text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. The responsibility for oversight of risks from cybersecurity threats rests with our entire Board, but the Audit Committee oversees certain cybersecurity related items as described below. At least twice per year the entire Board receives an overview from management on our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, and cybersecurity threat risks or incidents and developments, as well as the steps management took to respond to such risks. Additionally, our Chief Information Officer attends Audit Committee meetings to present cybersecurity information for consideration in financial reporting, as necessary, and attends private Executive Sessions with the Audit Committee. Our Director of Internal Audit reports to the Audit Committee regarding attack and penetration exercise results and remediation. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news or events and discuss any significant updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of matters such as enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters. In 2023, the Board participated in a tabletop exercise associated with cyber threats and in 2024 the Board received a presentation from the former Chief of Staff of the Cybersecurity and Infrastructure Security Agency.


text: At the management level for Southwest Gas, our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by Southwest Gas' President and the Vice President/Information Services/Chief Information Officer, along with the Director of Information Security. A Cybersecurity Executive Committee, consisting of officer-level management appointees representing key areas of our business, exists to maintain situational awareness of cybersecurity risks, support methods of addressing cybersecurity risks, and support the Chief Information Officer's efforts to help Southwest Gas follow natural gas sector-specific regulations and reporting. The Cybersecurity Executive Committee meets regularly with legal advisors and cybersecurity professionals. In our Information Services department, the cybersecurity management team members hold degrees in information technology or cybersecurity and industry-recognized certifications in cybersecurity, and each has many years of relevant work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Cybersecurity team members are expected to keep their knowledge, skills, and training current by participating in industry events and continuing education programs as applicable.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX

secItem: Item 1C


text: These members of management and the Cybersecurity Executive Committee are informed about, and monitor the prevention, mitigation, detection, and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our cybersecurity playbooks and incident response plan outline our procedures, communication protocols, and information escalation processes applicable throughout the lifecycle of a cybersecurity incident. The playbooks and plans cover information flow from discovery of a possible issue through the reporting of it to Information Services management, the Cybersecurity Executive Committee, and Board as necessary. As discussed above, members of management (our President, Chief Information Officer, and Director of Information Security) report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least twice per year, with the Audit Committee receiving more frequent updates as needed to assist in maintaining or enhancing cybersecurity posture in financial reporting, and monitoring attack and penetration testing results.


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.

companyName: Playa Hotels & Resorts N.V.


text: The Company employs a robust system of information technology and cybersecurity controls across its enterprise to assess, identify, and manage material risks from cybersecurity threats. This framework is implemented and overseen by management's information security and compliance department, which is led by the Company's Vice President, IT Security & Compliance. The Vice President, IT Security & Compliance, who reports directly to Senior Vice President, Information Technology, has a Bachelor of Science in Commerce, with concentrations in management information systems and marketing, and has over 30 years' experience in all aspects of IT, including managing development, operations, cyber security, and other key areas. The Senior Vice President, Information Technology, has an Executive Technology Leadership Certificate in IT from Cornell University and has over 25 years of IT experience leading large-scale initiatives to enhance infrastructure and architecture based on emerging technologies and strategies. The Vice President, IT Security & Compliance and Senior Vice President, Information Technology, provide regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements. The Company also has a network of regional information technology directors stationed in each region where our resorts are located, who are integrated into the overall enterprise information technology security and compliance program. The Company references a recognized third-party cybersecurity framework to evaluate and manage cyber risk within the Company. We regularly benchmark against this framework and use the findings to develop our cybersecurity roadmap for ongoing evolution and improvement.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information technology systems, our information security and compliance team utilizes a regularly updated cybersecurity incident response plan ("IRP"). The IRP has been designed taking into account a third-party cybersecurity framework focused on properly containing, investigating, and fully eradicating an incident. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing and resolving the incident as quickly and efficiently as possible, mitigating damage to the Company's systems and networks, minimizing impact on the Company's stakeholders, analyzing and executing upon reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team, including specified external forensic investigators and advisors, will depend on the particular facts and circumstances, the response team is led by the Vice President, IT Security & Compliance or his delegee. The plan also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident. Pursuant to its charter, the Audit Committee of the Board of Directors, which consists solely of independent directors and whose chair has cybersecurity experience, reviews, discusses with management, and oversees the Company's privacy, information technology and security and cybersecurity risk exposures, including: (1) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (2) the programs and steps implemented by management to monitor and mitigate any exposures; (3) the Company's information governance and information security policies and programs; and (4) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. The Audit Committee receives quarterly updates from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team, including a detailed threat assessment relating to information technology and cybersecurity risks as well as short- and long-term plans to mitigate identified risks and invest in new technological solutions and resources to support our cybersecurity program. The Board of Directors also receives updates on cybersecurity matters from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team on at least an annual basis, with periodic updates provided as needed. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.


