text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.


text: We have established processes for assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: CHART INDUSTRIES INC

ticker: GTLS

secItem: Item 1C


text: During 2024, we realized our objective of having no material cybersecurity incidents. Furthermore, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties, during any of the last three years.


text: By prioritizing cybersecurity at the highest level of our leadership, we assess cybersecurity risk, allocate resources and maintain a culture of cybersecurity awareness throughout Chart. Chart ties cybersecurity or being cyber safe to our key theme of safety, as an industrial manufacturer. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other programs: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We have incident response and breach management processes which occur in stages starting with preparation for cybersecurity incidents followed by detection and analysis of cybersecurity incidents, containment, eradication and recovery, and post-incident analysis. Such incident responses are overseen by leaders from our information security, compliance and legal teams. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: We also simulate responses to cybersecurity incidents by conducting tabletop exercises. Our cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In past years, our Information Security Management System has continued to work a Plan of Action and Milestones ("POAM") tied to the United States Cybersecurity Maturity Model Certification ("CMMC") program, formerly the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while looking for synergies across other standards, such as the Information Assurance Technical Framework ("IATF"), or as required for specific product lines or customers. Furthermore, we benchmark externally against other industrial manufacturers within the B2B (Business to Business) manufacturing industry, and even to a vertical level to determine Chart's risk profile through cybersecurity insurance tools that rank companies and bring them together within forums for cyber intelligence sharing and best practices.


text: Our risk management program also assesses third-party risks to identify and mitigate risks from vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition, we strive to have the appropriate cybersecurity clauses in our agreements and where necessary we have Data Processing Agreements ("DPAs") put in place for privacy of data.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Data privacy and data security considerations could impact our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Board receives updates on a regular basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status of key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the c hief information officer/chief information security officer ("CIO/CISO"), as a member of the Chart senior management, works to organize these functional teams given the individual's experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Company utilizes an affiliated company of Pacific Trail ("IT Provider"), which is a provider of financial services to numerous affiliates of Pacific Trail, which operate in the real estate and financial services industries for its accounting, accounts payable, treasury and related Information Technology ("IT") and data processing functions. The Company's financial systems and related controls, procedures, risk management, and including IT systems is integrated with that of the affiliated companies (together the "Affiliated Group").

companyName: KAANAPALI LAND LLC

ticker: KANP


text: Cybersecurity and cybersecurity risk management are important aspects of operations and a focus area for the Affiliated Group. Cybersecurity risks are evaluated on an ongoing basis by the Affiliated Group and its IT Provider, both internally and with the assistance of external firms.


text: The Company engages a national technology firm in an effort to maintain and continually update its cybersecurity posture and keep current with evolving cybersecurity risks. The IT Provider's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The IT Provider's technology team tests the effectiveness of its tools with periodic exercises, including Penetration (PEN) tests. Risk is assessed to identify and manage risks that could affect its ability to provide reliable processing to the Affiliated Group. This process requires IT Provider to identify significant risks based upon the following: (a) management's internal knowledge of and perceived risks to the IT environment, (b) significant changes to the internal and the third-party vendor IT environments, (c) input received annually from its consultants and external auditors based on its auditor's review of the IT operating environment, (d) management's review of Service Organization Controls (SOC) reports received from vendors housing critical applications, (e) regulatory requirements or operating standards that may directly impact the IT environment, and (f) identification of threats and the evaluation of the probability and likelihood of threats. For any significant risks identified, IT Provider's management is responsible for implementing appropriate measures to monitor and manage these risks, including implementing or revising control procedures, conducting specific consulting projects, and updating systems and processes to ensure compliance,.


text: As many security threats involve email and social engineering, the IT Provider has a multifaceted security training program for Affiliated Group employees. Cybersecurity training classes are administered at least annually. Testing and assessment of employees' ability to thwart attacks are performed throughout the year, with training being targeted at areas of users' weakness.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, however, there can be no assurance in that regard.


text: The management of IT Provider is responsible for directing and controlling operations and for establishing, communicating, and monitoring policies and procedures. The key members of management are the President, (who has over 20 years' experience in his current position) and is responsible for overseeing delivery of the services, and the Chief Information Officer ("CIO") (who has over 10 years' experience in his current position) and is responsible for overseeing the IT environment that supports the services. Importance is placed on maintaining sound internal controls and promoting integrity and the ethical values of the Affiliated Group in all personnel. Organizational values and behavioral standards are communicated to all personnel through policy statements and the Employee Handbook. Additionally, the President and CIO are in daily contact with personnel at all levels and reinforce the Affiliated Group's policies, procedures, and organizational values.


text: The IT Provider reports to the President and upper level management of the Affiliated Group as part of the risk management process in which IT Provider management identifies significant risks through discussions with Affiliated Group management and develops responses and mitigating actions to address such risks.


