text: Additionally, as a public company, we are subject to the Sarbanes-Oxley Act requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting. These audits, which are conducted by our independent public accounting firm, assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of systems and data. Any control deficiencies that represent cybersecurity risks, as well as any recommended changes to our processes, if appropriate, would be reported to senior management and the Board of Trustees.


text: The information technology systems we rely upon to effectively manage our business data, communications, supply chain, fulfillment, and other business processes are subject to risk from security breaches and other significant disruptions. Such breaches and disruptions may occur through breaches by our personnel or by intrusions over the internet, malware, computer viruses, attachments to e-mails or by persons with whom we have commercial relationships. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Item 1A. Risk Factors— We are subject to cyber security risks and may incur increasing costs in an effort to minimize those risks".

companyName: Freshpet, Inc.

ticker: FRPT

secItem: Item 1C


text: Our information security organization, led by our Chief Information Officer (our "CIO") who reports to our Chief Financial Officer (our "CFO"), is comprised of both I.T. security leadership and dedicated cybersecurity staff.


text: The information security organization, collectively, has extensive technology security and program management experience including cybersecurity professional certifications such as Certified Information Systems Security Professional ("CISSP"), advanced degrees in Information Assurance, and numerous years' experience assessing and managing cybersecurity risk within the Department of Defense and other public companies. Our CIO has over 25 years of technology experience, including leading information governance, I.T. security, and cybersecurity teams and initiatives across both publicly traded companies and global organizations.


text: Our policies, practices, and standards for addressing material risks associated with cybersecurity are integrated into our overall risk management and are based on industry standards including the National Institute of Standards and Technology ("NIST") which aligns the prevention techniques, identification, protection, detection, response, and recovery related to an incident. These controls are tested by our information security organization and by independent third parties. We actively engage with industry groups for awareness of best practices and our third-party providers for industry benchmarking of critical areas within our cybersecurity posture.


text: Our organization-wide information security program focuses on implementing effective and efficient controls, technologies, and other processes to help protect, identify, assess, manage and mitigate material cybersecurity threats and incidents. These processes include, among other things, regular testing of these controls through table-top exercises, penetration and vulnerability testing, auditing of our information security by an independent third-party auditor, ongoing security awareness training for employees and other educational programs, and continuous monitoring of our cybersecurity posture. We also employ numerous tools including, but not limited to, segregated layers of controls for access to our systems and security tools that help identify, isolate, remediate, and recover from identified vulnerabilities and security incidents in a timely manner. Our cybersecurity posture is managed by both our information security organization and through partnerships with industry recognized cybersecurity firms.


text: We have also created, and tested through incident response drills, the Freshpet Incident Response Plan and Playbook, which together set forth policy-level directives as well as specific guidelines for implementation, that describe our process for responding in the event of certain defined cyber incidents. These protocols (i) define the roles and responsibilities of participants, relationships to other Company policies and procedures, and reporting requirements needed during an incident, (ii) provide a framework by which our Incident Response Team ("IRT") shall determine the scope and risk of an incident, respond appropriately to that incident, and inform the Board and others depending upon the nature and severity of the incident, and (iii) reduce the likelihood of a similar incident from reoccurring following identification of such an incident.


text: Our CIO and other members of the information security organization routinely engage with our CFO regarding cyber risk management activities and provide updates and data, as needed, to other members of our executive team to facilitate decisions regarding security matters. No less than twice per year, and more frequently as appropriate, our CFO and CIO also provide updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee of our Board of Directors, and provide other information as needed to facilitate the committee's oversight of our cybersecurity risk. Additionally, some of our Board members have completed specialized director training on cybersecurity risk.


text: Our Chief Technology Officer ("CTO") is responsible for cybersecurity within our company, including information technology risks, controls, strategies and procedures. The Cybersecurity Subcommittee of the Board of Directors oversees cybersecurity for our company and meets with the CTO at least quarterly to discuss the status of cybersecurity efforts as well as any security incidents. Cybersecurity Subcommittee materials are provided to the Audit Committee as well as the full Board of Directors. The members of the Cybersecurity Subcommittee brings at least 40 years of expertise and executive-level experience in information technology and cybersecurity to successfully support the CTO to maintain strong a cybersecurity strategy within our company. The Board of Directors believes that a strong cyber strategy based on industry accepted best practices is vital to protect our business, customers and assets.

companyName: JOINT Corp

ticker: JYNT


text: Our CTO Leverages more than 20 years of technology experience in the healthcare and financial services industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing within highly regulated global environments. He has managed technology compliance under the regulatory governance of frameworks such as HIPAA, GDPR, FDA, CCPA and TJC Hospital Accreditation. Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CTO leads management's assessment and management of cybersecurity risk. The CTO reports to the Company's Chief Executive Officer. The CTO regularly reviews cybersecurity matters with management.


text: A dedicated team of technology professionals works throughout the year to monitor all matters of risk relating to cybersecurity. We completed our ISO 27001 Information Security Management certification project culminating in a primary and secondary audit against the standard. We expect to complete the final remediation and updates to policies and procedures and achieve our certification in March 2025. Additionally, we operate and are compliant under the following provisions: HIPAA attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.


text: Vendors that have access to our information are required to manage such information in accordance with laws and appropriate privacy and security standards. Standards are applied on a per-contract basis and include requirements to have an information security program and report to us any incidents in which its confidential information or systems are compromised. Depending on the nature of the vendors' access to our information, we monitor and evaluate the controls and governance established with the vendors ranging from a continuous cadence to at least quarterly.