text: Annually, we offer cybersecurity training programs to our Board. The cybersecurity trainings are designed to provide Board-level insight into cybersecurity strategy, leadership, and management in addition to organizational best practices to prepare, protect and respond against new and emerging cyber security risks and breaches.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Company's cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. These processes and procedures for managing material risks from cybersecurity threats are integrated into the Company's overall enterprise risk management systems and processes.


text: Prevention and Preparation The Company employs a variety of measures to prevent threats related to privacy, information technology and security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, and vulnerability scanning and penetration testing. The Company utilizes industry leading solutions for endpoint detection and response, patch management, email security, network security, and privileged access management to provide a layered approach to data security.


text: Third-party cyber readiness assessments are conducted on a recurring basis and third-party tools are utilized to identify potential vulnerabilities. In addition to the third-party cybersecurity framework referenced above, regular cyber security reviews are conducted with internal audit.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each of our associates is required to complete information security and data privacy training on an annual basis to reinforce awareness of cybersecurity risks to the organization.


text: We recognize that third-parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third-party risk from our vendors that hold financial or customer data, we maintain a vendor code of conduct, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.


text: As discussed above, to support our preparedness we have an IRP that we regularly update, as well as a quick reference checklist and response playbooks with step-by-step actions for significant threat categories. In addition, we perform tabletop exercises and periodic drills at least once a year to test our incident response procedures, identify improvement opportunities and exercise team preparedness. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our cyber defense team, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to our IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible consistent with the procedures in the IRP. Containment procedures may include off-lining systems, including by disconnecting, disabling, or segmenting network access for computers known to be infected or impacted, installing security patches to resolve malware issues or network vulnerabilities, resetting passwords for users with accounts that were breached, or blocking accounts of insiders who may have caused the incident, and coordinating with service providers.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Where appropriate, third-party forensic providers and other managed service providers may be brought in to assist with the investigation and remediation process.


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including a security operations center (SOC) provider, specialists in backup and recovery, a forensic investigation firm, a ransomware recovery vendor, insurance providers and various law firms.


text: Our IRP requires prompt notification of our senior management in the event of a cybersecurity incident that has impacted or is expected to impact the Company and prompt briefings on subsequent developments as appropriate. The IRP also addresses senior management responsibility, subject to Audit Committee oversight, with respect to disclosure determinations related to the cybersecurity incident. The IRP provides for Audit Committee and Board briefings as appropriate.


text: Following the conclusion of an incident, the Company, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and IRP, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party providers. For a discussion of these risks, see "Item 1A–Risk Factors– Cyber risk and the failure to maintain the integrity of internal or guest data could harm our reputation and result in a loss of business and/or subject us to costs, fines, investigations, enforcement actions or lawsuits."


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.


text: The Company employs a robust system of information technology and cybersecurity controls across its enterprise to assess, identify, and manage material risks from cybersecurity threats. This framework is implemented and overseen by management's information security and compliance department, which is led by the Company's Vice President, IT Security & Compliance. The Vice President, IT Security & Compliance, who reports directly to Senior Vice President, Information Technology, has a Bachelor of Science in Commerce, with concentrations in management information systems and marketing, and has over 30 years' experience in all aspects of IT, including managing development, operations, cybersecurity, and other key areas. The Senior Vice President, Information Technology, has an Executive Technology Leadership Certificate in IT from Cornell University and has over 25 years of IT experience leading large-scale initiatives to enhance infrastructure and architecture based on emerging technologies and strategies. The Vice President, IT Security & Compliance and Senior Vice President, Information Technology, provide regular briefings to our senior management team on cybersecurity matters, including threats, events, and program enhancements. The Company also has a network of regional information technology directors stationed in each region where our resorts are located, who are integrated into the overall enterprise information technology security and compliance program. The Company references a recognized third-party cybersecurity framework to evaluate and manage cyber risk within the Company. We regularly benchmark against this framework and use the findings to develop and fine tune our cybersecurity roadmap for ongoing evolution and improvement.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information technology systems, our information security and compliance team utilizes a regularly updated cybersecurity incident response plan ("IRP"). The IRP has been designed taking into account a third-party cybersecurity framework focused on properly containing, investigating, and fully eradicating an incident. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing and resolving the incident as quickly and efficiently as possible, mitigating damage to the Company's systems and networks, minimizing impact on the Company's stakeholders, analyzing and executing upon reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team, including specified external forensic investigators and advisors, will depend on the particular facts and circumstances, the response team is led by the Vice President, IT Security & Compliance or his delegee. The plan also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident. Pursuant to its charter, the Audit Committee of the Board, which consists solely of independent directors and whose chair has cybersecurity experience, reviews, discusses with management, and oversees the Company's privacy, information technology and security and cybersecurity risk exposures, including: (1) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (2) the programs and steps implemented by management to monitor and mitigate any exposures; (3) the Company's information governance and information security policies and programs; and (4) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. The Audit Committee receives quarterly updates from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team, including a detailed threat assessment relating to information technology and cybersecurity risks as well as short- and long-term plans to mitigate identified risks and invest in new technological solutions and resources to support our cybersecurity program. The Board also receives updates on cybersecurity matters from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team on at least an annual basis, with periodic updates provided as needed. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.