text: The Company engages a national technology firm in an effort to maintain and continually update its cybersecurity posture and keep current with evolving cybersecurity risks. The IT Provider's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The IT Provider's technology team tests the effectiveness of its tools with periodic exercises, including Penetration (PEN) tests. Risk is assessed to identify and manage risks that could affect its ability to provide reliable processing to the Affiliated Group. This process requires IT Provider to identify significant risks based upon the following:


text: (a) management's internal knowledge of and perceived risks to the IT environment, (b) significant changes to the internal and the third-party vendor IT environments, (c) input received annually from its consultants and external auditors based on its auditor's review of the IT operating environment, (d) management's review of Service Organization Controls (SOC) reports received from vendors housing critical applications, (e) regulatory requirements or operating standards that may directly impact the IT environment, and (f) identification of threats and the evaluation of the probability and likelihood of threats. For any significant risks identified, IT Provider's management is responsible for implementing appropriate measures to monitor and manage these risks, including implementing or revising control procedures, conducting specific consulting projects, and updating systems and processes to ensure compliance.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, however, there can be no assurance in that regard. (table of contents)


text: We believe that mitigating cybersecurity risks is the responsibility of every employee. We take a preventative approach with respect to cybersecurity threats by building a resilient cybersecurity culture and strong IT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks; • ongoing training, testing, and utilizing other forms of social engineering awareness and education for our employees; • using cybersecurity systems and tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for reporting and alerting on known threats and anomalous behaviors; • assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners; • creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats; • utilizing third-party experts to perform penetration testing and scanning of our systems for vulnerabilities; • obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and • maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.

companyName: SM Energy Co

ticker: SM


text: We have structured our cybersecurity risk management program according to the National Institute of Standards and Technology Cybersecurity Framework. We strive to employ cybersecurity best practices, including implementing new technologies to proactively monitor new threats and vulnerabilities and reduce risk; maintaining a Cybersecurity Incident Response Plan, Disaster Recovery Plan, and Business Continuity Plan; and regularly updating our response planning and protocols. We have integrated our cybersecurity processes into our overall risk management program, thereby establishing a comprehensive approach by which we determine and implement strategies designed to manage external, strategic, operational and financial risks to our business, including cybersecurity threats.


text: We utilize a wide range of protective cybersecurity technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. In addition, we use an information security risk management approach that includes monitoring security threats and trends in the industry, analyzing potential security risks that could impact the business, partnering with industry recognized security organizations, and coordinating an appropriate response should the need arise.


text: Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2023, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Risk Factors in Part 1, Item 1A of this report.


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements, and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.


text: Our Board of Directors receives regular updates on relevant IT matters affecting the Company, including cybersecurity risks and mitigation strategies. In addition to the general oversight provided by the full Board of Directors, the Audit Committee is responsible for oversight of our risk assessment and management processes, including with respect to IT and cybersecurity risks. The Audit Committee receives a quarterly cybersecurity report and regular updates from our Vice President and Chief Information Officer and our Director of Cybersecurity Risk and Business Continuity, which includes, among other information, the steps management has taken, and the specific guidelines and policies that have been established, to monitor, control, mitigate and report exposure to IT and cybersecurity risk.


text: We have established a Cyber Incident Response Team ("CIRT") to provide an efficient, effective, and orderly response to technology related incidents and our Cybersecurity Incident Response Plan contains protocols for communication within this team and reporting to executive management and the Audit Committee.


text: The CIRT is led by our Vice President and Chief Information Officer and Director of Cybersecurity Risk and Business Continuity. Together, these professionals are responsible for assessing and managing cybersecurity risks and they lead a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. Our Vice President and Chief Information Officer is a seasoned IT professional with over 28 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reports to our Executive Vice President and Chief Financial Officer. Our Director of Cybersecurity Risk and Business Continuity has over 23 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.


text: We believe that mitigating cybersecurity risks is the responsibility of every employee. We take a preventative approach with respect to cybersecurity threats by building a resilient cybersecurity culture and strong IT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks; • ongoing training, testing, and utilizing other forms of social engineering awareness and education for our employees; • using cybersecurity systems and tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for reporting and alerting on known threats and anomalous behaviors; • assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners; • creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats; • engaging third-party cybersecurity experts and consultants to perform penetration testing and scanning of our systems for vulnerabilities; • obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and • maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.


text: Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2024, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, refer to Risk Factors in Part 1, Item 1A of this report.


text: The CIRT is led by our Vice President and Chief Information Officer and Director of Cybersecurity Risk and Business Continuit y. Together, these professionals are responsible for assessing and managing cybersecurity risks and they lead a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. Our Vice President and Chief Information Officer is a seasoned IT professional with over 29 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reports to our Executive Vice President and Chief Financial Officer. Our Director of Cybersecurity Risk and Business Continuity has over 24 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity governance, strategy and risk management.

companyName: MASONITE INTERNATIONAL CORP


text: Our Board of Directors has ultimate oversight of the Company's privacy and cybersecurity programs and strategy, with each of the Board of Directors' Sustainability and Governance Committee and Audit Committee maintaining oversight responsibility for different elements of these programs. The Sustainability and Governance Committee and Audit Committee inform the full Board of Directors of any cybersecurity learnings or risks that were discussed at the committee level.