text: We have not directly encountered any incidents from cybersecurity threats to date, but in November 2022, a breach was suffered by one of our vendors, which resulted in the release of certain information with respect to our patients and employees. This breach is discussed in more detail in Item 1. Business, under Regulatory Environment entitled "HIPAA and State Privacy and Breach Notification Rules". Based upon our investigation and the cooperation with our vendor, we believe the data breach did not have a material adverse effect on our business or result in any material damage to us and do not believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Although we have not yet been materially impacted by any cybersecurity incident, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "If we fail to properly maintain the integrity of our data or to strategically implement, upgrade or consolidate existing information systems, our reputation and business could be materially adversely affected" and "If our security systems are breached, we may face civil liability and public perception of our security measures could be diminished, either of which would negatively affect our ability to attract and retain patients".


text: We annually assess our cybersecurity programs against third-party requirements, including HIPAA and the Sarbanes-Oxley Act (SOX). We test multiple aspects of cybersecurity regularly, including annual pen testing over our proprietary information systems and our technical recovery and incident response procedures annually.


text: We maintain a robust privacy compliance program. Employees receive periodic email communications, which train them to detect and report malware, ransomware and other malicious software and social engineering attempts that may compromise our information technology systems. In the second quarter of 2024, we implemented the KnowBe4 security training system and completed our first annual training in August 2024. In 2025, we plan to move to a quarterly testing regimen.


text: Currently, we rely on an established major incident management and communication process to address any potential cybersecurity incidents. This established process includes the use of third party partnerships to make available the distinct skill sets needed to assist in properly responding to any cybersecurity threat. We have established defined response procedures to effectively address any cyber threat that may occur regardless of the safeguards in place that minimize the chance of a successful cyberattack. The response procedures are designed to identify, analyze, contain and remediate such cyber incidents expeditiously. These procedures and approach to safeguard our information and assets will be continuously monitored by management and updated to evolve with the current cyber landscape in alignment with the ISO 27001 standard mentioned above.


text: We have designed and implemented a cybersecurity risk management program to help us identify, assess, and mitigate cybersecurity risks relevant to our business, based on the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0.

companyName: Medtronic plc

ticker: MDT


text: Our cybersecurity risk management program includes: • dedicated cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents, • cybersecurity regulatory based risk assessments for the Company's systems and applications (where required), • a formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident, • annual information security training program for all employees, including phishing awareness training, • cybersecurity works closely with application development and infrastructure & operation teams to embed security considerations into the foundation of technology, • engagement of third-party service providers to conduct assessment of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing, • a third-party risk assessment process for service providers, suppliers, and vendors.


text: In addition, given the smart technology within our devices, our product security includes design protocols and is supported by quality systems testing and use scanning tools to assess and detect vulnerabilities that could affect our products.


text: Risks from cybersecurity threats are integrated into Medtronic's enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company's business and operation.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. See Item 1A. Risk Factors under, "We rely on the proper function, security and availability of our information technology systems and data, as well as those of third parties throughout our global supply chain and our customer and payor base, to operate our business, and a breach, cyber-attack or other disruption to these systems or data could materially and adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position."


text: The cybersecurity risk management program is led by the Chief Information Security Officer (CISO). Our CISO has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. The CISO has held various executive level positions within Fortune 500 companies. Our CISO reports to the Chief Information Officer (CIO), who leads the Global Information Technology (IT) organization and works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Quality Committee of the Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee receives regular updates on the Company's cybersecurity risk management program from the CISO and CIO.


text: The cybersecurity risk management program is led by the Chief Information Security Officer (CISO). Our CISO has over 29 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. The CISO has held various executive level positions within Fortune 500 companies. Our CISO reports to the Chief Information Officer (CIO), who leads the Global Information Technology (IT) organization and works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Quality Committee of the Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee receives regular updates on the Company's cybersecurity risk management program from the CISO and CIO, and our procedures specify escalation of certain cybersecurity events to the Audit Committee chair and full Audit Committee.


text: Our risk management framework is designed to identify, assess, and mitigate potential threats that may impact the achievement of our business objectives. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Yext, Inc.

ticker: YEXT


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of potential risks, both internal and external, that could affect our business operations, financial stability, and reputation, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Our risk assessment methodology considers historical data, control effectiveness, and expert analysis to quantify and prioritize risks accordingly.


text: Following these risk assessments, we consider whether and how to adjust our strategies and controls to reduce the potential impact of identified risks. Our management team is responsible for executing risk mitigation plans and monitoring the effectiveness of these measures. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Technology Officer, who in turn reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: We work to educate our employees about cybersecurity risk management and the latest threats to enhance their awareness and to foster a security-conscious culture throughout the organization. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: We have engaged consultants and other third parties in connection with our risk assessment processes. These third parties have assisted us with the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We, like any technology company operating in the current environment, have experienced cybersecurity incidents in the past. However, as of the date of filing this Annual Report on Form 10-K, we have not previously experienced any cybersecurity incidents that were determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. The audit committee of our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.


