text: Risk Management, Strategy, and Governance Cybersecurity Integration with overall risk management Cleco's business operations rely on complex and evolving operational and information technology systems and network infrastructures. Digital information, information technology, and automation are essential components of Cleco's operations and growth strategy. Cleco continues to assess its cybersecurity tools and processes and has taken a variety of actions to monitor and address cyber-related risks. These cybersecurity tools and assessments are embedded in Cleco's overall enterprise risk management system. Cleco utilizes the following tools, methodologies, and standards to assess, identify, and manage material cybersecurity risks: • NERC CIP standards, which protect Cleco's operational technology and National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which provides frameworks to protect Cleco's operational and information technology, • Sarbanes-Oxley Act (SOX) regulations, which require Cleco to maintain access and security controls for certain systems that are essential to the completeness and accuracy of financial reporting, • internal and third-party assessments to identify, monitor, and defend against prioritized risks, • a unified Cybersecurity Incident Response Plan (CSIRP), • a Security Operations Center managed 24 hours a day by a third party, • other cybersecurity suppliers, and • relationships with various local, state, and federal law enforcement agencies.


text: Processes to assess, identify, and manage material risks Cleco has processes and procedures in place to ensure its cybersecurity program is operating effectively. Members of Cleco's EMT routinely review its cybersecurity strategy, policy, program effectiveness, standards enforcement, and cybersecurity issue management. Cleco conducts risk assessments and compliance audits against standards including the NIST CSF, NERC CIP, and SOX. Cleco also engages with a variety of independent third parties, such as assessors, consultants, and auditors, for periodic audits and reviews of cybersecurity threats and related controls, including review of periodic penetration tests, regular patch reviews from vendors listing relevant risks, industry alerts and forums, and tabletop exercises. These assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization. Cleco also utilizes its Internal Audit department to review its cybersecurity program, in which findings are reported to the Audit Committee.

companyName: Cleco Corporate Holdings LLC

secItem: Item 1C


text: Cleco's CSIRP helps ensure a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting Cleco. This response plan includes detection, analysis, containment, eradication, recovery, post-incident review, and timely notice to relevant stakeholders, including Cleco's Audit Committee, once an incident is deemed to be potentially impactful or material.


text: Cleco maintains a formal cybersecurity training program for all employees that includes training on matters such as data protection, phishing, email security best practices, and broader cybersecurity themes such as insider threats, vishing, ransomware, and third-party risk. Cleco also provides specialized security training for certain other employee roles.


text: Processes to oversee and identify material risks associated with use of third-party service providers Cleco implemented and is optimizing processes to manage the cybersecurity risks associated with its use of third-party software service providers. Additionally, Cleco proactively reviews and updates all third-party software service contracts upon renewal for potential amendments related to security, confidentiality, and recourse in the event of a negligent incident, such as a breach, loss, or unauthorized use of Cleco's data. These measures provide the structure for managing Cleco's cyber-related risks.


text: Management's oversight Cleco maintains a cybersecurity program overseen by its Chief Administrative and Sustainability Officer, EMT, and Audit Committee that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of information. This program is integrated within Cleco's enterprise risk management program, which utilizes the Enterprise Risk Management Committee to collaboratively manage and advance enterprise-wide risk management processes. Cleco's Disclosure Committee, which is comprised of EMT and the Chief Accounting Officer, is the means in which cybersecurity matters are assessed for disclosure requirements. Cleco's EMT sets enterprise risk strategies and makes risk-informed decisions that include the assessment and response to cybersecurity risk. Management engages in quarterly discussions with the Audit Committee regarding incidents of any magnitude experienced during the quarter, strategies and significant risk exposures, as well as the measures implemented to monitor and control these risks. These discussions may include the results of internal and third-party risk assessments and audit results, and management's plans to improve its cybersecurity posture using a risk-based approach.


text: Cleco's cybersecurity team, overseen by the Chief Administrative and Sustainability Officer, has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. Members of this team have extensive technical and leadership experience in federal and/or private sector environments as well as industry-recognized cybersecurity certifications. This team relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Cleco. Cleco's Audit Committee oversees the management of its cybersecurity risk and is responsible for communicating cyber-related incidents to its Boards of Managers.


text: Risks and previous events with material effects It is possible that Cleco's information technology systems and networks, or those managed by third parties, could have vulnerabilities and those vulnerabilities could go unnoticed for a period of time. Cleco may also be exposed to, and adversely affected by, interruptions to its computer and information technology systems, and sophisticated cyberattacks, including cybersecurity threats and vulnerabilities in its systems, malware, and attacks targeting its information technology systems and networks. Any such prior events, to date, have not had a material impact on Cleco's results of operations, financial condition or cash flows. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls Cleco has implemented and is implementing, or which Cleco causes or has caused third party providers to implement, will be sufficient to protect its systems, information or other property. For more discussion of potential cyber threats that may affect Cleco, see Item 1A, "Risk Factors — Operational Risks — Technology, Nation-State, and Hacktivist Threats."


text: The Board regularly discusses our most significant risks and how these risks are being managed. The Board has appointed a Risk Committee, consisting entirely of independent directors, whose responsibilities include assisting the Board in overseeing management's identification and evaluation of strategic enterprise risks, including risks associated with privacy, technology, information security, cybersecurity and cyber incident response and business continuity. The Risk Committee regularly updates the Board on these activities.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: The Risk Committee oversees the Company's approach to cybersecurity risk assessment and mitigation by, among other things, (i) reviewing the Company's cybersecurity insurance program, (ii) reviewing the Company's cybersecurity budget, (iii) discussing the results of various internal cybersecurity audits and periodic independent third-party assessments of the Company's cybersecurity programs, (iv) being briefed on cybersecurity matters by outside experts, and (v) receiving regular updates from the Company's Chief Information Security Officer ("CISO") and others on cybersecurity risks, operational metrics, compliance and regulatory developments, training programs, risk mitigation activities, key projects and industry developments. The Company's Chief Legal and Compliance Officer ("CLCO"), Chief Digital and Technology Officer ("CDTO"), CISO and Vice President of Compliance and Internal Audit participate in Risk Committee meetings and meet individually with the Risk Committee on a periodic basis to discuss and address relevant matters, including the Company's approach to cybersecurity risk assessment and mitigation. The CISO reports to the CDTO, who in turn reports to the Chief Executive Officer ("CEO"). The CISO has more than thirty years of IT experience, has served many years in various information security management roles and has multiple cybersecurity certifications.


text: The Company maintains an enterprise risk management process designed to identify potential events that may affect the achievement of the Company's objectives or have a material adverse effect on the Company. Cybersecurity is among the risks considered as a part of this process. The Company's management, including the CISO, also participates on the Company's Information Security & Privacy Governance Council ("ISPGC"). The ISPGC meets periodically to consider information security and privacy matters.


text: The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management and, depending on facts and circumstances, may include internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks.


text: We interact with the information technology networks and systems of third parties for many aspects of our business. We consider and evaluate cybersecurity risks associated with the use of independent third-party service providers. To help UPS understand and mitigate potential cybersecurity risks, we generally utilize measures such as vendor risk assessments, periodic technical assessments of third-party vendors' controls and contracts governing the use of and access to our data and compliance with our security requirements.