text: The Sustainability and Governance Committee oversees the Company's strategies and processes related to information security and technology risks, including cybersecurity. The Company's Chief Information Security Officer ("CISO"), and the Company's Chief Information Officer present a quarterly cybersecurity report to the Sustainability and Governance Committee and, at times, to the full Board of Directors. The reports include detailed updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, internal and third-party assessments of the Company's cybersecurity program maturity against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, incident preparedness and the current cybersecurity environment, including current trends or recent noteworthy incidents affecting other companies. The Company has created a cybersecurity incident response plan that requires management, including the Company's CISO, to take certain mitigating actions including notification to the Company's Disclosure Committee, upon the occurrence of certain types of incidents that may be material or pose significant risk to the Company, for management. The incident response plan also contains procedures requiring, upon the determination by management that the cybersecurity incident is material, notification to the Board of Directors' Sustainability and Governance Committee and Audit Committee.


text: To assist the Company in assessing, preventing, identifying, mitigating and responding to material risks resulting from cybersecurity threats, the Company has developed a comprehensive cybersecurity risk management program led by our CISO. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium who joined the Company in March 2018 after spending 15 years with other organizations as a cybersecurity and information technology ("IT") professional. Our CISO leads our management-level IT Risk Management Committee composed of IT functional leaders that meet quarterly to review the trending cybersecurity environment, risks and threats to the Company, the progress of cybersecurity mitigation and remediation projects and overall progress against the Company's cybersecurity strategy. The Company's senior IT leadership shares progress, findings or concerns reported by the IT Risk Management Committee with senior management to assess the impact of cybersecurity risks and threats to the Company, to assist with driving overall operational awareness, ownership and alignment broadly across the Company for a more effective cybersecurity risk management program.


text: The Company's enterprise-wide cybersecurity strategy is advanced and reinforced by policies, processes, procedures, standards, technologies and training designed to protect the Company's IT systems, operations and sensitive business data. The Company has deployed a multiple-layer defensive model, which includes a variety of detective and protective technologies and measures to monitor and protect our critical IT systems, which include among others, intrusion detection and protection, email security, endpoint security, 24/7 third party security monitoring and proactive security testing.


text: The Company evaluates new and existing third-party service providers and suppliers through a risk assessment that includes interviews and questionnaires to assess their cybersecurity capabilities, process maturity, compliance attestations and the overall technology relationship risk. Each third-party risk assessment is conducted during the contract negotiation process, during certain contract milestones and at other periodic intervals. The final risk assessments and reports are shared with internal teams and IT leadership to assist with ongoing risk mitigation actions. The Company's cybersecurity defense strategy is regularly tested through internal and third-party penetration testing. Additionally, the Company's cybersecurity program maturity and risk profile is regularly analyzed and measured internally against generally accepted industry standards and frameworks, including the NIST Cyber Security Framework, the FAIR model and external third-party maturity assessments.


text: To strengthen the Company's cybersecurity readiness, the Company has developed a cybersecurity incident response policy and a cybersecurity incident response plan in partnership with various internal department functions and third-party IT consultants. Our cybersecurity incident response plan is based on the NIST incident response lifecycle and co-led by our CISO and director of information security. Our cybersecurity incident response plan has a designated incident response team composed of management members from select departments who each play a role within the four phases of the plan that include preparation, detection analysis, containment, eradication, recovery and post-incident activity. Each phase provides a detailed list of actions and responsibilities for each department to assist in responding to a cybersecurity incident. In the event of a cybersecurity incident, as provided in our cybersecurity incident response plan, a root-cause analysis will be conducted and based on the findings, certain new or improved processes and procedures may be implemented to continually improve the security of our IT systems and confidential data. Additionally, the Company's incident response team conducts an annual table-top exercise, utilizing the cybersecurity incident response plan and makes improvements on the response plan based on new learnings. Senior management and Board-level table-top exercises have also been conducted to further prepare and support the Company with responding to and mitigating the effects of a cybersecurity incident. The Company has further implemented a business continuity and disaster recovery plan where critical systems are backed-up daily and incrementally and stored in an encrypted format in multiple secure locations.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part I, Item 1A. "Risk Factors – Risks Related to our Operations", these potential threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in our products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.


text: Pursuant to General Instruction G(2) to Form 10-K, the information required by this Item is incorporated herein by reference to the information under "Information Technology Risk Management" under the caption "Management's Discussion and Analysis of Financial Condition and Results of Operations" in the Company's 2023 Annual Report to Shareholders (included as Exhibit 13 hereto).

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Our board of directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company maintains a cybersecurity and information technology ("IT") risk management program designed to prevent, detect and respond to information security threats, which are fully integrated into the Company's ERM program.


text: Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council's ("FFIEC's") Cybersecurity Assessment Tool. The Company's program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.


text: Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager. The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.


text: Security event monitoring and detection Our processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity and incident response training for all employees.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of outside experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity and IT risk management systems. Engaging outside vendors enables us to leverage specialized knowledge and insights, ensuring our cybersecurity and IT risk management strategies and processes remain sound. Our collaboration with these third-parties includes threat assessments, consultation on security enhancements and regular audits, the results of these threat assessments and audits are reported to the Audit Committee. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.


text: We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics. We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations.


text: Incident materiality The Incident Response Program is a component of the Company's Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response program includes timely notification of a material cybersecurity incident to the to the appropriate law enforcement, regulatory agencies, Board of Directors and other members of senior management.