text: Annually, we offer cybersecurity training programs to our Board. The cybersecurity trainings are designed to provide Board-level insight into cybersecurity strategy, leadership, and management in addition to organizational best practices to prepare, protect and respond against new and emerging cybersecurity risks and breaches.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Company's cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. These processes and procedures for managing material risks from cybersecurity threats are integrated into the Company's overall enterprise risk management systems and processes.


text: Prevention and Preparation The Company employs a variety of measures to prevent threats related to privacy, information technology and security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, and vulnerability scanning and penetration testing. The Company utilizes industry leading solutions for endpoint detection and response, patch management, email security, network security, and privileged access management to provide a layered approach to data security.


text: Third-party cyber readiness assessments are conducted on a recurring basis and third-party tools are utilized to identify potential vulnerabilities. In addition to the third-party cybersecurity framework referenced above, regular cyber security reviews are conducted with internal audit.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each of our associates is required to complete information security and data privacy training on an annual basis to reinforce awareness of cybersecurity risks to the organization. Updates are provided to associates on an ongoing basis through cybersecurity awareness email campaigns, break room posters, and other methods of communication.


text: We recognize that third-parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third-party risk from our vendors that hold financial or customer data, we maintain a vendor code of conduct, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.


text: As discussed above, to support our preparedness we have an IRP that we regularly update, as well as a quick reference checklist and response playbooks with step-by-step actions for significant threat categories. In addition, we perform tabletop exercises and periodic drills at least once a year to test our incident response procedures, identify improvement opportunities and exercise team preparedness. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our cyber defense team, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to our IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible consistent with the procedures in the IRP. Containment procedures may include off-lining systems, including by disconnecting, disabling, or segmenting network access for computers known to be infected or impacted, installing security patches to resolve malware issues or network vulnerabilities, resetting passwords for users with accounts that were breached, or blocking accounts of insiders who may have caused the incident, and coordinating with service providers.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Where appropriate, third-party forensic providers and other managed service providers may be brought in to assist with the investigation and remediation process.


text: We have relationships with or access to a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including a security operations center (SOC) provider, specialists in backup and recovery, a forensic investigation firm, a ransomware recovery vendor, insurance providers, communications and public relations firms, and various law firms.


text: Our IRP requires prompt notification of our senior management in the event of a cybersecurity incident that has impacted or is expected to impact the Company and prompt briefings on subsequent developments as appropriate. The IRP also addresses senior management responsibility, subject to Audit Committee oversight, with respect to disclosure determinations related to the cybersecurity incident. The IRP provides for Audit Committee and Board briefings as appropriate.


text: Following the conclusion of an incident, the Company, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and IRP, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party providers. For a discussion of these risks, see "Item 1A–Risk Factors– Cyber risk and the failure to maintain the integrity of internal or guest data could harm our reputation and result in a loss of business and/or subject us to costs, fines, investigations, enforcement actions or lawsuits."


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is part of our risk management process. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the Center for Internet Security ("CIS") Critical Security Controls.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: We partner with leading cybersecurity companies and organizations to enhance our cybersecurity infrastructure, leveraging third-party technology and expertise to monitor and optimize the performance of deployed products and services. We also engage with third party firms to help identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards and best practices. We use a third-party provider to supplement the continuous monitoring of our cybersecurity environment and to help coordinate the investigation and remediation of events. Our incident response plan documents the procedures for assessing and managing cybersecurity events, including steps for identifying the nature of a cybersecurity threat (including whether the threat is associated with a third-party provider), as well as assessing the severity of a cybersecurity threat. Our incident response team includes executives, and any material cybersecurity events are reported to our Board. In addition, employees are provided with online training courses to build awareness around potential cybersecurity scams and are tested periodically to maintain their focus in this important area.


text: The information technology group has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. The group reports to our Chief Financial Officer. Our cybersecurity manager, who has held roles in security, infrastructure management, and enterprise information technology management, is responsible for assessing and managing the cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts.


