text: Our Board has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our and our subsidiaries' management, including our and our subsidiaries' senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Senior IT leadership (generally, chief information officers and/or chief information security officers) at the parent company and each subsidiary are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: LOEWS CORP

ticker: L

secItem: Item 1C


text: Information regarding cybersecurity risks may be elevated from senior IT leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our and our subsidiaries' senior IT leadership.


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important component of our overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the parent company and our subsidiaries.


text: The parent company and each subsidiary are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect each entity against cybersecurity risks and foster each entity's ability to respond to cybersecurity events. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, incident response plans and data security assessments of third-party service providers as a part of vendor management.


text: Risks from cybersecurity threats, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our and/or their business, results of operations, cash flows, financial condition and/or equity. For more information about these risks, see the risk factor titled "Failures or interruptions in or breaches to our or our subsidiaries' computer systems or information technology or communication infrastructure or those of our third party vendors could materially and adversely affect our or our subsidiaries' operations" under Item 1A.


text: Risk Management and Strategy LP places utmost priority on ensuring consistent and uninterrupted operational capability, as well as securing confidential business assets. We have systems and processes in place to assess, identify and manage cybersecurity incidents, and those systems and processes are integrated into our overall enterprise risk management system. We invest heavily in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents, and we have maintained a strong focus in consistently reviewing fundamental cybersecurity practices and ensuring we are reviewing emerging threats.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: To respond to the threat of security breaches and cyberattacks, we maintain a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, LP. This program includes mechanisms to monitor and detect unusual network activity, cybersecurity incident response and containment tools, and a response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees receive training and are tested routinely through simulated phishing attempts.


text: We rely heavily on third-party suppliers and vendors, and a cybersecurity incident at one of our suppliers or vendors could have a material adverse impact on our business operations. We evaluate third-party cybersecurity risk controls through various assessment activities carried out by LP employees and by third-party service providers acting on our behalf. We engage an independent third party to conduct an annual Security Program Assessment under the Capability Maturity Model Integration framework. For incident alerts and response, we outsource around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. In 2023, we also engaged a specialized third-party assessor to perform an operational technology security assessment for a subset of our manufacturing facilities. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.


text: No risks from cybersecurity threats have materially affected, nor has LP identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, LP, including our business strategy, results of operations or financial condition. Please see "Risk Factors – Business and Operational Risk Factors – Cybersecurity risks related to the technology used in our operations and other business processes, as well as security breaches of Company, customer, consumer, employee, or vendor information, could adversely affect our business" in Item 1A of this annual report on Form 10-K for additional discussion of cybersecurity risks applicable to LP.


text: Management Responsibilities Our cybersecurity program is managed by our Information Security Officer (ISO). Our ISO has over six years of cybersecurity experience working in publicly traded companies, with expertise leading risk remediation efforts in vulnerability management, network security, security awareness, threat monitoring, data security and cloud security.


text: To more effectively share information and gain consensus regarding cybersecurity initiatives and prevention policies, the Company has in place an Enterprise Risk Management Committee consisting of various members of LP senior leadership including the Chief Legal Counsel and Chief Financial Officer. The Enterprise Risk Management Committee is chaired by our Chief Tax Officer. The ISO, along with her team, is responsible for leading an enterprise-wide information security strategy, including policy, standards, architecture, processes, and security technology. The Enterprise Risk Management Committee (i) meets quarterly and as-needed to review and discuss the Company's risks, including cybersecurity threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging threat landscape and (ii) reports risks related to any material cybersecurity incidents, as needed, to the Board of Directors and the Finance and Audit Committee (FAC) of the Board of Directors.


text: Board Responsibilities Oversight of risks from cybersecurity threats is shared by the Board of Directors and the FAC. The FAC oversees our cybersecurity program. The ISO provides the FAC with an annual presentation on our cybersecurity program, emerging threats, and the state of LP's cybersecurity maturity. In addition, the ISO provides updates to the FAC no less often than annually with respect to additional information regarding the cybersecurity program.


text: We maintain a robust cybersecurity program that we have designed with the goal of identifying, deterring, detecting, responding to, and managing potential cybersecurity risks and threats.

companyName: LOWES COMPANIES INC

ticker: LOW


text: Risk management is a central part of our cybersecurity program. We conduct regular risk assessments and monitor our information systems for potential vulnerabilities. We employ a risk quantification model to identify, measure, and prioritize cybersecurity and technology risks, and we implement corresponding security controls and safeguards based on model outputs. In addition to cybersecurity risks being tracked, managed, and monitored directly by the information security group, cybersecurity risks are also integrated into, and are among the risks evaluated and considered by, our enterprise risk management program. The Company's Chief Legal Officer provides centralized oversight of our enterprise risk management program, which is managed by our Chief Compliance Officer and the Office of Enterprise Risk Management in partnership with the Enterprise Risk Council (ERC). The ERC is comprised of senior Company leaders with broad enterprise experience, including our Chief Information Security Officer (CISO).