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Item 1A. entitled Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers".


text: Our management team views cybersecurity risk management as an important strategic topic. Our cybersecurity strategy utilizes the cybersecurity framework developed by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF is a voluntary framework of practices to identify, protect, detect, respond to, and recover from cybersecurity risks. Using the NIST CF does not mean that we meet any particular technical standards or certifications, but rather that we use the NIST CSF to help us identify, assess, and manage cybersecurity risks relevant to our business. Using the NIST CSF, we form our cybersecurity plans and prioritize our activities using a risk-based approach which begins with the identification and evaluation of cybersecurity risks and threats that could disrupt our operations, safety procedures and regulatory compliance. Cybersecurity risks and related mitigation efforts are prioritized based on their potential impact severity, likelihood and vulnerability. Risk mitigation strategies include the application of cybersecurity policies and procedures, implementation of technology-based tools and controls, as well as employee training, education, and awareness initiatives. Our cybersecurity risk management includes ongoing monitoring of networks and systems for potential signs of suspicious activity. We track key performance indicators and cybersecurity metrics to evaluate the effectiveness of our cybersecurity safeguards and practices.

companyName: Air Transport Services Group, Inc.


text: We rely increasingly on software applications, data transmissions and cybersecurity safeguards provided by or in conjunction with third parties to maintain our cybersecurity posture and evolve with the threat environment. We engage third party resources to assess our procedures, test safeguards, provide training and monitoring, and assess our vulnerabilities. We evaluate third party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and data security standards.


text: ATSG management has overall responsibility for assessing and managing risks from cybersecurity threats to our operations. Management has a supervisory team that consists of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Vice President and Controller, and the Vice President of Information Technology, which meets regularly. The Vice President of Information Technology has primary responsibility for the execution of our cybersecurity risk management program and keeps the broader team informed about the detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of Information Technology and the Company's other information technology and security department personnel include individuals with advanced university degrees in cybersecurity and years of technology management experience in matters such as conducting threat assessments, cyber mitigation and incident response.


text: While the Board has the primary responsibility for risk oversight, the Audit Committee assists the Board in fulfilling its oversight responsibility with respect to the management of cybersecurity-related risks. Through its Cybersecurity Subcommittee, the Audit Committee periodically reviews and discusses with management, including the Vice President of Information Technology, (i) the Company's information security strategy, priorities and objectives; (ii) the Company's technology and information security risks, including with respect to cybersecurity and data privacy; and (iii) the steps management has taken to manage cybersecurity.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or that are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches may materially affect our business strategy, results of operations or financial condition. For additional discussion of potential risks regarding cybersecurity, please see the information contained in Risk Related to Business Interruptions and Cybersecurity Incidents in Part 1A of this Form 10-K.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: We design and assess our cybersecurity risk management program guided by the NIST Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness training of our employees and contractors, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, software, and vendors who access our data and/or systems.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. Risk Factors "Cyber-attacks targeting systems and infrastructure used by the gas and oil industry and related regulations may adversely impact our operations and, if we or our third-party providers are unable to obtain and maintain adequate protection for our key systems and data, our business may be harmed."


text: Our Board of Directors considers cybersecurity risk as a critical part of the enterprise and its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding any material cybersecurity incidents.


text: Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director's continuing education on topics that impact public companies.


text: Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats, our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for reporting material incidents to our Cybersecurity Committee that includes our Chief Financial Officer, General Counsel and Corporate Secretary, and our Chief Information Officer. Our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, such as external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our cybersecurity risk management program guided by the NIST Cybersecurity Framework to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: • risk assessments designed to help identify and address material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness training for all of our employees and contractors; • a cybersecurity incident response plan that includes procedures for responding to, escalating, and reporting cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, software, and vendors who access our data and/or systems.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. Risk Factors "Cyber-attacks targeting systems and infrastructure used by the gas and oil industry and related regulations may adversely impact our operations and, if we or our third-party providers are unable to obtain and maintain adequate protection for our key systems and data, our business may be harmed."


text: Our Audit Committee receives bi-annual updates from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding any significant cybersecurity incidents.


text: Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director's continuing education on topics that impact public companies.


text: Our Cybersecurity Manager leads our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats and reporting significant incidents to our Cybersecurity Committee, which includes our Chief Financial Officer, General Counsel and Corporate Secretary, Chief Information Officer, Cybersecurity Manager and Director of Internal Audit. Our Cybersecurity Manager has over 20 years of experience in information security and incident response and our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations.