text: The Audit Committee of our Board oversees our cybersecurity risk program and receives regular presentations from management regarding the Company's efforts to monitor and mitigate cybersecurity risks. In addition, cybersecurity risks are reviewed by our Board, at least annually.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. – See Item 1A. Risk Factors – "We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss." for more information about these and other risks related to information security.


text: As a Company that manages midstream infrastructure for the energy sector, cybersecurity is of great concern to our organization, and we aim to protect our systems, networks and programs from digital attacks. We have endeavored to implement policies, standards, and technical controls based on external cybersecurity standards, such as National Institute of Standards and Technology ("NIST") and ISO frameworks. Like others in our industry, we are reliant on the continuous and uninterrupted operation of our various technology systems. User access to our sites and information technology systems are important elements of our operations, as is protection against cybersecurity incidents. In the ordinary course of our business, we collect and store data in our data centers and on our networks, including proprietary business information, critical operating information, among other types of sensitive information. In addition, the information and operational technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. We use various processes and tools, including third-party cybersecurity tools and technologies, to aid us in seeking to secure and protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption, including those processes described below.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: Kinetik has an established Risk Management Policy supported by underlying processes to execute and meet the Company's Risk Management objectives. This Policy is based on the NIST requirements.


text: We conduct assessments across our systems, networks, and data infrastructure to identify, assess and manage potential and material cybersecurity threats and vulnerabilities. These assessments include penetration testing, vulnerability scans, cybersecurity audits, incident response planning, vendor risk assessments, and regulatory compliance assessments. Feedback from these assessments is incorporated into our systems and procedures through upgrades intended to further improve our cybersecurity posture.


text: The Company has established a cybersecurity incident management policy to facilitate the Company's management of cybersecurity incidents. Monitoring and detection systems have been implemented to help identify and remediate cybersecurity threats. All potential security events and/or confirmed security incidents, as appropriate, are reported and logged in to the Company's authorized incident management systems. The Company's incident response team ("IRT"), along with the third-party security system providers, aims to review, analyze, categorize and take action on reported security events. We also have an Incident Response Plan that is designed to be triggered if a security event is identified as a security incident. Consideration shall also be given to individually immaterial incidents that occur as part of a series of related unauthorized occurrences and are material when considered in the aggregate.


text: Furthermore, the Company has established processes for communicating an incident that is determined material, based on the Company's materiality assessment, to the Audit Committee. This process is designed to help implement a containment strategy and to comply with applicable regulations. The Company's Incident Response Plan focuses on the following goals: reduction of damage due to a security incident; identifying potential opportunities for eradication; identifying potential recovery strategies; establishing lesson learned analyses; and identifying mitigation strategies designed to decrease the likelihood of security incident reoccurrence.


text: At Kinetik, we believe that the recognition and reporting of cybersecurity threats by every employee and contractor plays a key role in protecting and securing our network. We have mandatory annual training for our employees and contractors on security awareness annually, using a library of cybersecurity training modules. We deploy quarterly simulated phishing emails to all system users in an effort to gauge their cybersecurity awareness.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. To keep our network secure, we have multifactor authentication (MFA) for all users, a password change policy, separation of duties in accounting systems, controlled access to network drives, endpoint protection, email security, mobile device management, device encryption, and ongoing active monitoring of threats.


text: Index to Financial Statements We have implemented devices designed to control third-party access to our plant systems and also provide 24/7 monitoring of our infrastructure.


text: As part of our strategy, we continue to work with industry leading vendors to conduct our internal network, cloud environment, and external pen testing, all of which are critical as we work to protect our hybrid environment. We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we have established a third-party risk management policy that requires third-party service providers to maintain security requirements and levels of services as part of their service delivery. Before engaging with any third-party service provider, we aim to conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to specific security standards and protocols.


text: The Board's Oversight and Management's Role Our Board has delegated the responsibility for overseeing cybersecurity risk. Our Audit Committee oversees management's assessment and management of cybersecurity risk. Our Senior IT Director, who reports to our Executive Vice President, Chief Administrative and Accounting Officer, leads the Information Technology team, is a member of our management-level. Cybersecurity Governance Committee and management-level Cybersecurity Risk Committee manage our information technology and cybersecurity function.


text: Through the Company's ERM program, our Cybersecurity Governance Committee and Cybersecurity Risk Committee oversee the Company's cybersecurity initiatives. The Cybersecurity Governance Committee is responsible for monitoring, reviewing and reporting to the Audit Committee on cyber incident response. The Cybersecurity Risk Committee is responsible for communication of security incidents to organizational stakeholders.