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO, the Risk Committee and the Board, and a process for consideration of whether a cybersecurity incident is material and may require disclosure in SEC filings.


text: For additional information on cybersecurity risks and the impact they may have on our business strategy, results of operations or financial condition see "Risk Factors – Business and Operating Risks – A significant cybersecurity incident, or increased data protection regulations, could materially adversely affect us".


text: The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management. These processes also include, depending on facts and circumstances, internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks.


text: The Company interacts with the information technology networks and systems of third parties for many aspects of our business. We consider and evaluate cybersecurity risks associated with the use of independent third-party service providers. To help UPS understand and mitigate potential cybersecurity risks related to third parties, we generally utilize measures such as vendor risk assessments, periodic technical assessments of third-party vendors' controls and contracts governing the use of and access to our data and compliance with our security requirements.


text: Agilent is committed to maintaining a secure environment for our data, complying with applicable legal requirements, and effectively supporting our business objectives and customer needs. Our cybersecurity strategy emphasizes the cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention, detection of, and response to cybersecurity threats.

companyName: AGILENT TECHNOLOGIES, INC.

ticker: A


text: Key Elements of Our Cybersecurity Program. We maintain cybersecurity policies that articulate Agilent's expectations and requirements regarding technology use, data privacy, risk management, and incident management. Regular exercises and assessments against recognized cybersecurity frameworks are conducted to improve the effectiveness of our processes. These are conducted by third party organizations in addition to internal audit teams. Cybersecurity is considered the responsibility of every Agilent employee, with regular education and best practice sharing to raise awareness of threats. Layered controls are implemented to prevent and detect cybersecurity threats, with policies and processes designed to provide timely notifications and compliance with legal requirements. These include controls to assess third party suppliers and their services.


text: Our cybersecurity program under the Chief Information Officer ("CIO") is led by our Chief Information Security Officer ("CISO"). The Board of Directors delegates oversight of cybersecurity risks to the Audit Committee, which receives updates from the CISO and CIO at least annually. Cybersecurity is integrated into the risk management process for the company through various mechanisms, including quarterly business reviews, annual budget planning, and linkage to the Enterprise Risk Management ("ERM") process.


text: As of the date of this report, we do not believe any risks from cybersecurity threats have materially affected Agilent, including our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be any incidents in the future or that they will not materially affect us as outlined in Item 1A. Risk Factors.


text: Our cybersecurity program under the Chief Information Officer ("CIO") is led by our Chief Information Security Officer ("CISO"), both of whom have over 20 years of experience managing and securing global enterprises. The Board of Directors delegates oversight of cybersecurity risks to the Audit Committee, which receives updates from the CISO and CIO at least annually. Cybersecurity is integrated into the risk management process for the company through various mechanisms, including quarterly business reviews, annual budget planning, and linkage to the Enterprise Risk Management ("ERM") process.


text: Cybersecurity risks are classified as a Tier 1 risk within our enterprise risk management program. We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement numerous cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, detailed incident response plans, and other advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate insider threats. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations. In some instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Our cybersecurity program employs various risk-tracking tools, industry data, monitoring, detection and response tools, vulnerability scanning, security dashboards and scorecards and other tools to support our continued evaluation of cybersecurity threats and regulatory requirements. Our cybersecurity program addresses the continuously evolving and extensive attack vectors and methods through layered security controls informed by constant threat analysis. Threats include a wide variety of perpetrators aiming for political, personal or financial gain, utilizing a broad set of tactics including ransomware, advanced malware, DDoS, account takeover, phishing/SMSing and social engineering, among others. These risks threaten our internal systems as well as third-party systems that we use and rely upon for the delivery of services and support of our operations. Our risk mitigation techniques include technology risk management, network segmentation, deployment of enhanced detection tools across our network, systems, databases, and applications and monitoring compliance with security standards.


text: Various security standards provide guidance to telecommunications companies in order to help identify and mitigate cybersecurity risks, including the voluntary framework released by the National Institute for Standards and Technology ("NIST") in 2014 and updated in 2018, in cooperation with other federal agencies and owners and operators of U.S. critical infrastructure. The NIST cybersecurity framework provides a prioritized and flexible model for organizations to identify and manage cyber risks inherent to their business. Our security infrastructure is comprised of multiple security capabilities designed with a defense-in-depth model informed by the NIST cybersecurity framework, as well as a variety of other industry standards and best practices. The risk-based approach of the NIST cybersecurity framework has enabled us to implement cybersecurity programs tailored to our particular network architectures, customer environments and institutional resources.


text: Our cybersecurity risk management program also attempts to assess third-party vendor, service provider, business partner and supply chain risk management issues. Our efforts aim to better understand the cybersecurity posture of our third-party vendors, service providers, business partners and suppliers by analyzing their cybersecurity risk management programs. Our third-party cybersecurity risk management processes include reviewing and revising our service provider and vendor management programs and the related agreements to require prompt notification of cyber incidents, outages and software vulnerabilities to facilitate timely assessment and disclosure of third-party cyber risks. Generally, our agreements require our third-party providers to abide by specific privacy, confidentiality and security processes, particularly for third-party data-processing activities. For vendors that offer software as a service solutions involving personal information, our third-party risk management program generally requires third-party attestation of their security practices such as a System and Organization Controls 2 report or ISO 27001 certification. Our due diligence and selection processes also require third parties to complete a cybersecurity and data privacy questionnaire that includes questions about contractor track record. Our third-party security reviews are limited by their disclosures; therefore, a risk-based approach is used in making vendor and contractual decisions based on those disclosures and the totality of the circumstances, such as whether the third party will have access to personal information or our network.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: Our organizational objectives are aligned to address our cybersecurity risks and management plays a pivotal role in assessing and managing our material risks from cybersecurity threats. Management's role in assessing and managing material cybersecurity risks includes various management positions and committees responsible for assessing such risks. Our internal processes require escalation of material cybersecurity risks to our executive leadership and Charter's Board of Directors, as well as management and committees who are tasked with the prevention, detection, mitigation and remediation of cybersecurity incidents. These processes provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification to a state and/or federal agency or affected customers.


text: Charter's Board of Directors has delegated to the Audit Committee oversight of our privacy and data security, including cybersecurity, risk exposures, policies and practices, including the steps management have taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. Charter's Audit Committee receives quarterly updates on the enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates or internal audit observations, if applicable.