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are subject to oversight by the Company's Board of Directors. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; and (iv) maintaining the confidence of our customers, clients and business partners.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a primarily domestic presence, with our cybersecurity threat operations designed with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, software updates and patches, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated periodically. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and the Company considers adjustments to its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Company is not aware of any cybersecurity incidents in the last three years that have materially affected or are reasonably likely to materially affect the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect the Company, see "We Face Risks Relating to Cybersecurity Incidents and Privacy Laws." in Item 1A. Risk Factors.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting guidelines. Decisions regarding the disclosure and reporting of such incidents are made by management in a timely manner. The Board of Directors and Audit Committee receive ongoing updates regarding any such incidents until they have been addressed. The Audit Committee regularly interacts with the Company's ERM function, the Company's Vice President of Information Technology, other members of management and relevant management committees, including the Company's Security Advisory Board and Cybersecurity Incident Response Team. On a quarterly basis each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology.


text: The Company's Vice President of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with the other members of the Security Advisory Board, which includes our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer and Executive Vice President and Chief Legal Officer. The Company's Vice President of Information Technology has over 25 years in Information Technology leadership including 15 years overseeing security and compliance operations. The Director of Information Security has over 15 years in various security roles in private and public sectors and has attained the professional certification of Certified Information Systems Security Professional (CISSP).


text: The Company's Vice President of Information Technology and Director of Information Security, in coordination with the Security Advisory Board and Cybersecurity Incident Response Team, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Vice President of Information Technology and Director of Information Security, in coordination with the Security Advisory Board and Cybersecurity Incident Response Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a primarily domestic presence, with our cybersecurity threat operations designed with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, software updates and patches, anti-malware functionality and access controls, all of which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity threats and risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested, evaluated and adjusted periodically. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents.


text: The Company's Vice President of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with the other members of the Security Advisory Board, which includes our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer and Executive Vice President and Chief Legal Officer. The Company's Vice President of Information Technology has over 26 years in Information Technology leadership including 16 years overseeing security and compliance operations. The Director of Information Security has over 15 years in various security roles in private and public sectors and has attained the professional certification of Certified Information Systems Security Professional (CISSP).


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program aligns with Wolfspeed's Enterprise Risk Management (ERM) program and addresses information technology and business environments. Our cyber risk management program is designed based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and we aim to incorporate industry best practices throughout.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our Information Security (InfoSec) Governance, Risk and Compliance (GRC) organization leverages multiple methods and overlapping capabilities to protect the confidentiality, integrity and availability of our data, information and intellectual property. Assessments of Wolfspeed's cyber program are conducted by internal audit and third-party information and cyber experts to monitor the effectiveness and maturity level of Wolfspeed's cybersecurity program.


text: Cybersecurity tabletop exercises and event simulations are conducted with management, incorporating external resources and advisors, to test our ability and preparedness to respond to cyber threats and identify any areas of weakness. The program, standard operating procedures and supporting tools for determining thresholds for materiality are incorporated as a key component to the incident response program and related activities.


text: All employees are required to complete cybersecurity training semiannually, with additional on-demand training and phishing campaigns offered throughout the year. InfoSec GRC's approach to cybersecurity is structured to align with Wolfspeed's business goals, objectives and regulatory requirements and covers all company locations, globally.


text: Engagement of Third Parties Given the complex and quickly evolving nature of cybersecurity threats, we engage third-party advisors to assist our team in developing and maintaining effective cybersecurity risk management. Partnering with external entities allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023 we engaged a global cybersecurity leader to conduct an external assessment of our Information Security program, which included consideration of the cybersecurity framework, organizational structure and collective capabilities.


text: Oversight of Third-party Risk As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments. Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For example, we conduct security risk assessments of third-party providers that request or require access to our digital and information assets.


text: As of the date of this Annual Report, we have not identified a material cyber incident that would have a material impact on our business, results of operations, or financial condition; however, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that we will not suffer a material cyber incident in the future. Refer to Item 1A "Risk Factors" of this Annual Report for further discussion on cybersecurity risks.


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk program and practices, including cybersecurity risks, with members of senior leadership and management. In turn, the audit committee periodically reports on its review to the full board of directors.


text: Our Chief Information Officer (CIO) meets at a regular cadence with a member of the board of directors who is the board's cybersecurity designee. The CIO also briefs the audit committee on the effectiveness of Wolfspeed's cyber risk management program quarterly or in accordance with significant events. In addition, the board of directors is advised by our CIO on Wolfspeed's cybersecurity risk exposures and steps taken to monitor and mitigate cybersecurity risks.


text: Wolfspeed's Senior Director of Information Security leads our InfoSec GRC organization and is responsible for the implementation, operation, and monitoring of our cybersecurity risk management program. Our Senior Director of Information Security reports to the CIO, who reports to the Executive Vice President, Chief Financial Officer. The Senior Director of Information Security has over 16 years of experience in the cybersecurity space and has completed advanced training in the fields of cybersecurity and technology.


text: Responsible for assessing and managing our cyber risk management program, the InfoSec GRC organization is comprised of multiple teams that address and respond to cyber risk related to identification and access management, data protection, security architecture and engineering, security operations, insider threat, and cyber defense. The InfoSec GRC oversees compliance with our cybersecurity framework, including benchmarking, within the organization and facilitates cybersecurity risk management activities. The InfoSec GRC teams also oversee the review and approval process of policies and the security awareness program. Each team reports directly to the Senior Director of Information Security who is responsible for informing the CIO, information technology leadership and senior leadership teams on the prevention, detection, mitigation, and remediation of the program, including cybersecurity incidents.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program aligns with Wolfspeed's Enterprise Risk Management ("ERM") program and addresses information technology and business environments. Our cyber risk management program is designed based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and we aim to incorporate industry best practices throughout.