text: Members from our legal, finance, internal audit and technology leadership comprise a management committee on cybersecurity (the "Cybersecurity Risk Committee"), which is primarily responsible to assess and manage our material risks from cybersecurity threats. The composition of our Risk Management Committee reflects a diverse and comprehensive range of expertise, critical for overseeing the effective evaluation and management of potential material cybersecurity risks within Yext. Members of the Cybersecurity Risk Committee hold advanced degrees in key fields relevant to our risk management efforts, including computer science, information security assurance, business administration, engineering, as well as legal, finance, and accounting disciplines. This combination of specialized knowledge and experience, reinforced by industry recognized certifications in these areas, positions the Cybersecurity Risk Committee to effectively evaluate and manage potential material cybersecurity risks.


text: Our Chief Information Security Officer and our Cybersecurity Risk Committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Cybersecurity Risk Committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: • Continuous monitoring to detect and respond to potential cybersecurity incidents promptly, including the use of advanced security technologies and threat intelligence; • Engagement with external cybersecurity experts to conduct independent assessments of our cybersecurity posture, ensuring that our defenses remain robust against an evolving the threat landscape; • Development and testing of incident response processes, plans and procedures to ensure preparedness in the event of a cybersecurity incident, including clearly defined roles and responsibilities enabling a swift and coordinated response; • Communication and update channels that allow for the timely dissemination of information regarding cybersecurity incidents and the effectiveness of implemented controls. This includes regular reporting to senior management, Cybersecurity Risk Committee and, as appropriate, to the Board of Directors; and • Regular review and updating of our cybersecurity policies and processes to reflect the changing threat landscape ensuring that our risk management practices remain effective and aligned with industry best practices.


text: Our Chief Information Security Officer and/or Chief Technology Officer provide quarterly briefings to the audit committee of our Board of Directors regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to our Board of Directors on such reports.


text: We, like any technology company operating in the current environment, have experienced cybersecurity incidents in the past. However, as of the date of filing this Annual Report on Form 10-K, we have not previously experienced any cybersecurity incidents that were determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: We are an externally managed company and our day-to-day operations are managed by our New Manager and our officers under the oversight of our Board of Directors. We are reliant on our New Manger, in identifying, assessing and managing material risks to our business from cybersecurity threats.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Our New Manager, through Rithm, maintains a comprehensive cybersecurity program and regularly assesses any risk of cybersecurity threats. In doing so, Rithm continuously monitors and tests our information systems for potential vulnerabilities pursuant to our cybersecurity program. Rithm's cybersecurity program is led by its interim Chief Information Security Officer ("CISO") and is part of its overall enterprise risk management program.


text: Rithm's dedicated cybersecurity personnel supervise and monitor our controls, technologies, systems and other processes utilized to mitigate any data loss, theft, exploitation, unauthorized access or other vulnerabilities that may affect our information or data. Specifically, Rithm's cybersecurity program consists of incident response procedures, information security and vendor management due diligence, as well as participation in industry consortiums, ongoing monitoring, internal and independent testing of information systems and continuous employee education and simulations. Rithm's independent testing includes both (i) periodic testing and evaluations performed by its internal audit team and (ii) annual network penetration testing conducted through independent third parties. Rithm's processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into its overall risk management system and processes. As part of these processes, Rithm monitors the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Additionally, in order to reduce cybersecurity risks related to our use of third-party service providers, Rithm (i) obligates our service providers to adhere to strict privacy and cybersecurity measures and (ii) performs risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is assigned a tiered risk rating, which determines the frequency and extent of evaluation for the service provider. Furthermore, Rithm collects and evaluates SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents for our key service providers.


text: To date, we have not experienced a material cybersecurity breach and no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While the New Manager has implemented processes and procedures that it believes are tailored to address and mitigate the cybersecurity threats that our Company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on our New Manager managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Security breaches and other cyber-security incidents could result in a loss of data, interruptions in our business, subject us to regulatory action and increased costs, each of which could have a material adverse effect on our business and results of operations." in this Annual Report.


text: Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors, in conjunction with the New Manager, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Rithm's CISO and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed. Additionally, Rithm has protocols by which certain cybersecurity incidents would be escalated in a timely manner to our Audit Committee and Board of Directors.


text: The New Manager, through Rithm, takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks. The CISO plays a critical role in protecting the Company's assets, data and reputation by developing a robust security strategy and security awareness. Rithm's current CISO brings over 20 years of experience in IT operations and information security with a proven track record working in large financial institutions, mortgage companies and banks, with expertise in managing complex security environments. The CISO, in conjunction with other executive leaders such as the CIO and the Chief Legal Officer, manages the Company's cybersecurity posture.


text: In doing so, the CISO receives regular reports prepared by our experienced cybersecurity personnel on cybersecurity threats and continuously reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks.


text: At the employee level, the New Manager maintains an experienced information technology team tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. The New Manager also holds employee trainings on privacy and cybersecurity, as well as records and information management, and it conduct phishing tests. We generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: We maintain standard procedures to help assess, identify and manage material risk posed by cybersecurity threats and regularly evaluate how we can integrate these procedures into our overall risk management processes. For example, we require that all of our employees who have access to our internal network complete formal cybersecurity training upon hire and on a periodic basis, including training on phishing, malware, and other cybersecurity risks. We also continuously evaluate our information technology systems and our practices that relate to our information technology systems. To date, we have not engaged any formal assessment or cyber security auditors or other third parties in connection with these efforts but may elect to do so in the future.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: To the extent we identify areas in our information systems that need improvement, we seek to timely implement and monitor such improvements. While we believe that we have taken appropriate security measures to protect our data and information technology systems, and have been informed by our third-party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third-party vendors, that could materially adversely affect our business and financial condition. For additional information regarding whether risks from cybersecurity threats are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: We currently engage a qualified IT consultant who reports to our Chief Executive Officer. This consultant has robust experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.