text: We have a unified cybersecurity leadership team, composed of members of our Security Executive Steering Committee ("Security ESC") to oversee implementation of appropriate cybersecurity protections and promote accountability. The Security ESC is led by senior executives in our information technology ("IT") and network operations groups and is comprised of senior executive leaders across the organization with the goal of driving cybersecurity focus through not just technical teams, but the entire business. The Security ESC reviews and evaluates current cyber threats and risks and improvements to our program and provides quarterly updates to the Chief Executive Officer as well as ad hoc updates on urgent matters. We also have a Cyber Security Council ("CSC") and Security Operations Steering Committee that, under the direction of the Security ESC, collectively focus on cybersecurity across Charter and the overall protection of our internal network and related processes, policy, training and actions to protect customer and employee data. The CSC is comprised of senior leaders across the organization and operates under the auspices of the Security ESC, which is ultimately accountable under our enterprise risk management program for cybersecurity.


text: The executive team members overseeing our cybersecurity program are Magesh Srinivasan, Executive Vice President, Network Operations, and Jake Perlman, Executive Vice President, Software Development & IT. Our Security Operations Center and Security Compliance teams (including Software Development and IT and Network Security Operations) are unified under our Chief Information Security Officer, Greg Temm, to provide a centralized view of our risk posture to prevent vulnerabilities and more effectively manage cybersecurity threats across the enterprise.


text: Mr. Srinivasan is responsible for network operations across our 41-state footprint. He joined Charter in 2016, and most recently served as Senior Vice President in Network Operations, first in Core and Backbone Operations and most recently in Video Operations. Prior to that, he served in several senior engineering roles at Time Warner Cable Inc. ("TWC"), including as Group Vice President of Commercial Engineering and Operations, Vice President of Commercial Engineering for TWC's West Region, and Director in the Texas Region. Mr. Srinivasan began his career at Sprint Corporation in a series of engineering roles with increased responsibility. He received a bachelor of science from Anna University, a master's degree and doctorate in materials science from Kansas State University, and a master's degree in business administration from the Graduate School of Business at the University of Kansas.


text: Mr. Perlman leads software development, security, technical integration, and IT. His scope includes software design and development for customer service agent, field technician, and customer self-service applications. Mr. Perlman joined Charter as a Senior Vice President in 2016, initially overseeing Video and Shared Software Services. He added Video Engineering, Voice Engineering, Lab Infrastructure and Deployment Support to his team in 2019. Before joining Charter, Mr. Perlman served as Chief information Officer for Bright House Networks, where he oversaw all of IT including Billing System Management, Software Development, Online Development, Internal IT, Information Security, and other functions. Prior to that, he held various IT roles at CenturyLink. Mr. Perlman holds a bachelor of arts from Brown University and a master of business administration from the University of Colorado – Boulder Leeds School of Business.


text: Mr. Temm joined Charter in 2020 as Group Vice President, IT Security, where he maintained responsibility for cybersecurity across our IT infrastructure, leading cyber threat intelligence, vulnerability management, security operations, incident response, information security engineering and architecture, risk management and security awareness. Previously, Mr. Temm was Chief Information Risk Officer for the Financial Services-Information Sharing and Analysis Center (FS-ISAC) where he collaborated with global financial services companies – foremost cybersecurity providers, law enforcement and government agencies – to protect the financial services sector against cyber and physical threats while coordinating responses to sector-wide incidents. Prior to FS-ISAC, Mr. Temm spent nearly two decades with Mastercard, serving in various leadership roles in cybersecurity, corporate security, network operations and debit operations. He holds a bachelor of science in business administration from Lindenwood University, where he graduated with Great Distinction. He is also a Certified Information Systems Security Professional ("CISSP").


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. For further discussion of cybersecurity risks, see "Part I. Item 1A. Risk Factors – Risks Related to Our Business – Various events could disrupt or result in unauthorized access to our networks, information systems or properties and could impair our operating activities and negatively impact our reputation and financial results."


text: We have a unified cybersecurity leadership team, composed of members of our Security Executive Steering Committee ("Security ESC") to oversee implementation of appropriate cybersecurity protections and promote accountability. The Security ESC is led by senior executives in our information technology ("IT") and technology operations groups and is comprised of senior executive leaders across the organization with the goal of driving cybersecurity focus through not just technical teams, but the entire business. The Security ESC reviews and evaluates current cyber threats and risks and improvements to our program and provides quarterly updates to the Chief Executive Officer as well as ad hoc updates on urgent matters. We also have a Cyber Security Council ("CSC") and Security Operations Steering Committee that, under the direction of the Security ESC, collectively focus on cybersecurity across Charter and the overall protection of our internal network and related processes, policy, training and actions to protect customer and employee data. The CSC is comprised of senior leaders across the organization and operates under the auspices of the Security ESC, which is ultimately accountable under our enterprise risk management program for cybersecurity.


text: Our Executive Vice President, Technology Operations and our Executive Vice President, Software Development & IT collectively oversee our cybersecurity program. Our Executive Vice President, Technology Operations is responsible for operating our customer product technology infrastructure across our 41-state footprint. He has served in various network operations roles at Charter since 2016 and previously held various engineering roles at other large public companies. Our Executive Vice President, Software Development & IT leads software development, security, technical integration, and IT. He has served in various software and engineering roles at Charter since 2016, and has previously held various IT roles, including chief information officer, at other telecommunications companies.


text: Our Chief Information Security Officer ("CISO") is a Certified Information Systems Security Professional and has served in various roles in information security at Charter since 2020. He has over two decades of experience in cybersecurity, corporate security and network operations, including cyber threat intelligence, vulnerability management, security operations, incident response, information security engineering and architecture, risk management and security awareness.


text: We have an established security program and framework based on ISO/IEC 27001 ("Security Program") and maintain ISO/IEC 27001:2013, SOC 1 Type 2, and SOC 2 Type 2 certifications. The Security Program has been established to allow management oversight of cybersecurity risks, institute directives and principles for information security, ensure alignment to regulatory and contractual cybersecurity obligations, and enable timely incident response and remediation.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Our information and security team, led by our Chief Information Security Officer ("CISO"), have implemented and continue to maintain various technical, physical, and administrative processes, policies, and standards as the foundation of our Security Program, which are designed to help us manage and mitigate risks from cybersecurity threats, including, but not limited to, incident detection and response plans, vulnerability management processes, risk assessments, disaster recovery and business continuity plans, access controls, asset management, logging and monitoring, security awareness training, and third-party risk management programs.


text: Our CISO and information security team actively monitor and evaluate our networks, systems, data, and security risk profile to identify and assess cybersecurity risks. The information security team uses a variety of methods to identify and assess these risks, including, conducting networks scans, using manual and automated tools, conducting vulnerability and maturity assessments, and subscribing to services and reports providing threat intelligence.


text: In addition, we use a variety of third-party service providers to support and execute on our Security Program. These third parties provide cybersecurity consulting services, cybersecurity software, penetration testing, audits, and other professional services to aid us in identifying, assessing, and managing risks from cybersecurity threats.