text: Our Information Security ("InfoSec") Governance, Risk and Compliance ("GRC") organization leverages multiple methods and overlapping capabilities to protect the confidentiality, integrity and availability of our data, information and intellectual property. Assessments of Wolfspeed's cyber program are conducted by internal audit and third-party information and cyber experts to monitor the effectiveness and maturity level of Wolfspeed's cybersecurity program.


text: Engagement of Third Parties Given the complex and quickly evolving nature of cybersecurity threats, we engage third-party advisors to assist our team in developing and maintaining effective cybersecurity risk management. Partnering with external entities allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2025 we engaged a global cybersecurity leader to conduct an external assessment of our Information Security program, which included consideration of the cybersecurity framework, organizational structure and collective capabilities.


text: As of the date of this Annual Report, we have not identified a material cyber incident that would have a material impact on our business, results of operations, or financial condition; however, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that we will not suffer a material cyber incident in the future. Refer to Part 1, Item 1A "Risk Factors" of this Annual Report for further discussion on cybersecurity risks.


text: Our Chief Information Officer (the "CIO") meets at a regular cadence with a member of the board of directors who is the board's cybersecurity designee. The CIO also briefs the audit committee on the effectiveness of Wolfspeed's cyber risk management program quarterly or in accordance with significant events. In addition, the board of directors is advised by our CIO on Wolfspeed's cybersecurity risk exposures and steps taken to monitor and mitigate cybersecurity risks.


text: Wolfspeed's VP, Chief Information Security Officer (the "CISO"), with over 25 years of experience in Fortune 500 companies including in aspects of IT, infrastructure, information security including multiple CISO roles, and certifications across IT and information security, leads our InfoSec GRC organization and is responsible for the implementation, operation, and monitoring of our cybersecurity risk management program. Our CISO reports to the CIO, who reports to the Chief Executive Officer.


text: Responsible for assessing and managing our cyber risk management program, the InfoSec GRC organization is comprised of multiple teams that address and respond to cyber risk related to identification and access management, data protection, security architecture and engineering, security operations, insider threat, and cyber defense. The InfoSec GRC oversees compliance with our cybersecurity framework, including benchmarking within the organization and facilitates cybersecurity risk management activities. The InfoSec GRC teams also oversee the review and approval process of policies and the security awareness program. Each team reports directly to the Senior Director of Information Security who is responsible for informing the CIO, information technology leadership and senior leadership teams on the prevention, detection, mitigation, and remediation of the program, including cybersecurity incidents.


text: Risk oversight and management is a key role for the Board and its committees. The Board is responsible for identifying and understanding Enbridge's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.

companyName: ENBRIDGE INC

ticker: ENB


text: Oversight of cybersecurity is integrated into the responsibilities of the Board. The Audit, Finance and Risk Committee (the AFRC) provides oversight of cybersecurity matters, particularly as they relate to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. The Safety and Reliability Committee (SRC) has oversight responsibility for security (physical, data and cyber) including as it relates to operational risk and controls, safety, operations integrity and reliability, and asset operations.


text: Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk. This includes quarterly reports to the AFRC and SRC on cybersecurity matters. In addition, on an annual basis management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks (including cybersecurity), highlighting top risks and trends. The annual CRA is an integrated enterprise-wide process. We assess and rank risks based on impact and probability, and we strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk category relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the SRC an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and that appropriate treatments are in place to manage those risks.


text: Cybersecurity has been identified as a top risk as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Cybersecurity risk is described in Item 1A. Risk Factors.


text: Enbridge's management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO), who has over two decades of international leadership in the business of technology. We also engage independent third parties to assess our cybersecurity program, track their recommendations and use those to further improve the program. Reporting to the CIO is the Chief Information Security Officer who is in charge of our cybersecurity program and oversees the 24x7x365 Security Operations Center (SOC).


text: We conduct continuous assessments of our cybersecurity standards, perform regular tests of our ability to respond and recover, and monitor for potential threats. To further mitigate threats, we collaborate with governments and regulatory agencies, and take part in external events to learn and share. Our workforce participates in regular security awareness training, including exercises to build capabilities to identify and report suspect phishing emails to our SOC. In the last year, we continued to expand the cybersecurity training and simulated testing we administer to high-risk groups within the organization. A tailored cybersecurity training course has been implemented for team members in operational technology roles, and we have increased the frequency of phishing simulation tests.


text: We have a cybersecurity third party risk management program, which is an evolving, cross-functional program to help assess and mitigate risks from third party vendors and other service providers. Our cybersecurity team also uses several layers of defense and protection technologies, cybersecurity experts, and automated alerting and response mechanisms to reduce risk to Enbridge.


text: Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced an increasing number of cybersecurity threats in recent years. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber attacks and other cybersecurity incidents pose threats to our technology systems and could materially adversely affect our business, operations, reputation or financial results." in Item 1A. Risk Factors.


text: Cybersecurity risk management, strategy and governance O versight of cybersecurity is integrated into the responsibilities of the Board and its committees. The Board is responsible for identifying and understanding Enbridge's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.