text: Our IT consultant regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board, which has overall responsibility for risk oversight.


text: Over the last two years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect is, including our business, results of operations, or financial condition.


text: We currently engage a qualified IT consultant who reports to our Chief Executive Officer. This consultant has over 30 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.


text: Our IT consultant regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. Our Chief Executive Officer periodically reports information regarding our cybersecurity program to our Board, which has overall responsibility for risk oversight. In addition, our management is responsible for alerting our Board of any material cybersecurity incidents.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Due to our structure as a REIT, the cybersecurity program, processes and strategy described in this section are limited to the corporate systems, information and service providers belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. Our Operating Partnership and its subsidiaries lease the hotel properties to XHR Holding, the Company's taxable REIT subsidiary, which engages third-party independent hotel management companies to operate and manage all aspects of the hotels; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to guest reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the property operators, managers and franchisors, and we must instead rely on such operators', managers' and franchisors' programs and processes to protect the properties in which we invest from various risks from cybersecurity threats.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our corporate-level cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical corporate network systems and corporate information; • a security function principally responsible for managing at the corporate-level (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our corporate security controls; • a cybersecurity awareness training of our corporate employees, incident response personnel, and senior management; • cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents that impact Xenia's corporate systems and information; and • a third-party risk management process for key service providers, suppliers, and vendors that support our corporate functions based on our assessment of their respective risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our corporate operations, business strategy, results of operations, or financial condition. As noted above, given our status as a REIT, we do not have actual or contractual access to the systems or information maintained by the property operators, managers and franchisors and we must rely on such operators', managers' and franchisors' programs and processes to protect the properties in which we invest.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program described above.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives periodic briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our enterprise risk management committee ("ERMC") and internal information technology security staff as part of the Board of Directors's continuing education on topics that impact public companies.


text: Our management team, including the ERMC and our Vice President of Information Technology and our legal and compliance function, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a key employee with over 20 years of experience in information technology and cybersecurity and various members of the senior management team with significant training in cyber incident response.


text: Our management team stays informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents that impact our corporate systems and information through various means, which may include briefings from internal and external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the corporate IT environment.


text: Key elements of our corporate-level cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical corporate network systems and corporate information; • a security function principally responsible for managing at the corporate-level (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our corporate security controls; • a cybersecurity awareness training of our corporate employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents that impact Xenia's corporate systems and information; and • a third-party risk management process for key service providers, suppliers, and vendors that support our corporate functions based on our assessment of their respective risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our corporate operations, business strategy, results of operations, or financial condition. See "Part I-Item 1A. Risk Factors - Technology and Information Systems Risks." As noted above, given our status as a REIT, we do not have actual or contractual access to the systems or information maintained by the property operators, managers and franchisors and we must rely on such operators', managers' and franchisors' programs and processes to protect the properties in which we invest.


text: The Audit Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives periodic briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our enterprise risk management committee ("ERMC") and internal information technology security staff as part of the Board of Directors' continuing education on topics that impact public companies.


text: We recognize the importance of being able to assess, effectively respond to, and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of our information systems, data, or network resources. To address these concerns, we have developed and implemented company-wide policies and procedures to help raise awareness of, identify, assess, and manage cybersecurity threats. Our Information Security organization has primary responsibility for the implementation of our cybersecurity policies and procedures and the management of our responses to information technology and security risks, including risks related to cybersecurity threats.

companyName: Vista Outdoor Inc.


text: Risk identification is managed through Information Technology ("IT") programs and service providers that specialize in identifying such risks, employee training, and information security policies. We utilize third-party monitoring services that monitor our vendor relationships for cybersecurity-related issues as well as a third party for vulnerability scanning and monitoring of our environments. The cybersecurity team annually conducts internal and external penetration testing with outside third-party cybersecurity experts. Employee training programs reinforce our information security policies, standards and practices, as well as the expectation that employees comply with these policies. We also train employees on how to identify potential cybersecurity risks and protect our resources and information. Training is mandatory for all relevant employees, on a periodic basis, and is supplemented by company-wide testing initiatives, including periodic phishing tests. We also require relevant employees to take periodic awareness training on data privacy, which includes information about pertinent laws, confidentiality, and security, as well as how to effectively report and respond to unauthorized access to or use of personal information Risk Management


text: Based on the risk and impact assessment mentioned above, the Information Security organization forms an Incident Response Team to identify the key responders for the security incident and maintain engagement and communication throughout the incident lifecycle, which may include, among other things, containment, eradication, recovery, and a review of lessons learned. In addition to the Incident Response Team, we have also formed a Cybersecurity Committee that is notified of information security incidents for the purposes of assessing the potential materiality of any such incident. The Cybersecurity Committee consists of management and other representatives of our IT, Finance, Legal, and Internal Audit teams with assistance of third-party consultants and outside legal counsel as appropriate. When necessary, the Cybersecurity Committee will bring matters to the attention of the Audit Committee of the Board of Directors as discussed more fully below.


text: To manage cybersecurity risks related to third-party service providers, we conduct security assessments of certain third-party providers before engagement and have established monitoring procedures related to data breaches or other security incidents originating from third parties. To assist in this effort, we may from time to time engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate certain potential cybersecurity incidents as appropriate.


