitigation strategies. The board of directors also may review and assess cybersecurity risks in connection with its review of our company's mission critical risks.


text: While we have not, as of the date of this 2024 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Risk Factors" for more information on our cybersecurity risks.


text: The TDS information security program aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Risk assessments are conducted periodically leveraging this standard and are integrated into the TDS Enterprise Risk Management (ERM) program. The assessment results are used to drive continuous improvement in the TDS cybersecurity control environment, as well as to manage potential data security risks of third-party service providers. TDS assesses the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. TDS manages these evolving risks through ongoing investments in the security program including active monitoring of the internal data environment and the environments of third-party service providers who manage sensitive data. In addition, TDS Information Technology leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack. TDS leverages external parties to perform independent assessments and tests of security controls in the environment.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: TDS' Information Technology Security leaders are responsible for assessing and managing cybersecurity risks. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. The TDS environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.


text: The full Board of Directors engages in oversight of TDS' cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and TDS' assessment of cybersecurity threats and mitigation plans. The TDS Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, at least on an annual basis.


text: The TDS information security program is based on a defense-in-depth approach and aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Security control and maturity assessments are conducted periodically leveraging this standard. TDS also leverages internal and external auditors and consultants to perform independent assessments and tests of security controls. The assessment results are used to drive continuous improvement in the TDS cybersecurity control environment, as well as to manage potential data security risks of third-party service providers.


text: TDS identifies risks across the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. Risks related to third-party providers who have access to TDS data and systems are identified, assessed and managed through a formal third-party risk assessment process. Third-parties who access sensitive company or customer information are contractually obligated to meet specific privacy and security requirements. The TDS security operations program includes active monitoring of the internal data environment and regular assessment of the environments of third-party service providers who manage sensitive data. In addition, TDS security leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack and further test potential risks. Identified risks are evaluated against a risk classification framework to direct remediation, mitigation and management efforts based on severity. Cybersecurity risks are integrated into the TDS Enterprise Risk Management (ERM) program with updates provided on a quarterly basis.


text: The TDS Chief Information Security Officer (CISO) and UScellular Senior Vice President of Information Technology are responsible for assessing and managing cybersecurity risks. Each has over twenty years of experience at the company, encompassing network engineering, information technology and cyber security. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. As part of their accountability for incident response, significant incidents are communicated to an internal committee including the Chief Financial Officer and general counsel to assess their materiality and if materiality is confirmed it is reported by the defined process. To date TDS has not identified nor become aware of any cybersecurity incidents that individually or in aggregate have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.


text: The full Board of Directors engages in oversight of TDS' cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and TDS' assessment of cybersecurity threats and mitigation plans. The TDS CISO and UScellular Senior Vice President of Information Technology provide the full Board of Directors an annual update and discussion of the cybersecurity program. The TDS Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. The Audit Committee meets with the TDS CISO and UScellular Senior Vice President of Information Technology at least two times per year. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, typically on an annual basis.


text: As part of our enterprise risk management, we maintain a comprehensive cybersecurity program that proactively monitors, assesses, identifies, mitigates and responds to cybersecurity threats, including threats relating to disruption of business operations or financial reporting systems, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal and reputational risks, and that emphasizes governance and compliance. Our cybersecurity program and related cybersecurity policies are reviewed annually.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Board of Directors Our cybersecurity program is overseen by the independent Audit Committee of our Board. Our Chief Information Security Officer ("CISO") presents a quarterly report of cybersecurity updates to the Audit Committee. Each quarter, the Board receives a report from the Audit Committee chair on items covered during that quarter's meeting. In 2023, the topics included our focus on cybersecurity resilience, our approach to responsible use of Artificial Intelligence and the new cybersecurity disclosure rules. Our Board's and Audit Committee's inputs are key components in the development of our long-term cybersecurity strategy, aligning the program's goals within our risk tolerance.


text: In addition, a biennial cybersecurity risk assessment is completed with an external third party to provide us with a more complete view of our cybersecurity risk. We retain a prominent cybersecurity consulting firm to assist with, and advise on, our cybersecurity and incident response program. We engage on a quarterly basis with our auditors on matters regarding cybersecurity and maintain a robust control environment, in compliance with the Sarbanes-Oxley Act of 2002, as amended, that includes controls to protect the confidentiality, integrity and availability our data.