text: The Audit, Finance and Risk Committee (AFRC) provides primary oversight of cybersecurity matters, including with respect to financial risk and controls, integrity of financial data and public disclosures, and security of the cyber landscape across data and digital. Management provides quarterly cybersecurity reports to the AFRC and the Board and also reports to the Safety and Reliability Committee, as deemed necessary, on cybersecurity issues related to safety, reliability and operations.


text: Each year, management prepares and provides to the Board and its committees a corporate risk assessment (CRA), which analyzes and prioritizes enterprise-wide risks, highlighting top risks and trends (including cybersecurity). The annual CRA is an integrated enterprise-wide process which engages each part of our business to assess and rank risks based on impact and probability. We strive to ensure that mitigation measures are appropriately designed, prioritized and resourced. The CRA report is reviewed by the Board committees with responsibility for the risk categories relevant to their mandate and is provided to the Board, which coordinates Enbridge's overall risk management approach. Complementary to the CRA, management prepares and provides to the Safety and Reliability Committee an annual top operational risk report that highlights the highest consequence operational risks across Enbridge and includes further detail on the risks and their treatment. This information helps inform the Board about the potential impact of top operational risks and of treatments in place to manage those risks.


text: Cybersecurity has been identified as a top risk, as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Although we devote significant resources and security measures to prevent unwanted intrusions and to protect our systems and data, we (and our third-party vendors) have experienced, and expect to continue to experience, cyber attacks of varying degrees in the conduct of our business, including, for example, denial of service attacks. Cybersecurity risk is described in Item 1A. Risk Factors.


text: Enbridge's management is responsible for the implementation of risk management strategies and monitoring performance. The technology and information services (TIS) function is centralized under the Senior Vice President & Chief Information Officer (CIO). We also engage independent third parties to assess our cybersecurity program, track their recommendations, and use those to further improve the program. Reporting to the CIO is the Chief Information Security Officer who is in charge of our cybersecurity program and oversees the 24x7x365 Security Operations Center (SOC).


text: We conduct continuous assessments of our cybersecurity standards, perform regular tests of our ability to respond and recover, and monitor for potential threats. To further mitigate threats, we collaborate with governments and regulatory agencies and take part in external events to learn and share. Our workforce participates in regular security awareness training, including exercises to build capabilities to identify and report suspect phishing emails to our SOC. In the last year, we continued to expand the cybersecurity training and simulated testing we administer to high-risk groups within the organization. A tailored cybersecurity training course has been implemented for team members in operational technology roles, and we have increased the frequency of phishing simulation tests.


text: We have a cybersecurity third-party risk management program, which is an evolving, cross-functional program to help assess and mitigate risks from third-party vendors and other service providers. Our cybersecurity team also uses several layers of defense and protection technologies, cybersecurity experts, and automated alerting and response mechanisms to reduce risk to Enbridge.


text: As detailed in our risk factors included in Item 1A, Chubb recognizes the significant risks posed by cybersecurity and data protection challenges, which could adversely affect our business, financial condition, and results of operations. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we evaluate changes and enhancements to our technology environment as well as conduct third party assessments to confirm that they meet our information security control requirements. Our cybersecurity program and control environment incorporate appropriate industry standards and best practices, such as the National Institutes of Standards and Technology Cyber Security Framework (NIST CSF), and is designed to comply with numerous U.S. federal and state and international laws, rules and regulations governing the protection of personal and confidential information of our clients and employees. We use various tools and methods to assess, identify and manage cybersecurity risk that are tested regularly, including the following:

companyName: Chubb Ltd

ticker: CB


text: Technological Tools Chubb uses information security tools designed to protect information and systems. Our Information Security team regularly monitors these tools to discover and respond promptly to anomalous and suspicious patterns. We also participate in information sharing networks (government and private) and deploy system updates and other technologies.


text: Employee Training We endeavor to provide all employees with data protection training. Employees involved with information protection, privacy and other risk management specialties also engage in specialized role-based training as is practicable. We use a variety of training methods, including computer-based training, role-based training, company intranet awareness campaigns and various simulation exercises.


text: Data Protection Culture Chubb actively promotes a data protection culture. We maintain policies and standards designed to protect personal and corporate information. The policies and standards are developed by a multi-disciplinary team, with participation from information security and IT compliance, privacy, IT legal, compliance and business representatives.


text: Risk Assessments and Operational Audit Our information security policies and protocols undergo regular assessments and audits, and we engage with external parties to review our protections, including benchmarking to industry standards and best practices, such as the NIST CSF. In addition, we benchmark our programs against key regulatory frameworks and conduct technical assessments of our controls, which may include penetration testing and other technical testing. These processes are integrated into our established Enterprise Risk Management (ERM) framework, which is led by Chubb's senior management and overseen by our Board's Risk & Finance Committee. Refer to "Enterprise Risk Management" under Item 1 for further description of our ERM function and Board oversight.


text: Chubb uses risk-based processes to oversee and identify cybersecurity risks associated with the use of third-party service providers and third-party hardware. These processes include contractual controls as well as risk-based diligence processes, periodic assessments, and monitoring. Chubb recognizes the growing risk associated with third-party hardware, software, and services, and we have taken steps we believe are appropriate to manage those risks. We review third-party software and hardware in our environment to understand the components used and what impact they could have on our overall cyber risk environment.