text: Our Security Program is managed by our Executive Security Steering Committee ("ESSC"), comprised of selected members of leadership, including our CISO, which assesses and manages any material risks from cybersecurity threats. The CISO and security team provide regular updates to the ESSC on our Security Program and, in accordance with our security incident response plan, escalate applicable cybersecurity threats or incidents to the ESSC for review and management. SPS COMMERCE, INC.


text: Our Audit Committee of our board of directors oversees our risk management processes related to cybersecurity risks and is regularly informed of such risks through presentations or reports from our CISO. In addition, our security incident response plan includes reporting certain cybersecurity incidents to our Audit Committee. Finally, our board of directors reviews cybersecurity risks on an annual basis, including discussing with management and members of the ESSC our strategy surrounding prevention, detection, mitigation, and remediation of potential security threats. While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business, financial condition, or results of operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Our information security team has implemented and continues to maintain various technical, physical, and administrative controls as the foundation of our Security Program, which are designed to help us identify, manage, prevent, and mitigate risks from cybersecurity threats, including, but not limited to, incident detection systems and response plans, vulnerability management tools and processes, risk assessments, disaster recovery and business continuity plans, access controls, asset management, logging and monitoring, security awareness training, and third-party risk management programs.


text: Our information security team actively monitor and evaluate our networks, systems, data, and security risk profile to identify and assess cybersecurity risks. We use a variety of methods to identify and evaluate these risks using manual and automated tools and processes, including, network scans, vulnerability and maturity assessments, and subscribing to services and reports providing threat intelligence. In doing so, risks are assessed for criticality, prioritized in context of our business, and communicated to stakeholders for engagement as needed.


text: We use a variety of third-party service providers to support and execute on our Security Program. These third parties provide cybersecurity consulting services, cybersecurity software, penetration testing, audits, and other professional services to aid us in identifying, assessing, and managing risks from cybersecurity threats.


text: The Security Program is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2023, has over 10 years of experience leading cybersecurity programs in a large, publicly traded, international enterprise, and is a Certified Information Systems Security Professional ("CISSP"). Our Executive Security Steering Committee ("ESSC"), comprised of selected members of leadership, assesses and manages any material risks from cybersecurity threats and manages our Security Program. The CISO and information security team provide regular updates to the ESSC on our Security Program and, in accordance with our security incident response plan, escalate applicable cybersecurity threats or incidents to the ESSC for review and management. SPS COMMERCE, INC.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business, financial condition, or results of operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Our Audit Committee of our board of directors oversees our risk management processes related to cybersecurity risks and is regularly informed of such risks through presentations or reports from our CISO. Through committee reports, the Audit Committee apprises the full board of directors of any significant cybersecurity updates. In addition, our security incident response plan includes reporting certain cybersecurity incidents to our Audit Committee. Finally, our board of directors reviews cybersecurity risks on an annual basis, including discussing with management, our CISO, and members of the ESSC our strategy surrounding prevention, detection, mitigation, and remediation of potential security threats.


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall enterprise risk management processes. The processes for assessing, identifying and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include identifying the relevant assets that could be affected, determining possible threat sources and threat events, assessing threats based on their potential likelihood and impact, and identifying controls that are in place or necessary to manage and/or mitigate such risks.

companyName: DEXCOM INC

ticker: DXCM


text: We have established cybersecurity and privacy programs to maintain the confidentiality, integrity, availability, and privacy of protected information and ensure compliance with relevant security/privacy regulations, contractual requirements, and industry-standard frameworks. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs. For example, our Information Security Management System (ISMS) is certified as being in conformity with ISO/IEC 27001 by SRI Quality System Registrar. We maintain cybersecurity and privacy policies and procedures in accordance with industry-standard control frameworks and applicable regulations, laws, and standards. All corporate cybersecurity policies are reviewed and approved by senior leadership at least annually as part of our ISMS.


text: Our cybersecurity controls, which are the mechanisms in place to prevent, detect and mitigate threats in accordance with our policies and procedures, are based on the regulatory requirements to which we are subject and are monitored and tested both internally and externally by third parties at least annually. These controls include regular system updates and patches, employee training on cybersecurity and privacy requirements, incident reporting, and the use of encryption to secure sensitive information. In addition, we also regularly perform phishing tests of our employees and update our training plan at least annually. We maintain business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and/or the loss of data and services from the effects of natural or man-made disasters to Dexcom locations. We also provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. See "Risk Factors — Risks Related to Privacy and Security." As cybersecurity threats become more frequent, sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our strategy that includes developing and commercializing products that integrate our CGM technologies into insulin delivery systems or data platforms of our partners. The technology integration and cloud-based depository platforms we continue to focus on can make us more vulnerable to cybersecurity threats, thereby making our pursuit of such strategies more costly.


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Board's Technology Committee. The Technology Committee reports to the Board as necessary with respect to its activities, including making such reports and recommendations to the Board and its other committees as necessary and appropriate and consistent with its purpose, described below.


text: The Technology Committee, comprised of independent Board members, is responsible for reviewing cybersecurity, privacy, data protection and other major technology risk exposures of the Company, the steps management has taken to monitor and control such exposures, and the Company's compliance with applicable cybersecurity and data privacy laws and industry standards. These reviews are provided at least quarterly. The Technology Committee receives management updates and reports, primarily through the Company's Cybersecurity and Privacy Committee, a multidisciplinary team responsible for the overall governance, decision-making, risk management, awareness and compliance for cybersecurity and privacy activities across the Company.


text: The Cybersecurity and Privacy Committee is co-chaired by our Information Security Officer (ISO), Product Security Officer (PSO), and Chief Privacy Officer (CPO), and its members include executive officers of the Company, including our Chief Technology Officer, Chief Financial Officer, Chief Information Officer, and Chief Legal Officer, as well as representatives from the finance, internal audit, quality, regulatory, and legal teams. Management's role in assessing and managing the material risks from cybersecurity threats is accomplished primarily through the committee.


text: Members of the Cybersecurity and Privacy Committee have broad ranges of expertise and experience in information technology and security. Our ISO, a co-chair of the committee, has over fifteen years of experience in the field of information security management, having previously led security operations and infrastructure and IT functions for a public university campus and a non-profit organization, and holds several licenses and certifications relating to information security, including a Certified Information Systems Security Manager from the Information Systems Audit and Control Association (ISACA), a Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium (ISC2) and several technical cybersecurity certifications from the Global Information Assurance Certification (GIAC). Our PSO, also a co-chair of the committee, has over twenty-five years of previous experience in cyber security architecture and cyber security management for a number of large Fortune 500 technology companies and holds several certifications including CISSP from the International Information Security System Security Certification Consortium, C-CISO from EC-Council, Numerous certifications from Microsoft, CISCO, Juniper, Checkpoint among others and has completed several advanced GIAC security classes from the SANS Institute.