text: We, along with CoreSite, our data centers operations subsidiary, each maintain a management information security steering committee. We maintain two steering committees because of the distinct nature of CoreSite's business. Each committee works in collaboration with the other, including through the overlap of certain key steering committee members. Each committee meets quarterly. These committees provide direction and support for our and CoreSite's security initiatives and review operational metrics.


text: Our steering committee includes our CISO, our Chief Information Officer, our Chief Risk Officer, our Chief Technology Officer, our Senior Counsel—Corporate Legal, CoreSite's Senior Vice President of IT & Digitization and CoreSite's Vice President of Information Security and IT Infrastructure, each of whom has experience, both at American Tower and in prior roles, related to cybersecurity. Our CISO has 25 years of experience in cybersecurity, previously holding positions in the cybersecurity service provider space and at a software security firm. Our Chief Information Officer has held IT leadership positions across large, multi-national companies for nearly three decades, where he has overseen cybersecurity programs. Our Chief Risk Officer has nearly 40 years of risk and audit experience, including oversight of IT audit, with experience at a leading public accounting firm as well as one of the world's largest computer storage and software companies. Our Chief Technology Officer has over 30 years of experience in the technology space, including leadership roles with wireless carriers and chip manufacturers, where cybersecurity was critical to the delivery of secure solutions. Our Senior Counsel—Corporate Legal also serves as our lead Privacy Officer and is a lawyer who has led our privacy program since its inception. CoreSite's Senior Vice President of IT & Digitization has led CoreSite's IT function for over 5 years, including having responsibility for securing the business's cybersecurity environment. CoreSite's Vice President of Information Security and IT Infrastructure has over 25 years of experience building secure IT solutions across large network and data center environments and has been responsible for the day-to-day operation of CoreSite's business-critical IT environment since 2015.


text: CoreSite's steering committee includes CoreSite's Chief Executive Officer, its Chief Accounting Officer, its Chief Revenue Officer, its Senior Vice President of IT & Digitization, its Vice President of Legal, its Senior Vice President of Development & Product Engineering, its Senior Vice President of Data Center Operations, its Senior Vice President of Human Resources, its Vice President of Compliance & Internal Controls, its Senior Vice President of Finance & Corporate Development, its Vice President of Information Security and IT Infrastructure, its Director of Compliance & Internal Controls, and American Tower's CISO. Each of CoreSite's steering committee members has been chosen based on their understanding of, and participation in, maintaining the rigorous control environment necessary to achieve the list of certifications detailed below.


text: As part of our risk management strategy, we maintain an insurance policy to cover cybersecurity incidents.


text: CoreSite maintains several certifications related to cybersecurity processes for nearly all of its data center facilities, including: (i) System and Organization Controls (SOC) 1 Type 2 examination; (ii) SOC 2 Type 2 examination; (iii) International Organization for Standardization (ISO/IEC 27001); (iv) National Institute of Standards and Technology Publication Series 800-53 (NIST 800-53) attestation based on the high-impact baseline controls and additional Federal Risk and Authorization Management Program (FedRAMP) requirements for a subset of control families applicable to colocation services; (v) Payment Card Industry Data Security Standard (PCI DSS) validation; and (vi) Health Insurance Portability and Accountability Act (HIPAA) attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.


text: Our cybersecurity awareness program provides training for all global employees at onboarding and subsequently three times every year. In 2023, across our organization, employees completed over 16,000 training classes related to cybersecurity. Additionally, in 2023, to elevate cybersecurity awareness, we also conducted live training as part of our Employee Development program, sent monthly phishing tips to all employees and provided weekly communications during October, which is cybersecurity awareness month.