text: To our knowledge, and as of the filing date on this annual report, risks from cybersecurity threats, including potential risks arising from previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to materially affect Chubb's business strategy, results of operations, or financial condition. For more detail regarding cybersecurity threats, see our risk factor titled "A failure in our operational systems or infrastructure or those of third parties, including due to security breaches or cyber-attacks, could disrupt business, damage our reputation, and cause losses" under Item 1A.


text: Board and Management Governance We have cybersecurity and information technology oversight at the Board and management levels. Direct Chubb Board-level oversight is generally within the purview of two of the Board's committees: Audit and Risk & Finance.


text: The Audit Committee is responsible for oversight of our cybersecurity program and related exposures and risks. The Audit Committee periodically reports to the full Board and consults with the Risk & Finance Committee on such matters. The Audit Committee's review and oversight generally encompasses data breach risk and impact, cyber protection and detection controls, privacy matters, third-party risks (including risks from cybersecurity threats associated with any third-party service providers), cyber trends and events, and other topics. The Risk & Finance Committee is responsible for oversight of risk generally and identifying significant risks, which may include risks relating to cybersecurity and privacy, business continuity risk (including the resilience of IT operations and physical infrastructure) and cyber underwriting risk. The oversight responsibilities of the Audit and Risk & Finance Committees with respect to cyber security and information technology risks are each set forth in their respective charters. Members of management, including our Chief Information Security Officer (CISO) and Global Chief Technology Officer (CTO), regularly provide updates to these committees in person and through written reports. The Audit and Risk & Finance Committees also conduct a joint meeting on ERM matters, which includes coverage of strategic risk priorities, as well as Chubb's actions and mitigation efforts in response to such risks.


text: Cybersecurity risk management oversight is led by our CISO and CTO. Prior to joining Chubb in 2015, our CISO was Director of the threat analytics platform for a major cybersecurity incident detection and response company. Prior to that, our CISO was an executive leader within the information security practice and a technical architect with two global accounting firms. Our CTO has extensive experience as a chief technology officer in digital-first environments and was previously the chief technology officer of a large global bank, responsible for the bank's core infrastructure, end-user technology, production support, group architecture, cloud technology, and software license management. Our CTO holds a master's degree in geographical information systems and a bachelor's degree in artificial intelligence and computer science. Chubb management also benefits from the advice provided by a Cyber Advisory Board of external experts. The members of the Cyber Advisory Board have extensive experience and deep expertise on cybersecurity matters, several having served in senior government positions with executive responsibility for identifying and mitigating cyber threats across the globe.


text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.


text: As detailed in our risk factors included in Item 1A, Chubb recognizes the significant risks posed by cybersecurity and data protection challenges, which could adversely affect our business, financial condition, and results of operations. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we evaluate changes and enhancements to our technology environment as well as conduct third-party assessments to confirm that they meet our information security control requirements. Our cybersecurity program and control environment incorporate appropriate industry standards and best practices, such as the National Institute of Standards and Technology Cyber Security Framework (NIST CSF), and are designed to comply with numerous U.S. federal and state and international laws, rules, and regulations governing the protection of personal and confidential information of our clients and employees. We use various tools and methods to assess, identify, and manage cybersecurity risk that are tested regularly, including the following:


text: Employee Training We endeavor to provide all employees with data protection training. Employees involved with information protection, privacy, and other risk management specialties also engage in specialized role-based training as is practicable. We use a variety of training methods, including computer-based training, role-based training, company intranet awareness campaigns, and various simulation exercises.


text: Data Protection Culture Chubb actively promotes a data protection culture. We maintain policies and standards designed to protect personal and corporate information. The policies and standards are developed by a multi-disciplinary team, with participation from information security and IT compliance, privacy, IT legal, compliance, and business representatives.


text: The management-level responsibility for assessing and managing cybersecurity risk is led by our CISO and CTO. Prior to joining Chubb in 2015, our CISO was Director of the threat analytics platform for a major cybersecurity incident detection and response company. Prior to that, our CISO was an executive leader within the information security practice and a technical architect with two global accounting firms. Our CTO has extensive experience as a chief technology officer in digital-first environments and was previously the chief technology officer of a large global bank, responsible for the bank's core infrastructure, end-user technology, production support, group architecture, cloud technology, and software license management. Our CTO holds a master's degree in geographical information systems and a bachelor's degree in artificial intelligence and computer science. Chubb management also benefits from the advice provided by a Cyber Advisory Board of external experts. The members of the Cyber Advisory Board have extensive experience and deep expertise on cybersecurity matters, several having served in senior government positions with executive responsibility for identifying and mitigating cyber threats across the globe.


text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity, and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations, and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.

companyName: AMEDISYS INC


text: Amedisys deploys a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments and penetration testing, to inform our leadership team of cybersecurity-based risks. In addition, we schedule tabletop exercises with management and other employees to test our cyber incident response plans. Amedisys has also received HITRUST certification for our internally developed applications which allows us to baseline our program to industry standards and best practices.