text: As part of our efforts to facilitate effective oversight, the Cybersecurity Governance Committee and the Cybersecurity Risk Committee hold discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures at least quarterly and more frequently as necessitated by emerging material cyber risks or incidents.


text: Further, to communicate our system health, performance, metrics, and roadmap, the Information Technology team delivers a quarterly update to the Audit Committee, as well as the Cybersecurity Governance Committee and Cybersecurity Risk Committee, to discuss cybersecurity matters such as the effectiveness of our cybersecurity strategy and ensuring alignment with our business objectives. A Cybersecurity Dashboard is used to share metrics and matters needing Board attention in Audit Committee meetings. The Cybersecurity Dashboard also includes commentaries on risk exposure and materiality, if any, as they relate to cybersecurity.


text: Our executive team, in particular, our Senior IT Director and members of our IRT, have relevant degrees in computer information systems and extensive experience and background in network design and configuration, endpoint protection, privileged identity management, device encryption, cloud network and infrastructure, cloud email security, security information and event management (SIEM), and vulnerability assessments. This combined expertise is important to our cybersecurity risk management processes.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remain. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. No security measure is infallible. See "Risk Factors" in Part I—Item 1A of this Annual Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks As a Company that manages midstream infrastructure for the energy sector, cybersecurity is of great concern to our organization, and we aim to protect our systems, networks and programs from digital attacks. We have endeavored to implement policies, standards, and technical controls based on external cybersecurity standards, such as National Institute of Standards and Technology ("NIST") and ISO frameworks. Like others in our industry, we are reliant on the continuous and uninterrupted operation of our various technology systems. User access to our sites and information technology systems are important elements of our operations, as is protection against cybersecurity incidents. In the ordinary course of our business, we collect and store data in our data centers and on our networks, including proprietary business information, critical operating information, among other types of sensitive information. In addition, the information and operational technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. We use various processes and tools, including third-party cybersecurity tools and technologies, to aid us in seeking to secure and protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption, including those processes described below.


text: Kinetik has an established risk management policy supported by underlying processes to execute and meet the Company's risk management objectives. This Policy is based on the NIST requirements.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. To keep our network secure, we have multifactor authentication (MFA) for all users, a password change policy, separation of duties in accounting systems, controlled access to network drives, endpoint protection, email security, mobile device management, device encryption, and ongoing active monitoring of threats. We have implemented devices designed to control third-party access to our plant systems and also provide 24/7 monitoring of our infrastructure.


text: The Board's Oversight and Management's Role Our Board has delegated the responsibility for overseeing cybersecurity risk. Our Audit Committee oversees management's assessment and management of cybersecurity risk. Our Senior IT Director, who reports to our Executive Vice President, Chief Administrative and Accounting Officer, leads the Information Technology team, is a member of our management-level Cybersecurity Governance Committee and management-level Cybersecurity Risk Committee and manages our information technology and cybersecurity function.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remain. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. See "Risk Factors" in Part I—Item 1A of this Annual


text: Index to Financial Statements Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: The Company has a cybersecurity and incident response program designed to assess, identify, and manage material risks from cybersecurity threats, including matters related to the cybersecurity of the Company's critical infrastructure, data, or information technology systems and the Company's actions to prepare for, identify, assess, respond, mitigate and remediate material cyber, information security, or technology risks (collectively referred to as Information Security). This program includes: • operating a Cyber Security Operations Center; • raising employee awareness through annual general and job-specific cybersecurity trainings and employee phishing simulations; • maintaining defined cyber incident response plans; • enhancing security measures to protect our systems and data; • evolving monitoring capabilities to improve early detection and rapid response to potential cyber threats; and • adapting to new work environments that include off-site work through mitigation of remote network risk to our internal systems, assets, or data.

companyName: Vistra Corp.

ticker: VST


text: Cybersecurity represents an important component of the Company's overall approach to enterprise risk management and is integrated into the risk management process and ongoing assessment. In addition to an internal security program, we strive to stay ahead of the threat landscape by working to conduct due diligence on key third-party vendors' Information Security programs and risks. We make strategic investments in our perimeter and internal defenses, cyber security operations center, and regulatory compliance activities with the advice of consultants and third parties. Moreover, to minimize risk, we maintain an insurance policy that provides coverage for matters relating to Information Security.


text: Vistra's Chief Information Officer (CIO) ensures Information Security is built into the Company's larger technology strategy and oversees our Chief Information Security Officer (CISO). Our CISO and his Information Security team are responsible for leading the enterprise-wide information security strategy, policy, standards, architecture, and processes and our Cyber Incident Response Teams under the CISO are responsible for monitoring and analyzing the Company's cybersecurity posture in partnership with Risk and Legal.