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and there can be no assurance that our cybersecurity risk management policies and procedures will be fully implemented, complied with or successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors- Legal and Regulatory Risks- If our efforts to protect the security of personal information about our customers and consumers are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cybersecurity breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation and our reputation could suffer."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, oversight of cybersecurity and other information security risks.


text: The Audit Committee receives presentations at least annually regarding our enterprise risk management program, including reports from our Vice President of Internal Audit and our head of Information Technology, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures.


text: Management's Role in Managing Risk and Monitoring Incidents The leaders of our Information Security organization are responsible for assessing and managing our material risks from cybersecurity threats and supervision of both our internal information security personnel and our retained external cybersecurity consultants.


text: Other members of our management team, including those from legal, finance, and internal audit, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity team has extensive years of collective experience and members hold multiple certifications, including CISSP, CCNP, CISA, and CySA+.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems, internal networks and information.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: We have aligned our cybersecurity risk management program with recognized security frameworks such as the National Institute of Standards and Technology Cybersecurity Framework and ISO standards. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use these frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • an information security event response plan that includes procedures for responding to cybersecurity events; • an information security event response team (the "Response Team") principally responsible for managing our response to cybersecurity events; and • a third-party risk management process for key IT vendors based on our assessment of their criticality to our operations and respective risk profile.


text: During 2025, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity events, that materially affected us, including our business strategy, results of operations or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, and if realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in "Item 1A. Risk Factors."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity and Technology Risk Management Committee of the Board of Directors (the "Cybersecurity Committee") oversight of cybersecurity and other information technology risks. The Cybersecurity Committee oversees management's implementation of our cybersecurity risk management program.


text: The Cybersecurity Committee receives regular reports from our Chief Information Officer (" CIO ") regarding any significant cybersecurity events, as well as any events with lesser impact potential. The CIO periodically reports to the Board of Directors regarding cybersecurity risks and our cybersecurity risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our CIO, who is a member of our management team, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has over two decades of IT experience, including in applications, infrastructure, development, security and governance, and has presented as a featured speaker at numerous IT and security conferences. Our management team, including our CIO, has overall responsibility for our corporate cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Response Team, which includes our CIO and other members of our management team, has primary responsibility for assessing and managing our response to cybersecurity events.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and events through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; tabletop training exercises; and alerts and reports produced by security tools deployed in the IT environment.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as our business depends on customers trusting that their shopping experience with us is both reliable and safe. We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our regular enterprise risk management updates to the Audit Committee, (ii) our information technology and security related internal controls and (iii) our global incident response and vulnerability management programs.

companyName: Wayfair Inc.

ticker: W


text: We view cybersecurity as a shared responsibility across the company and this integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. All employees are required to complete yearly security training, and we periodically perform tabletop exercises with management participation. Further, our cybersecurity, privacy, procurement, legal and other cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection tools and a vulnerability identification program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Wayfair engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: In order to mitigate data or security incidents that may originate from third party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third party risks, and require security and privacy addenda to our contracts where applicable.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss,, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: Our Board of Directors (the "Board") is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Audit Committee is charged with reviewing and discussing our policies with respect to risk assessment and risk management, which includes overseeing our major financial, privacy, security, cybersecurity, and technology risk exposures and the steps our management has taken to monitor and control these exposures. At the management level, our Head of Cybersecurity and the cybersecurity teams are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our current Head of Cybersecurity has 20 years of industry experience, including serving as an enterprise Chief Information Security Officer for many years and having extensive experience in developing and leading risk management programs. Additionally, our Head of Cybersecurity holds multiple industry standard security certifications, including CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).


text: The Audit Committee receives reports, briefings and presentations from senior management, including our Head of Cybersecurity, at periodic committee meetings, including, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates. In addition to our scheduled meetings, our Global Incident Response Plan ensures that significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee is appropriate, ensuring the committee's and the Board's oversight is timely and responsive. Our Global Incident Response Plan also includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as our business depends on customers trusting that their shopping experience with us is both reliable and safe. We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our regular enterprise risk management updates to the Audit Committee, (ii) our information technology and security related internal controls and (iii) our global incident response and vulnerability management programs.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Wayfair engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. Working with these external experts enables us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: Our Board is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Our Audit Committee is charged with reviewing and discussing our policies with respect to risk assessment and risk management, which includes overseeing our major financial, privacy, security, cybersecurity and technology risk exposures and the steps our management has taken to monitor and control these exposures. At the management level, our Head of Cybersecurity and the cybersecurity teams are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our current Head of Cybersecurity has 20 years of industry experience, including serving as an enterprise Chief Information Security Officer for many years and having extensive experience in developing and leading risk management programs. Additionally, our Head of Cybersecurity holds multiple industry standard security certifications, including CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).


text: The availability of our products and services and fulfillment of our customer obligations depend on the continuing operation of our information technology and communications systems. Accordingly, cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. The Company's cybersecurity policies, standards and practices leverage recognized frameworks established by the International Organization for Standardization.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of implementing and maintaining preventative controls, identifying and monitoring threats and maximizing chances of recovery in the case of a cybersecurity incident.