text: Operationally, we, along with CoreSite, each perform periodic penetration testing to identify weaknesses in systems and networks so that they can be addressed appropriately. At least once per year, we also engage an outside cybersecurity firm to perform independent testing. Our vulnerability management program is in place to adequately identify, classify, prioritize and remediate vulnerabilities affecting assets. Our security operations program monitors our systems and networks, and is responsible for investigating, responding to, and reporting any potential security incidents in a timely manner. Our Incident Response Plan includes steps to determine materiality of any such incident and escalate matters to the Board and our employees are regularly trained on the plan. We conduct an incident response exercise at least annually to ensure a timely, consistent and compliant response. In 2023, we performed two separate exercises: (1) a crisis management tabletop exercise that simulated a ransomware incident and included participation from our management, including our CEO and CFO, and (2) an IT-focused tabletop which simulated multiple types of cybersecurity incidents, including (a) compromised credentials, (b) brute force attack, (c) uncleaned malware and (d) ransomware. Both of these tabletop exercises were facilitated by a third-party.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party vendors and service providers. We have in place a Third-Party Cybersecurity Risk Management program to assess the cybersecurity practices of third-party vendors and service providers with access to our and CoreSite's systems or information.


text: We have not been materially impacted by any cybersecurity threats or prior cybersecurity incidents, including with respect to our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks, threats or any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Board of Directors Our cybersecurity program is overseen by the independent Audit Committee of our Board. Our Chief Information Security Officer ("CISO") presents a quarterly report of cybersecurity updates to the Audit Committee. Each quarter, the Board receives a report from the Audit Committee chair on items covered during that quarter's meeting. In 2024, the topics included, among other items, our focus on cybersecurity resilience, new cybersecurity initiatives and our approach to responsible use of artificial intelligence. Our Board's and Audit Committee's inputs are key components in the development of our long-term cybersecurity strategy, aligning the program's goals within our risk tolerance.


text: In addition, a periodic cybersecurity risk assessment is completed with an external third party to provide us with a more complete view of our cybersecurity risk. We retain a prominent cybersecurity consulting firm to assist with, and advise on, our cybersecurity and incident response program. We engage on a quarterly basis with our internal auditors on matters regarding cybersecurity and maintain a robust control environment, in compliance with the Sarbanes-Oxley Act of 2002, as amended, that includes controls to protect the confidentiality, integrity and availability our data.


text: Our steering committee includes our CISO, our Chief Information Officer, our Senior Vice President and Chief Security Officer, our Senior Vice President, Internal Audit, our Chief Technology Officer, our Vice President, Corporate Legal, CoreSite's Senior Vice President of IT & Digitization and CoreSite's Vice President of Information Security and IT Infrastructure. Our CISO has held information security and IT leadership positions across large organizations for eight years, which included overseeing governance and compliance programs. Our Chief Information Officer has held IT leadership positions across large, multi-national companies for nearly three decades, where he has overseen cybersecurity programs. Our Chief Security Officer heads our converged physical and information security team and has over 26 years of experience in the corporate security, crisis management, and security consulting industries, including as head of global security for a major mining company and through leadership positions in several international risk consultancies. Our Senior Vice President, Internal Audit, has over 30 years of international finance leadership experience and heads our Internal Audit function, including the evaluation of risk and vulnerabilities for both physical and system assets and the testing of related controls. Our Chief Technology Officer has over 30 years of experience in the technology space, including leadership roles with wireless carriers and chip manufacturers, where cybersecurity was critical to the delivery of secure solutions. Our Vice President, Corporate Legal also serves as our lead Privacy Officer and is a lawyer who has led our privacy program since its inception. CoreSite's Senior Vice President of IT & Digitization has led CoreSite's IT function for over 5 years, including having responsibility for securing the business's cybersecurity environment. CoreSite's Vice President of Information Security and IT Infrastructure has over 25 years of experience building secure IT solutions across large network and data center environments and has been responsible for the day-to-day operation of CoreSite's business-critical IT environment since 2015.


text: Our cybersecurity awareness program provides training for all global employees at onboarding and subsequently three times every year. In 2024, across our organization, employees completed over 8,943 training classes related to cybersecurity. Additionally, in 2024, to elevate cybersecurity awareness, we also conducted live training as part of our Employee Development program, sent monthly phishing tips to all employees and provided weekly communications during October, which is cybersecurity awareness month.