text: The CIO and CISO collaborate with our internal audit department and external consultants to review information technology-related risks (based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework) as part of the overall Vistra cyber risk management process. Through these processes, the CIO and CISO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats.


text: We also participate in industry groups and with regulators to gain additional knowledge, including, but not limited to, the Federal Bureau of Investigation, U.S. Cybersecurity and Infrastructure Security Agency, U.S. Department of Homeland Security, Electricity Information Sharing and Analysis Center, U.S. Cyber Emergency Response Team, the NRC and NERC. We apply the knowledge gained through industry partnerships, government organizations, external cyber risk platforms, and program maturity assessments to improve our processes to detect and mitigate cyber threats.


text: As of the date of this report, we have not identified any impacts from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected our results of operation or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information on risks from cybersecurity threats, see Item 1A. Risk Factors.


text: While the Board has established a separate Risk and Sustainability Committee to oversee enterprise risk processes, the Board maintains oversight of Vistra's Information Security. Vistra engaged a third-party advisor to provide cybersecurity oversight and tabletop training to the full Board in 2023 to further our commitment to responsible oversight of cybersecurity risk management. At least quarterly, our CIO reports to the Board on our Information Security program, including cybersecurity risks and threats (including the emerging threat landscape), an assessment of our Information Security program, and the status of projects to strengthen our Information Security program. In furtherance of our commitment to responsible oversight of cybersecurity risk management, in 2023, the Board appointed a director who brings extensive cybersecurity expertise to the Board.


text: Our CIO serves as head of Vistra's Technology Services and is responsible for ensuring the reliability, security, and continued development of the Company's technology platforms and delivering new solutions to support the business. The CIO has served in various senior information technology roles in public companies for over 30 years, including Keurig Dr. Pepper Inc., General Motors, Pfizer, and Electronic Data Systems.


text: Our CISO also has over 35 years of information technology experience. He is a 10-year U.S. Air Force veteran and has held technology positions in infrastructure management and operations with Raytheon and Blockbuster. He also maintains Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.


text: Cybersecurity represents an important component of the Company's overall approach to enterprise risk management and is integrated into the risk management process and ongoing assessment. In addition to an internal security program, we strive to stay ahead of the threat landscape by actively monitoring and conducting due diligence on key third-party vendors' Information Security programs and risks. This includes qualitative assessments to gain a deeper understanding of their security posture and potential vulnerabilities. We make strategic investments in our perimeter and internal defenses, cyber security operations center, and regulatory compliance activities with the advice of consultants and third parties. Moreover, to minimize risk, we maintain an insurance policy that provides coverage for matters relating to Information Security.


text: Vistra's Chief Information Officer (CIO) ensures Information Security is built into the Company's larger technology strategy and oversees our Chief Information Security Officer (CISO). Our CISO and his Information Security team are responsible for leading the enterprise-wide information security strategy, policy, standards, architecture, and processes. Additionally, our Cyber Incident Response Teams under the CISO are responsible for monitoring and analyzing the Company's cybersecurity posture in partnership with Risk and Legal.


text: The CIO and CISO collaborate with our internal audit department and external consultants to review information technology-related risks (based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework) as part of the overall Vistra cyber risk management process. Through these processes, the CIO and CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats.


text: The Sustainability and Risk Committee of the Board has been delegated oversight responsibility of Vistra's Information Security. Vistra periodically engages third-party advisors to provide cybersecurity oversight and tabletop training to the full Board to further our commitment to responsible oversight of cybersecurity risk management. At least quarterly, our CIO reports to the Board on our Information Security program, including cybersecurity risks and threats (including the emerging threat landscape), an assessment of our Information Security program, and the status of projects to strengthen our Information Security program. In furtherance of our commitment to responsible oversight of cybersecurity risk management, in 2023, the Board appointed a director who brings extensive cybersecurity expertise to the Board.


text: Our CISO has over 23 years of information technology experience. He has held technology positions across various areas — including infrastructure management, application management, architecture, operations, and cybersecurity — and brings expertise from Farmers Insurance and Zurich Insurance.


text: Under the oversight of our Executive Security Council, which is chaired by our Senior Vice President of Technology (Certified Information Systems Security Professional), and is also comprised of our Chief Legal Officer, Chief Operating Officer, Chief Accounting Officer and Treasurer and Chief Financial Officer, we have developed and implemented a cybersecurity risk management governance, risk, and compliance ("GRC") program that applies to us as well as our advisor and its affiliates. The GRC program is used to identify, assess, and mitigate findings and risks to our operations from cybersecurity threats. Our GRC program employs qualitative and quantitative assessments of the cybersecurity risk landscape impacting our operations, as identified by our Information Technology ("IT") and Security team to determine likelihood and potential impact. The analysis is evaluated by our Executive Security Council, and subject to the oversight of our board of directors to assess and prioritize potential risk to our information security. We consider cybersecurity, along with other top risks, within our enterprise risk management and GRC framework.