text: Our ISO reports directly to our Senior Vice President, Chief Information Officer (CIO), who is a member of the committee. He has held this role at Dexcom since 2021, having previously served as our Senior Vice President, Information Technology since 2018 and Vice President, Information Technology from 2016 to 2018. Our CIO also has a wide range of experience within global organizations in the field of information technology, including having served in various IT leadership roles at CareFusion, a Becton Dickinson Company, from 2012 to 2016, and ResMed in San Diego from 2007 to 2012. He holds a Bachelor of Engineering in Mechanical Engineering and a Master of Industrial Engineering. Our PSO reports directly to our Executive Vice President, Chief Technology Officer (CTO), who is also a member of the committee. Our CTO has held this role since 2022 and has 25 years of experience spanning consumer electronics, data storage, IoT and broadband industries. From 2011 to 2022 he worked at Technicolor (now known as Vantiva), most recently serving as Chief Technology Officer and General Manager of the Broadband Business Division. In addition to an MBA, he holds a Master of Science in Mechanical Engineering and a Bachelor of Mechanical Engineering.


text: The prevention, detection, mitigation and remediation of cybersecurity incidents at Dexcom is accomplished pursuant to various policies, procedures and processes, including incident response plans and the cybersecurity and privacy programs and controls described above under "Risk Management and Strategy." These measures include escalation protocols through which the Cybersecurity and Privacy Committee is informed about cybersecurity and incidents by our ISO and PSO, who are informed through our business units. As described above, members of the Cybersecurity and Privacy Committee provide updates to the Technology Committee of the Board on a regular basis, and the full Board receives updates from the Technology Committee. In addition, there are protocols in place for immediate escalation in the event of any cybersecurity issues or developments that may require consideration between regularly scheduled Technology Committee or Board meetings.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. See "Risk Factors — Risks Related to Privacy and Security." As cybersecurity threats become more frequent, sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources as we pursue our strategy of continuously modifying and enhancing our protective measures while developing and commercializing products that incorporate our CGM technologies and integrate with the insulin delivery systems or data platforms of our partners. The technology integration and cloud-based depository platforms we continue to focus on can make us more vulnerable to cybersecurity threats, thereby making our pursuit of such strategies more costly.


text: The Technology Committee, comprised of independent Board members, is responsible for reviewing cybersecurity, privacy, data protection and other major technology risk exposures of the Company, the steps management has taken to monitor and control such exposures, and the Company's compliance with applicable cybersecurity and data privacy laws and industry standards. These reviews are provided at least annually. The Technology Committee receives management updates and reports, primarily through the Company's Cybersecurity and Privacy Committee, a multidisciplinary team responsible for the overall governance, decision-making, risk management, awareness and compliance for cybersecurity and privacy activities across the Company.


text: Our ISO reports directly to our Senior Vice President, Chief Information Officer (CIO), who is a member of the committee. She has held this role at Dexcom since 2024 and is responsible for global information technology at Dexcom. Our CIO brings 30 years of diverse strategic and operational experience in IT management, data engineering, AI, digital, ecommerce, infrastructure modernization and supply chain. Prior to Dexcom, our CIO served as Senior Vice President, Chief Information Officer at Bausch + Lomb. Additionally, our CIO has held transformational roles at Johnson & Johnson, Bristol Myers Squibb, American Standard and Price Waterhouse Coopers. She holds a Bachelor of Science degree in Economics and Management Information Systems from the University of Delaware. Our Executive Vice President, Chief Technology Officer (CTO) is also a member of the committee. Our CTO has held this role since 2022 and has 25 years of experience spanning consumer electronics, data storage, IoT and broadband industries. From 2011 to 2022 he worked at Technicolor (now known as Vantiva), most recently serving as Chief Technology Officer and General Manager of the Broadband Business Division. In addition to an MBA, he holds a Master of Science in Mechanical Engineering and a Bachelor of Mechanical Engineering.


text: Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as a cybersecurity incident response team ("CSIRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of cybersecurity incidents to law enforcement and regulatory bodies, as appropriate.

companyName: EVEREST GROUP, LTD.

ticker: EG


text: Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers. The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, DDoS and other protections to secure the company's critical infrastructure. The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts. The SOC also initiates incident response protocols, including escalating threats as needed to the CSIRT, including the Chief Information Security Officer ("CISO"), who can further escalate to other members of senior management and the Board, as may be appropriate. Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises, and cyber incident response exercises are used to test the effectiveness of the overall cybersecurity control environment. In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.


text: Everest outsources certain business, technological and administrative functions and relies on third-party vendors to perform certain functions or provide certain services on its behalf. The Company negotiates contractual provisions to address identified cybersecurity risk(s) with third-party vendors. Third party security assessments of these vendors are also performed as part of the Company's third-party vendor management processes. The Company also maintains processes to oversee and manage material risks from cybersecurity threats associated with its use of third-party service providers.


text: Everest provides resources and learning opportunities to educate all of our colleagues on how to identify, report, and be vigilant against cybersecurity threats in the workplace. In addition, we conduct cybersecurity incident simulation exercises with business, information technology, management, and other key stakeholders to practice and test response processes. Furthermore, the Company collaborates with industry associations, government and regulatory authorities, peer companies and external advisors to monitor the threat environment and to inform its cybersecurity practices.


text: For the year ended December 31, 2023, Everest has not experienced any cybersecurity incident that materially affected the Company, including its business strategy, results of operations or financial conditions.


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. Accordingly, the Company's Board, through the RMC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight, as described more fully in our Proxy Statement, while management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk.


text: The Company also appointed a certified Chief Information Security Officer ("CISO") with significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the Executive Risk Committee or ERC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business of cybersecurity threats. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, report on material cybersecurity risks.


text: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company, and the effectiveness of the Company's cybersecurity program to the RMC. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.


text: Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as a incident response team ("IRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of incidents to law enforcement and regulatory bodies, as appropriate.


text: Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers. The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, distributed denial-of-service and other protections to secure the company's critical infrastructure. The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts. The SOC also initiates incident response protocols, including escalating threats as needed to the IRT, including the Chief Information Security Officer ("CISO"), who can further escalate to other members of senior management and the Board, as may be appropriate. Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises and incident response exercises are used to test the effectiveness of the overall cybersecurity control environment. In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.


text: Everest provides resources and learning opportunities to educate all of our colleagues on how to identify, report and be vigilant against cybersecurity threats in the workplace. In addition, we conduct cybersecurity incident simulation exercises with business, information technology, management and other key stakeholders to practice and test response processes. Furthermore, the Company collaborates with industry associations, government and regulatory authorities, peer companies and external advisors to monitor the threat environment and to inform its cybersecurity practices.


text: For the year ended December 31, 2024, Everest has not experienced any cybersecurity incident that materially affected the Company, including its business strategy, results of operations or financial conditions.