text: The Company periodically engages assessors, consultants, auditors and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The Company attempts to adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. In engaging with third-party providers that will have access to certain sensitive Company data, the Company performs a cross-functional due diligence review and attempts to identify risks posed by engaging such third-party providers, and, where feasible, seeks to obtain contractual commitments from such third parties with respect to such engagement. The Company maintains cybersecurity insurance with coverage for security incident response expenses, certain losses due to network security failures, investigation expenses, privacy liability and certain third-party liability, subject to certain deductibles, exclusions and policy limits.


text: The Board and the Audit Committee are responsible for overseeing the Company's ERM processes, with the Audit Committee being tasked with overseeing cybersecurity risks facing the Company. Throughout the year, the Audit Committee receives relevant updates from management on cybersecurity matters, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the overall threat environment, technological trends, global employee training and efforts to enhance the Company's cybersecurity capabilities and preparedness. Relevant matters are also reviewed with the full Board on at least an annual basis.


text: The Company's Chief Information and Digital Officer (the "CIDO"), who reports directly to the Senior Vice President, Chief Financial Officer, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management programs, in partnership with business and functional leaders across the Company. The CIDO has 23 years of experience in the information technology and cybersecurity field, including previous roles in security architecture, audit, compliance, and governance.


text: Under the oversight of the CIDO, members of the Company's Information Technology and Compliance departments administer the Company's cybersecurity response policies, including assessing cybersecurity incidents as they occur and determining the severity of any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policies. These teams report to an incident response governance team, which is composed of members of the Company's senior leadership team. These teams monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report incidents to the Audit Committee, as appropriate.


text: For additional information regarding how cybersecurity threats have affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see Part I, Item 1A, "Risk Factors—General Risk Factors—Interruption, interference with, or failure of our information technology and communications systems could hurt our ability to effectively provide our products and services, which could harm our reputation, financial condition, operating results and cash flows".


text: The Company's Global Director of Information Security & Compliance (the "GDISC") is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management programs, in partnership with business and functional leaders across the Company. The GDISC has 22 years of experience in the information technology and cybersecurity field, including previous roles in cybersecurity leadership, governance, and technology architecture and engineering. The GDISC reports to the Company's Chief Information Officer (the "CIO"), who reports directly to the Senior Vice President, Chief Financial Officer. The CIO has 24 years of experience in the information technology and cybersecurity field, including previous roles in security architecture, audit, compliance, and governance.


text: Under the oversight of the GDISC, members of the Company's Information Technology and Compliance departments administer the Company's cybersecurity response policies, including assessing cybersecurity incidents as they occur and determining the severity of any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policies. These teams report to an incident response governance team, which is composed of members of the Company's senior leadership team. These teams monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report incidents to the Audit Committee, as appropriate.


text: For additional information regarding how cybersecurity threats have affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see Part I, Item 1A, "Risk Factors—General Risk Factors—Interruption, interference with, or failure of our information technology and communications systems could hurt our ability to effectively provide our products and services, which could harm our reputation, financial condition, operating results and cash flows."


text: We structure our information security program around the Federal Financial Institutions Examinations Council (FFIEC) Information Security program guidance, including the FFIEC Cybersecurity Assessment Toolkit, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our Chief Technology and Innovation Officer ("CTIO"), along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.

companyName: Kearny Financial Corp.

ticker: KRNY


text: We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.


text: We have established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain information security risk insurance coverage.


text: We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.


text: Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our CTIO provides quarterly reports to the Risk Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.


text: Our CTIO is part of the risk management function, reporting directly to our Chief Executive Officer ("CEO"). Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly and summaries of key issues discussed and actions taken are provided to the Risk Committee.


text: We structure our information security program around Federal Financial Institutions Examinations Council ("FFIEC") and Federal Deposit Insurance Corporation ("FDIC") regulatory guidance, along with other applicable industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to evaluate program effectiveness. Our Chief Technology and Innovation Officer ("CTIO"), along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.


text: We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain information security controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.


text: We have established processes and systems to identify and mitigate information security risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain cyber risk insurance coverage commensurate for an institution of our size and complexity.


text: We engage third party security experts to supplement our internal Information Security team for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: The secure maintenance and transmission of confidential information, as well as execution of transactions over the systems of our third-party service providers, is essential to protect us and our customers against fraud and security breaches and to maintain customer confidence. Information security and risk management are an integral part of our new product and service implementation and vendor relationship management to confirm that they all meet the minimum standards and policies established and approved by our Board. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our information security risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: Our Board is actively engaged in the oversight of our information security program. In 2025 the Board created an Information Security Committee, which is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material information security issues and risks. Our CTIO provides reports, at least quarterly, to the Information Security Committee regarding information security programs, key enterprise information security initiatives, and significant cybersecurity and privacy incidents. Our CTIO is part of the risk management function, reporting directly to our Chief Executive Officer ("CEO").


text: Park maintains comprehensive technologies and programs to help ensure our information technology and systems are effective and prepared for data privacy and cybersecurity risks, including oversight of our programs for security monitoring for internal and external threats to help ensure the confidentiality, availability and integrity of our information assets.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Park's Audit Committee oversees its cybersecurity risk assessment, risk management and risk mitigation policies and programs. Park's Enterprise Risk Management ("ERM") Committee reports to the Audit Committee and is responsible for identifying Park's cybersecurity risks. Park also has a dedicated Risk Management team that reports to the ERM Committee, which includes representatives from several departments, external consultants and insurance professionals who interface with brand and management partners to assist with risk mitigation at our properties. Additionally, we have engaged third-party service providers to assist with risk mitigation activities, implementing security monitoring capabilities designed to alert us to suspicious activity, and developing an incident response program that is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident. Our cybersecurity incident response plan requires prompt notification of senior management in the event of a cybersecurity incident that has affected or is expected to affect the Company and prompt briefings on subsequent developments as appropriate. We have undertaken table-top risk exercises and employees participate in mandatory annual trainings and receive communications regarding the cybersecurity environment to increase awareness throughout the Company. The Company's cybersecurity program is based on the U.S. National Institute for Standards and Technology Cybersecurity Framework. We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate.