companyName: Cottonwood Communities, Inc.


text: We have established a multilayer cyber threat defense program that enables us to identify, protect, detect, respond, and recover from cyber threat findings, taking appropriate action to prevent these threats from turning into risk. Part of this security program is an incident response plan, the goal of which is to provide a timely response, mitigate any damage, restore services, preserve evidence, evaluate risk impact, communicate effectively to all stakeholders, and ultimately reduce the likelihood of an incident recurrence through proper containment and retrospective.


text: We engage third party consultants to conduct cybersecurity assessments and help mature the information security program. We regularly review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the board of directors, and we may adjust our cybersecurity program and practices as necessary based on the information provided by these assessments, audits and reviews. We review and test our information security systems, including regular penetration tests of our network. We also use third-party systems to monitor our information security continually.


text: For any of our critical hosted applications we require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, or the report is qualified, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: We regularly evaluate our overall security risk posture to ensure appropriate security controls are in place to ensure confidentiality, integrity, and availability of the firms processing environment, including our business strategy, results of operations or financial condition, to ensure that we have an appropriate security program in place in order to manage materiality. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information, see "Item 1A. Risk Factors – Breaches of our data security could materially harm us, including our business, financial performance and reputation."


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Executive Security Council periodically reports to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment, and programs in place to address and mitigate the risks associated with the evolving cybersecurity threat landscape. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to any cybersecurity incidents. Material cybersecurity events, if any, are escalated to our full board of directors on an ongoing basis as necessary.


text: Our Executive Security Council governs our overall cybersecurity function and is responsible for developing and implementing our information risk program and managing our response to threats in collaboration with our IT and Security team, subject to oversight by our board of directors. Our Executive Security Council meets regularly regarding the risks of any cybersecurity incidents which are reported pursuant to (i) criteria set forth in our information risk program, (ii) notification criteria set forth in our contracts with third-party service providers and (iii) reports prepared by consultants, auditors, and other third parties retained by us, if necessary, to investigate cybersecurity incidents. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT and Security team, including the third-party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: The Company's Senior Vice President of Technology's relevant cybersecurity expertise includes Certified Information Systems Security Professional designation (CISSP), ISO 27001 as well as over 20 years of experience as a technology and security professional.


text: Under the oversight of our Executive Security Council, which is chaired by our Senior Vice President of Technology (Certified Information Systems Security Professional), and is also comprised of our Chief Legal Officer, Chief Operating Officer, Chief Accounting Officer and Treasurer and Chief Financial Officer, we have developed and implemented a cybersecurity risk management governance, risk, and compliance ("GRC") program that applies to us as well as our advisor and its affiliates. Our GRC program is used to identify, assess, and mitigate findings and risks to our operations from cybersecurity threats. Our GRC program employs qualitative and quantitative assessments of the cybersecurity risk landscape impacting our operations, as identified by our Information Technology ("IT") and Security team, to determine likelihood and potential impact. The analysis is evaluated by our Executive Security Council, and subject to the oversight of our board of directors to assess and prioritize potential risk to our information security. We consider cybersecurity, along with other top risks, within our enterprise risk management and GRC framework.


text: We engage third-party consultants to conduct cybersecurity assessments and help mature the information security program. We regularly review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors, and we may adjust our cybersecurity program and practices as necessary based on the information provided by these assessments, audits and reviews. We review and test our information security systems, including regular penetration tests of our network. We also use third-party systems to monitor our information security continually.


text: We regularly evaluate our overall security risk posture to ensure appropriate security controls are in place to ensure confidentiality, integrity, and availability of the firms processing environment, including our business strategy, results of operations or financial condition, to ensure that we have an appropriate security program in place in order to manage materiality. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information, see " Item 1A. Risk Factors – Breaches of our data security could materially harm us, including our business, financial performance and reputation."


text: Our Senior Vice President of Technology's relevant cybersecurity expertise includes Certified Information Systems Security Professional ("CISSP") designation, ISO 27001 as well as over 20 years of experience as a technology and security professional.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere through our service agreements with them, as further discussed in Note 13—Related Party Transactions of our Notes to Consolidated Financial Statements, and Cheniere's board of directors (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Cheniere Corpus Christi Holdings, LLC


text: As part of its broader approach to risk management, Cheniere's cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Cheniere's strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, Cheniere routinely evaluates opportunities to refine its cybersecurity program in order to mitigate operational network risks. Cheniere includes business continuity planning as a component of its strategy to help ensure critical systems are available to support the Company in the instance of a disruptive event. Cheniere also participates in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also strives to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.