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. The Company's Board, through its committees, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight. In 2024, a Technology and Cyber Board Committee was established to further assist the Company Board's oversight responsibilities with respect to information technology governance, strategy, delivery and risk management, including cybersecurity and data privacy. Management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. In addition, the Company's subsidiary boards of directors may also provide additional oversight.


text: The Company also appointed a certified CISO who has significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the ERC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, review overall cybersecurity strategies and policies and to report on material cybersecurity risks.


text: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company and the effectiveness of the Company's cybersecurity program to the Board's Technology and Cyber Committee. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Safehold Inc.

ticker: SAFE


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Head of Risk Management and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Certain members of our management team, including the Head of Risk Management and our General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. These individuals have primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: As customer preferences and business-efficiency demands lead to a more connected and digitized world, cybersecurity and privacy risks have become critical business issues. Luxfer understands the systemic nature of cybersecurity threats to the safety and security of our Company, customers, and employees. As such, Luxfer is committed to safeguarding and protecting our information technology ("IT") network, equipment, and systems against cybersecurity threats to ensure our future security and reduce risk.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Accordingly, we will continue to review and update our existing governance, policies, and practices to address the following objectives: • Ensure business continuity by protecting Luxfer's technology, data, intellectual property, and information assets; • Increase cyber-resiliency and enhance controls for detecting and mitigating cybersecurity incidents; • Safeguard the availability and reliability of Luxfer's network infrastructure, systems, and services; • Ensure compliance with all applicable regulations and Luxfer policies, controls, standards and guidelines; and, • Comply with requirements for confidentiality and privacy for Luxfer's customers and employees.


text: As of the date of the filing of this Form 10-K, we are not aware of attempts by third parties to gain access to our systems and networks and do not believe that any such attempts have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition.


text: The Board's Role - As a part of its regular risk oversight, Luxfer's Board of Directors is responsible for overseeing cybersecurity, information security, and technology risk. The Board is comprised of independent Non-Executive Directors, and one Executive Director. Luxfer's Senior Leadership team provides regular reports on information security matters at least quarterly to the Board, as it is their responsibility to oversee Management's actions to identify, access, mitigate and remediate material risk.


text: Luxfer's cybersecurity program is managed by our IT Steering Committee. Comprised of IT Managers from across the company and chaired by a member of Luxfer's executive leadership team, the IT Steering Committee maintains the vision, strategy, and operation of Luxfer's cybersecurity program. IT Managers, who have operational responsibility for the actions of the Committee, ensure the effective implementation of the Company IT policies and also manage the local IT teams to ensure they are appropriately supported. Local IT teams have the day-to-day responsibility for implementing and monitoring the operation of Company IT policies within their respective business units. IT personnel within the Company are qualified within their respective roles and are provided with the resource to carry out their responsibilities effectively.


text: We devote significant resources to network security, data encryption, employee training, monitoring of networks and systems, patching, maintenance and backup of systems and data. We also follow best practices for IT and data security as our IT controls are aligned with DFARS / NIST 800-171 IT Security Standard for US Government Contractors. Although there have been no cybersecurity incidents have been material to the Company to date, cyber-attacks are continually becoming more sophisticated, and our IT network is still potentially vulnerable to threats and incidents in the future.


text: To assure long-term success, Luxfer is committed to discovering and preparing for all potential cybersecurity threats. We set out below certain mitigating actions that we believe help us manage our principal cybersecurity risks.


text: Network and Systems Luxfer's operations are increasingly dependent on IT systems and management of information, and a cyber-attack could inhibit our business operations including disruption to sales, production and cash flows.


text: Luxfer has a wide breadth of controls in place to protect against cyber-attacks including firewalls, threat monitoring systems, protected cloud architecture, and more frequent security patching. We have phased out vulnerable operating systems and updated legacy servers with advanced security. Applications that run and manage our core operating data are fully backed up.


text: Employee Error or Misuse As cyber-attacks and phishing scams are becoming more advanced, employees may fail to recognize the signs of a cyber-attack or rely solely on the Company's IT defenses.


text: We have global policies covering IT security standards, annual training modules for employees. We also train our employees on cybersecurity through phishing simulations.


text: Third-Party Cybersecurity Measures In part, we depend on the reliability of certain tested third parties' cybersecurity measures, including firewalls, virus solutions and backup solutions. Our business may be affected if these third-party resources are compromised.


text: Our IT Steering Committee performs thorough due diligence and risk analyses on third party vendors, verifying that sufficient security testing is performed on all software before installation on Luxfer's network. The IT Steering Committee also monitors and reviews access and permissions to all software and programs regularly.


text: We are required to comply with the UK General Data Protection Regulation (GDPR) relating to the security of personally identifiable information that we process. A data breach can result in non-compliance with the GDPR, leading to fines or litigation.


text: We make every effort to comply with the GDPR and implement best practices including annual review of our Data Protection Policy. We also train employees to maintain secure systems, and access control measures, and regularly monitor and test our networks to protect data, payment information, and personally identifiable information.


text: Training and compliance - Our employees are a key line of defense against cybersecurity threats and malicious actors. In addition to our IT Policies, Luxfer has a comprehensive cybersecurity training and awareness program to educate employees on how to recognize cybersecurity threats, prevent cyber-related incidents, and how to report a potential threat or breach. Our online compliance training program is mandatory for all employees worldwide, and includes cybersecurity awareness and IT security trainings, along with other compliance and governance related topics. Within each training module, employees are required to review a Company IT policy applicable to the topic of the training, and attest that they have read, understood, and agree to comply with the Policy.


text: Luxfer's IT Steering Committee continues to carry out internal phishing simulations to engage employees with cybersecurity, raise awareness, and educate employees on how to recognize and report phishing attacks. Through the simulations, we are able to test our employees' reaction to phishing emails and collect important metrics such as click rate. Data collection allows us to pinpoint trouble spots and target additional trainings to specific teams or locations. This information is also reported once quarterly to Luxfer's Senior Leadership Team and is an important supplement to our overall IT security training program.


text: Security audits and assessments - We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness.


text: As customer preferences and business-efficiency demands lead to a more connected and digitized world, cybersecurity and privacy risks have become critical business issues. Luxfer understands the systemic nature of cybersecurity threats to the safety and security of our Company, customers, and employees. As such, Luxfer is committed to safeguarding and protecting our information technology ("IT") network, equipment, and systems against cybersecurity threats to ensure our future security and reduce risk.


text: Accordingly, we will continue to review and update our existing governance, policies, and practices to address the following objectives: • Ensure business continuity by protecting Luxfer's technology, data, intellectual property, and information assets; • Increase cyber-resiliency and enhance controls for detecting and mitigating cybersecurity incidents; • Safeguard the availability and reliability of Luxfer's network infrastructure, systems, and services; • Ensure compliance with all applicable regulations and Luxfer policies, controls, standards and guidelines; and, • Comply with requirements for confidentiality and privacy for Luxfer's customers and employees.