text: Our Chief Financial Officer ("CFO") has significant work experience related to information security issues and oversight and is the executive officer that oversees our cybersecurity program, which includes the implementation of controls to identify threats, detect attacks and protect our information assets. Our dedicated ERM Committee, which includes our CFO and certain members of our executive leadership team, provides principal oversight and guidance of our cybersecurity risk management programs and processes. While our Board has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. Our Audit Committee is responsible for reviewing and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures and the guidelines, programs and steps implemented by management to assess, manage and mitigate any such exposures. The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report security instances to the Audit Committee as they occur, if material.


text: Cybersecurity Risks In addition to the reliance on our own information technology systems, we rely on the information technology systems of our hotel managers to protect proprietary and customer information as well as our third-party service providers who support key portions of our operations. Any compromises of our own network or the networks of our hotel managers or third-party service providers could materially affect our business, financial condition and results of operations. For a discussion of our cybersecurity risks, refer to "Part I - Item 1A. Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our information technology systems or the information technology systems of our hotel managers or third-party service providers could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K. Although we have experienced cybersecurity incidents, to date, none have had a material adverse effect on us. We carry insurance that helps provide protection against the potential losses arising from cybersecurity incidents, although we may incur expenses and losses related to a cybersecurity incident that are not covered by insurance or are in excess of our insurance coverage.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Park's Audit Committee oversees its cybersecurity risk assessment, risk management and risk mitigation policies and programs. Park's Enterprise Risk Management ("ERM") Committee reports to the Audit Committee and is responsible for identifying Park's cybersecurity risks. Park also has a dedicated Risk Management team that reports to the ERM Committee, which includes representatives from several departments, external consultants and insurance professionals who interface with brand and management partners to assist with risk mitigation at our properties. Additionally, we have engaged third-party service providers to assist with risk mitigation activities, implementing security monitoring capabilities designed to alert us to suspicious activity, and developing an incident response program that is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident. Our cybersecurity incident response plan requires prompt notification of senior management in the event of a cybersecurity incident that has affected or is expected to affect the Company and prompt briefings on subsequent developments as appropriate. We have undertaken table-top risk exercises and employees participate in mandatory annual trainings and receive communications regarding the cybersecurity environment to increase awareness throughout the Company. The Company's cybersecurity program is informed by industry-recognized security frameworks such as the U.S. National Institute of Standards and Technology Cybersecurity Framework. We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate.


text: Our Chief Financial Officer ("CFO") has significant work experience related to information security issues and oversight and is the executive officer that oversees our cybersecurity program, which includes the implementation of controls to identify threats, detect attacks and protect our information assets. Our dedicated ERM Committee, which includes our CFO and certain members of our executive leadership team, provides principal oversight and guidance of our cybersecurity risk management programs and processes. While our Board has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. Our Audit Committee is responsible for reviewing and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures and the guidelines, programs and steps implemented by management to assess, manage and mitigate any such exposures. The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report cybersecurity incidents to the Audit Committee as they occur, if material.


text: Cybersecurity Risks In addition to the reliance on our own information technology systems, we rely on the information technology systems of our hotel managers to protect proprietary and customer information as well as our third-party service providers who support key portions of our operations. Any compromises of our own network or the networks of our hotel managers or third-party service providers could materially affect our business, financial condition and results of operations. For a discussion of our cybersecurity risks, refer to "Part I - Item 1A. Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our hotel managers' or our own information technology and systems, including third-party service providers, could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K. Although we have experienced cybersecurity incidents, to date, none have had a material adverse effect on us. We carry insurance that helps provide protection against the potential losses arising from cybersecurity incidents, although we may incur expenses and losses related to a cybersecurity incident that are not covered by insurance or are in excess of our insurance coverage.


text: Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other cybersecurity threats present risks to the confidentiality, integrity and availability of our information systems, including those of the third parties upon which we rely, and our data residing in those systems. We take seriously our responsibility to protect sensitive consumer, customer and employee information.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Given the data-driven nature of our business and the prevalent use of technology in operating our business, we face cybersecurity risks that could materially affect our business strategy, results of operations and financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.


text: Strategy and Management Oversight We have an enterprise risk management function at Zillow Group responsible for the oversight and assessment of ongoing and emerging risks to our business operations and the integrity of our data, including the impact of cybersecurity risks. Our enterprise risk management team maintains a steering committee that oversees and opines on our processes to identify, prioritize and assess key risks, including risks related to cybersecurity. The steering committee is composed of senior, cross-functional business leaders with visibility into our key risks. Such members have expertise in the areas of risk management, business strategy, information technology, cybersecurity, legal and compliance, finance, communications, and business products, among others. In partnership with risk owners, this steering committee monitors risk exposures and verifies that efficient and effective risk-management strategies or acceptance and notification criteria are in place. The steering committee meets at least quarterly and its activities are overseen by the Audit Committee of our Board of Directors ("Board").