text: Risks that could affect us are an integral part of Cheniere's Board and Audit Committee deliberations throughout the year. Cybersecurity risks are integrated into Cheniere's enterprise risk assessment process, which is reviewed by Cheniere's Board at least annually. Cheniere's Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while Cheniere's Audit Committee has been delegated the authority to oversee and periodically review the security of Cheniere's information technology systems and controls, including programs and defenses against cybersecurity threats. Cheniere's Audit Committee discusses with Cheniere's management its cybersecurity risk exposures and the steps Cheniere's management has taken to mitigate such exposures, including its risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates Cheniere's Audit Committee on the overall status of its cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Project, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere through our service agreements with them, as further discussed in Note 11—Related Party Transactions of our Notes to Consolidated Financial Statements, and Cheniere's board of directors (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Project, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Liberty Energy Inc.

ticker: LBRT


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide practice of cybersecurity risk management. This integration ensures that cybersecurity considerations are part of our decision-making processes. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to identify, assess, and manage material risks from cybersecurity threats. As part of our cybersecurity risk management process, we have conducted simulated cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness.


text: Engagement of Third-Parties Recognizing the complexity and evolving nature of cybersecurity threats, we may periodically engage a range of external experts, including cybersecurity assessors, consultants, and auditors to evaluate and test our information systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes generally follow industry-recognized standards and frameworks, and are compliant with applicable laws.


text: Oversight of Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of critical third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Information Officer ("CIO") and cybersecurity staff and advisors. This approach is designed to mitigate risks related to data breaches or other security incidents involving third-parties.


text: Risks from Cybersecurity Threats We have experienced, and may in the future experience, directly or indirectly through our third-party service providers, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For more information about the cybersecurity risks we face, see "We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors has designated the Audit Committee to oversee risk management associated with cybersecurity threats. The Audit Committee is comprised of board members with diverse expertise including risk management, technology, and finance, which we believe enables them to oversee cybersecurity risks.


text: We have a cybersecurity risk management committee comprised of senior leadership, including our CIO. The committee evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. The Company's cybersecurity risk management committee is also responsible for informing the Audit Committee on cybersecurity risks. The committee provides briefings to the Audit Committee on at least a quarterly basis, performs a comprehensive annual review of cybersecurity risks and threats, and assesses and adjusts the Company's processes to prevent, detect, mitigate, and remediate any such risks and threats.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO. With over 30 years of experience in the field of information systems and cybersecurity, our CIO brings a wealth of expertise to this role. His background includes extensive experience as an enterprise CIO and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program as such items relate to cybersecurity. Our CIO manages our cybersecurity risks with the help of key personnel overseeing cybersecurity, information technology networks and infrastructure, operational technology, and critical software applications.


text: Our CIO and information technology team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CIO and information technology team implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO and information technology team are equipped with a well-defined incident response plan, which includes escalation to the cybersecurity risk management committee and the Audit Committee, and relevant public disclosure, as appropriate.


text: Our Board of Directors (the "Board") has designated the Audit Committee to oversee risk management associated with cybersecurity threats. The Audit Committee is comprised of board members with diverse expertise including risk management, technology, and finance, which we believe enables them to oversee cybersecurity risks.


text: We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, point-of-sale processing at our retail sites, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek US Holdings, Inc.

ticker: DK


text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. Delek collaborates with third-party vendors to leverage managed security services, enhancing Delek's cybersecurity capabilities. Delek possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. Delek continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: The Board of Directors and executive leadership team at Delek are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the company's resiliency against cyber threats. To assist in these efforts, the Board of Directors has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology & Data Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows recognized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention designed to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek conducts mandatory security awareness programs, including required training and phishing campaigns for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for the years ended December 31, 2024, 2023 and 2022. Delek continuously assesses and enhances the confidentiality, integrity, and availability of its IT and OT assets.


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021, the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, providing oversight of cybersecurity risks at the highest levels of our organization. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Data Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted periodically. Management conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires also receive training in response to drills and simulated attacks.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: We recognize that third-party service providers introduce cybersecurity risks to our business. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols, as applicable.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management activities. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks to us or third parties with whom we do business. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity, information security and information technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our Board of Directors in exercising oversight of the Company's cybersecurity, information security and information technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of emerging cybersecurity incidents to our Audit Committee, who in turn reports to our Board of Directors.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with management to proactively review current cybersecurity threats as well as our potential exposure. Our CAO, supported by members of our management team and information technology group, briefs the Audit Committee on cybersecurity matters as needed and holds discussions on cybersecurity risks, incident trends and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.