text: As of the date of the filing of this Form 10-K, we are not aware of any successful attempts by third parties to gain access to our systems and networks and do not believe that any such attempts have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition.


text: The Board's Role - As a part of its regular risk oversight, Luxfer's Board of Directors is responsible for overseeing cybersecurity, information security, and technology risk. The Board is comprised of independent Non-Executive Directors, and one Executive Director. Luxfer's Senior Leadership team provides regular reports on information security matters at least quarterly to the Board, as it is their responsibility to oversee Management's actions to identify, access, mitigate and remediate material risk.


text: Luxfer's cybersecurity program is managed by our IT Steering Committee. Comprised of IT Managers from across the company and chaired by a member of Luxfer's executive leadership team, the IT Steering Committee maintains the vision, strategy, and operation of Luxfer's cybersecurity program. IT Managers, who have operational responsibility for the actions of the Committee, ensure the effective implementation of the Company IT policies and also manage the local IT teams to ensure they are appropriately supported. Local IT teams have the day-to-day responsibility for implementing and monitoring the operation of Company IT policies within their respective business units. IT personnel within the Company are qualified within their respective roles and are provided with the resource to carry out their responsibilities effectively.


text: We devote significant resources to network security, data encryption, employee training, monitoring of networks and systems, patching, maintenance and backup of systems and data. We also follow best practices for IT and data security as our IT controls are aligned with DFARS / NIST 800-171 IT Security Standard for US Government Contractors. Although there have been no cybersecurity incidents that have been material to the Company to date, cyber-attacks are continually becoming more sophisticated, and our IT network is still potentially vulnerable to threats and incidents in the future. As part of our cybersecurity risk management processes, we maintain an incident response plan that establishes a set of procedures for reporting and handling cybersecurity events To assure long-term success, Luxfer is committed to discovering and preparing for all potential cybersecurity threats. We set out below certain mitigating actions that we believe help us manage our principal cybersecurity risks.


text: Network and Systems Luxfer's operations are increasingly dependent on IT systems and management of information, and a cyber-attack could inhibit our business operations including disruption to sales, production and cash flows.


text: Luxfer has a wide breadth of controls in place to protect against cyber-attacks including firewalls, threat monitoring systems, protected cloud architecture, and more frequent security patching. We have phased out vulnerable operating systems and updated legacy servers with advanced security. Applications that run and manage our core operating data are fully backed up.


text: Employee Error or Misuse As cyber-attacks and phishing scams are becoming more advanced, employees may fail to recognize the signs of a cyber-attack or rely solely on the Company's IT defenses.


text: We have global policies covering IT security standards, annual training modules for employees. We also train our employees on cybersecurity through phishing simulations.


text: Third-Party Cybersecurity Measures In part, we depend on the reliability of certain tested third parties' cybersecurity measures, including firewalls, virus solutions and backup solutions. Our business may be affected if these third-party resources are compromised.


text: Our IT Steering Committee performs thorough due diligence and risk analyses on third party vendors, verifying that sufficient security testing is performed on all software before installation on Luxfer's network. The IT Steering Committee also monitors and reviews access and permissions to all software and programs regularly.


text: We are required to comply with the UK General Data Protection Regulation (GDPR) relating to the security of personally identifiable information that we process. A data breach can result in non-compliance with the GDPR, leading to fines or litigation.


text: We make every effort to comply with the GDPR and implement best practices including annual review of our Data Protection Policy. We also train employees to maintain secure systems, and access control measures, and regularly monitor and test our networks to protect data, payment information, and personally identifiable information.


text: Training and compliance - Our employees are a key line of defense against cybersecurity threats and malicious actors. In addition to our IT Policies, Luxfer has a comprehensive cybersecurity training and awareness program to educate employees on how to recognize cybersecurity threats, prevent cyber-related incidents, and how to report a potential threat or breach. Our online compliance training program is mandatory for all employees worldwide, and includes cybersecurity awareness and IT security trainings, along with other compliance and governance related topics. Within each training module, employees are required to review a Company IT policy applicable to the topic of the training, and attest that they have read, understood, and agree to comply with the Policy.


text: Luxfer's IT Steering Committee continues to carry out internal phishing simulations to engage employees with cybersecurity, raise awareness, and educate employees on how to recognize and report phishing attacks. Through the simulations, we are able to test our employees' reaction to phishing emails and collect important metrics such as click rate. Data collection allows us to pinpoint trouble spots and target additional trainings to specific teams or locations. This information is also reported once to Luxfer's Senior Leadership Team and is an important supplement to our overall IT security training program.


text: Security audits and assessments - We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, and assessments. We regularly engage appropriately qualified independent third parties to assess our cybersecurity program, including cybersecurity maturity assessments, and independent review of our security control environment and operating effectiveness.


text: Markel Group is a holding company comprised of a diverse group of companies and investments. Our specialty insurance business, Markel, sits at the core of our company. Markel Group utilizes information technology systems and services, including cybersecurity, provided and/or administered by Markel. Through Markel Group's wholly owned subsidiary, Markel Ventures, Inc. (Markel Ventures), Markel Group owns controlling interests in businesses that operate in a variety of industries. The Markel Ventures businesses are independently managed with respect to their information security and data protection programs.

companyName: MARKEL GROUP INC.

ticker: MKL


text: In order to maintain a strong cybersecurity program, Markel uses a variety of controls and technology tools designed to identify, detect, prevent, respond to, and recover from security threats. Markel undergoes regular security audits including a System and Organization Controls (SOC) audit for Cybersecurity conducted annually by independent auditors in which cybersecurity threats are identified and assessed. Markel regularly tests aspects of its internal security and conducts security risk interviews and assessments on third parties with whom it does business, depending on the nature of the relationship. Markel has invested in technology that assists its risk management teams in measuring and addressing weaknesses in its third-party and supply chain community. Markel performs continuous monitoring of all its third parties to ensure they are maintaining acceptable levels of security controls and remediating any known weaknesses.


text: Markel participates in the Financial Services Information Sharing and Analysis Center to share information about the latest cyber threats and preparedness measures. Markel also shares threat intelligence information with other partners. Markel has a cybersecurity incident response plan, as well as a crisis management plan, that cover cyber events, including a process for determining the materiality of cyber events that includes evaluation by a cross functional crisis management group including security, information technology, finance, legal and business and escalation to Markel Group senior management as warranted by the severity of the situation. An internal team engages in tabletop exercises several times each year to enhance preparedness for such situations.


text: Information security and data protection risks are the responsibility of all employees. Markel has a mandatory training program covering a variety of security and data protection disciplines. In addition, all Markel employees are required to acknowledge annually policies on acceptable use of Markel's technology resources and enterprise information security. Contractors are required to provide certain representations and certifications relating to information security.