text: We also maintain an information security function that oversees the protection of our information assets through a program informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework and the Cyber Risk Institute's Cyber Profile. These frameworks guide our information security function in designing programs to assess cybersecurity risks and prevent cybersecurity incidents. The information security team is led by our Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide cybersecurity strategy, including assessing and managing risks from cybersecurity threats, and implementing technical security controls by maintaining policies, standards and processes. With more than 20 years of experience in the field of cybersecurity, our CISO has had extensive involvement with the information security function and the maintenance of a robust cybersecurity program. Our CISO has held data privacy and information security roles with increasing responsibility in the financial services, technology and casino industries and is a certified information systems security professional.


text: The information security team maintains incident response policies and procedures designed to help protect the integrity, availability and confidentiality of information and help prevent loss of service. Cybersecurity events and incidents may be reported or detected through a variety of means, including emails to centralized information security addresses, our online information technology ticketing system, automatic alerts and incident detection systems, direct discovery by our information security team, or reports from a third party. Additionally, our incident response policies and procedures specify the process for initial investigation and containment procedures, remediation tactics, retention of documentation and internal and external communications. Our incident response policies and procedures also specify processes for analyzing the severity of an identified incident, which serve to dictate the escalation procedures to notify varying levels of our risk management team. In response to cybersecurity incidents, we may involve external advisors to assist with remediation efforts and communications and we may seek to mitigate associated liabilities through our insurance coverage. Such third parties may include external legal counsel, forensic investigators and public relation firms, among others. These vendors serve to support our existing processes and procedures and operate as an extension of our enterprise risk management and information security functions.


text: Our internal audit team conducts security controls testing and provides independent validation that such controls are operating effectively on systems in scope for various regulatory and compliance requirements. Our regulatory compliance team uses third-party external auditors to perform independent testing against all systems in scope for our regulatory and customer- driven compliance obligations. The audit cadence aligns with regulatory and customer-driven needs. The scope of our audits includes all systems that store, transmit or process data. We also perform periodic third-party risk assessments, vulnerability testing, system and cloud security assessments against our information technology systems.


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology. We have a third-party service provider management program to manage cybersecurity risks associated with our use of these third-party service providers. The program includes the use of security questionnaires, review of statements of work and related information security addenda, procuring results of audits and compliance reviews and obtaining overviews of network infrastructure, among others. Based upon the extent and type of services utilized, reviews of certain third-party engagements are coordinated through members of the following management teams: procurement, legal, compliance, enterprise risk management and information security risk management, among others, as applicable. Depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the third-party, our third-party service provider management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our Board considers risk assessment and development of risk mitigation strategies to be a responsibility of the entire Board in consultation with the appropriate Board committees. The Board regularly engages in risk oversight on a broad range of matters, including challenges associated with strategic acquisitions, cybersecurity, regulatory and other legal and compliance matters. For more focused risk oversight, our Board committees are tasked with specific risk management roles.


text: The Audit Committee oversees major enterprise risks and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. Members of our legal, compliance, enterprise risk management and information security management teams provide information and updates on any significant issues related to these topics at the periodic Audit Committee meetings, which are typically held at least quarterly. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by internal audit and third party consultants, among others.


text: Audit Committee member education is provided throughout the year through presentations to and discussions with the Audit Committee led by members of management, third-party consultants, our independent registered public accounting firm and legal counsel, on topics including information security, among others. Members of our Audit Committee have expertise in the technology industry as well as corporate risk management strategies.


text: Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other cybersecurity threats present risks to the confidentiality, integrity and availability of our information systems, including those of the third parties upon which we rely, and our data residing in those systems. We take seriously our responsibility to protect sensitive consumer, customer and employee information and continually align our cybersecurity program with our overall business strategy.


text: As of the date of this Annual Report on Form 10-K, we have not identified material risks from known cybersecurity threats that have materially affected Zillow Group. Given the data-driven nature of our business and the prevalent use of technology in operating our business, we face cybersecurity risks inherent to our normal course of operation that, if realized, are reasonably likely to materially affect our business strategy, results of operations and financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.


text: Strategy and Management Oversight We have an enterprise risk management function responsible for the oversight and assessment of ongoing and emerging risks to our business operations and the integrity of our data, including the impact of cybersecurity risks. Our enterprise risk management team maintains a steering committee that oversees and opines on our processes to identify, prioritize and assess key risks, including risks related to cybersecurity. The steering committee is composed of senior leaders with visibility into our key risks. Such members have expertise in the areas of risk management, business strategy, information technology, cybersecurity, legal and compliance, finance, and business products, among others. In partnership with other stakeholders, this steering committee monitors risk exposures, promotes risk-management strategies, and implements acceptance and notification criteria. The activities of the steering committee are overseen by the Audit Committee of our Board (the "Audit Committee").


text: We also maintain an information security function that oversees the protection of our information assets through a program informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework and the Cyber Risk Institute's Cyber Profile. These frameworks guide our information security function in designing programs to assess cybersecurity risks and respond to cybersecurity incidents. The information security team is led by a designated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide cybersecurity strategy, including assessing and managing risks from cybersecurity threats, and implementing technical security controls by maintaining policies, standards and processes. With more than 20 years of experience in the field of technology and cybersecurity, our CISO has had extensive involvement with the information security function and the maintenance of a robust cybersecurity program. Our CISO has held data privacy and information security roles with increasing responsibility in heavily regulated industries such as financial services, technology and gaming and is a certified information systems security professional.