text: The Markel information security and data protection program is led by a Chief Information Security Officer (CISO) who supervises a team of security and data protection professionals across the globe. Markel's global information security and data protection program leverages the Cybersecurity Framework from the National Institutes of Standards and Technology as well as industry best practices. Markel also is able to map to both ISO (International Organization for Standardization) and BSI (British Standards Institution) among other cybersecurity standards. Markel's CISO has been with Markel 13 years and has 22 years' experience in information technology, with 17 years in information technology security, and is a certified Information Systems Security Professional (CISSP).


text: Each of our Markel Ventures businesses maintains its own, separate IT infrastructure, that often includes third-party providers, to support the needs of its business. As a result, cybersecurity risk for the Markel Ventures businesses is not concentrated in one system or service provider. Further, given the disparate nature of the businesses, systems, and providers, there is no single, uniform approach to managing cybersecurity risk at the Markel Ventures businesses – each is tailored to its unique needs. As is the case with all risks, management for each Markel Ventures business is responsible for evaluating and managing cybersecurity risks for its business. Therefore, each business determines the appropriate IT systems and providers needed to do so. Management for each business shares information on material risks from cybersecurity incidents with Markel Ventures management.


text: Markel Ventures has established processes for the Markel Ventures businesses to share information about how they assess, identify, and manage cybersecurity risk and shares information on material risks from cybersecurity incidents with Markel Group management, as appropriate. Each Markel Ventures business has a board that meets quarterly. Material matters regarding cybersecurity risk management and cybersecurity incidents are discussed at these meetings. In addition, Markel Ventures management regularly meets with the businesses to discuss their risk identification, assessment, and management approach. These discussions include how the business assesses, identifies, and manages key risks, including cybersecurity risks.


text: Markel Ventures requires real-time reporting of material cybersecurity incidents to understand how the matters are being managed, assess whether public disclosure is required and inform Markel Group senior management of relevant matters. Depending on the cybersecurity incident, third parties may be engaged by the Markel Ventures businesses to assist them in understanding and managing the event.


text: Given the varying size and complexity of the Markel Ventures businesses, a diverse array of individuals assume responsibility for managing cybersecurity risks within them. In some instances, primary responsibility may be with a member of the executive management team. In other instances, primary responsibility may land with information technology professionals. In all instances, however, ultimate responsibility rests with each business' Chief Executive Officer.


text: Markel Group Board Oversight The Markel Group Board of Directors oversees Markel Group's risk management framework on an enterprise-wide basis, which includes cybersecurity risks. Periodic reports are provided to the Markel Group Board of Directors by members of management which, among other things, seek to systematically identify the principal risks facing our businesses and the manner in which such risks are addressed. For cybersecurity, this includes a review of the cybersecurity program and its governance, active and planned initiatives, protection and prevention matters, detection and response measures, and the threat landscape.


text: Cybersecurity Risks No previous cybersecurity incident has had, or is reasonably likely to have, a material adverse effect on Markel Group, its business strategy, results of operations, or financial condition. For risks related to cybersecurity threats, see Item 1A Risk Factors, including under "Information technology systems that we use could fail or suffer a security breach or cyberattack, which could have a material adverse effect on us or result in the loss of regulated or sensitive information."


text: Markel Group is a holding company comprised of a diverse group of businesses and investments. Our specialty insurance business, which operates under the name Markel, sits at the core of our company. Markel Group also owns controlling interests in businesses that operate in a variety of other industries. We refer to this group of businesses as Markel Ventures. Each of our businesses is independently managed with respect to their information security and data protection programs.


text: In order to maintain a strong cybersecurity program, our insurance business, Markel, uses a variety of controls and technology tools designed to identify, detect, prevent, respond to, and recover from security threats. Markel undergoes regular security audits including a System and Organization Controls, or SOC, audit for Cybersecurity conducted annually by independent auditors in which cybersecurity threats are identified and assessed. Markel regularly tests aspects of its internal security and conducts security risk interviews and assessments on third parties with whom it does business, depending on the nature of the relationship. Markel has invested in technology that assists its risk management teams in measuring and addressing weaknesses in its third-party and supply chain community. Markel performs continuous monitoring of all its critical third parties to ensure they are maintaining acceptable levels of security controls and remediating any known weaknesses.


text: Markel participates in the Financial Services Information Sharing and Analysis Center to share information about the latest cyber threats and preparedness measures. Markel also shares threat intelligence information with other partners. Markel has a cybersecurity incident response plan, as well as a crisis management plan, that cover cyber events, including a process for determining the materiality of cyber events that includes evaluation by a cross functional crisis management group including security, information technology, finance, legal and business and escalation to Markel Group senior management as warranted by the severity of the situation. An internal team engages in tabletop exercises on a regular basis to enhance preparedness for such situations.


text: The Markel information security and data protection program is led by a Chief Information Security Officer (CISO) who supervises a team of security and data protection professionals across the globe. Markel's global information security and data protection program leverages the Cybersecurity Framework from the National Institutes of Standards and Technology as well as industry best practices. Markel also is able to map to both ISO (International Organization for Standardization) and BSI (British Standards Institution) among other cybersecurity standards. Markel's CISO has been with Markel 14 years and has 23 years' experience in information technology, with 18 years in information technology security, and is a certified Information Systems Security Professional (CISSP).


text: Information technology systems and services, including cybersecurity, used by the small team of individuals at the Markel Group holding company are provided and/or administered by teams within our insurance business, consistent with practices outlined above.


text: Each of our Markel Ventures businesses maintains its own, separate IT infrastructure, that often includes third-party providers, to support the needs of its business. As a result, cybersecurity risk for the Markel Ventures businesses is not concentrated in one system or service provider. Further, given the disparate nature of the businesses, systems, and providers, there is no single, uniform approach to managing cybersecurity risk at the Markel Ventures businesses – each is tailored to its unique needs. As is the case with all risks, management for each Markel Ventures business is responsible for evaluating and managing cybersecurity risks for its business. Therefore, each business determines the appropriate IT systems and providers needed to do so.


text: Markel Ventures has established processes for the Markel Ventures businesses to share information about how they assess, identify, and manage cybersecurity risk, and Markel Ventures shares information on material risks from cybersecurity incidents with Markel Group management, as appropriate. Each Markel Ventures business has a board that meets regularly. Material matters regarding cybersecurity risk management and cybersecurity incidents are discussed at these meetings. In addition, Markel Ventures management regularly meets with the businesses to discuss their risk identification, assessment, and management approach. These discussions include how the business assesses, identifies, and manages key risks, including cybersecurity risks.


text: Markel Ventures requires real-time reporting of cybersecurity incidents to understand how the matters are being managed, assess whether public disclosure is required, with escalation to Markel Group senior management as warranted by the severity of the situation. Depending on the cybersecurity incident, third parties may be engaged by the Markel Ventures businesses to assist them in understanding and managing the event.


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Lifted does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that Lifted will not be seriously damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: LFTD PARTNERS INC.

ticker: LIFD


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1A. Risk Factors" for more information regarding the Company's cybersecurity-related risks.