text: Processes and Procedures We have adopted physical, technological, and administrative controls on cybersecurity. Our risk management processes include, among others, the following features: • We leverage the National Institute of Standards and Technology security frameworks as well as established internal security standards, industry practices, and applicable regulatory requirements. Our program is designed to comply with a range of applicable industry standards, such as the Payment Card Industry Data Security Standard. • We maintain cybersecurity insurance coverage that provides protection against potential losses arising from certain cybersecurity incidents. • We require that cybersecurity awareness and data privacy training, along with company-wide and tailored training programs, be provided to associates annually. We also regularly conduct phishing and social engineering simulations, and host events to increase awareness, including an annual cybersecurity awareness summit and monthly campaigns. • We have a cybersecurity incident response plan in place which provides a framework for responding to cybersecurity incidents. Our information security team leverages technologies and vendors to monitor and respond to security threats via a dedicated security operations center. In the event of a security incident, a defined procedure outlines containment, response, and recovery actions that draw on resources and leadership across the Company, as needed. • A cross-functional team conducts periodic simulated exercises, and we perform regular vulnerability scanning and conduct vulnerability testing during the software development life cycle. • We collaborate with internal stakeholders and third-party assessors and consultants to conduct regular reviews, tests, and audits of our security program. This coordinated approach reviews security controls that safeguard our information assets, including payment information, through processes such as security control assessments and third-party penetration testing. Additionally, we utilize tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other evaluations to improve our security measures and strategies. • We also participate in various cybersecurity and retail industry groups to remain apprised of emerging cybersecurity risks, defense, mitigation strategies, and governance best practices.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We have developed contracting processes and terms to gain commitments from certain vendors and third-party service providers to adhere to appropriate security practices and outline specific security requirements and expectations, including compliance with industry standards, applicable laws and regulations, and our internal security policies. We regularly evaluate and assess vendor risk levels based on a variety of factors, such as the nature of shared data, potential impact to business continuity, and vendors' security posture. Our processes extend beyond initial evaluations to include proactive monitoring and routine oversight.


text: Cybersecurity incidents and risks of which we are aware as of the date of this Form 10-K have not materially affected our business strategy, results of operations, and financial condition, although we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, reputation, results of operations, or financial condition. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Our Chief Digital and Information Officer (CDIO), our CISO, and senior members of our information security group are responsible for identifying, assessing, and managing risks from cybersecurity threats. Our CISO, who manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security group and through internal escalation procedures, reports to the CDIO, who reports directly to our Chairman, President, and Chief Executive Officer.


text: The CDIO has served in various roles in information technology for over 25 years, holds undergraduate and graduate degrees in electrical and electronics engineering and computer science, and brings significant insights into cybersecurity strategies. The CISO has served in various roles in information security for over 30 years, including serving as a CISO of four public companies. The senior members of the information security group who report to the CISO have extensive experience in technology and security roles from serving with several large public companies and possess cybersecurity certifications, including Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Information Systems Auditor, among others.


text: Oversight responsibility over cybersecurity risk is shared by the Board and the Audit Committee, with the Audit Committee being primarily responsible for overseeing risks related to cybersecurity, data protection, and privacy matters. The Audit Committee regularly reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape, in addition to the results of third-party reviews and assessments of our security controls. Our CDIO or CISO provide regular cybersecurity updates in the form of written reports and presentations to the Audit Committee at its quarterly meetings, which are also provided to the full Board. We also have protocols by which certain cybersecurity incidents are escalated and, where appropriate, reported to the Audit Committee in a timely manner.


text: Risk management is a central part of our cybersecurity program. We conduct regular risk assessments and monitor our information systems for potential vulnerabilities. We employ a risk quantification model to identify, measure, and prioritize cybersecurity and technology risks, and we implement corresponding security controls and safeguards based on model outputs.


text: As part of our focus on the use of AI technology in our business, we developed an AI cybersecurity strategy designed to enable the building of secure and reliable AI systems while also managing ethical, legal, cyber, data privacy, and other technology risks. The Company also established an AI Governance Committee, which is composed of leaders across a variety of business, technology, and support functions, to oversee the creation and implementation of risk control and strategic implementation frameworks. In addition to cybersecurity risks being tracked, managed, and monitored directly by the information security group, cybersecurity risks are also integrated into, and are among the risks evaluated and considered by, our enterprise risk management program. The Company's Chief Legal Officer provides centralized oversight of our enterprise risk management program, which is managed by our Chief Compliance Officer and the Office of Enterprise Risk Management in partnership with the Enterprise Risk Council (ERC). The ERC is comprised of senior Company leaders with broad enterprise experience, including our Chief Information Security Officer (CISO).


text: Our Chief Digital and Information Officer ( CDIO), our CISO, and senior members of our information security group are responsible for identifying, assessing, and managing risks from cybersecurity threats. Our CISO, who manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security group and through internal escalation procedures, reports to the CDIO, who reports directly to our Chairman, President, and Chief Executive Officer.


text: Oversight responsibility over cybersecurity risk is shared by the Board and the Audit Committee, with the Audit Committee being primarily responsible for overseeing risks related to cybersecurity, data protection, privacy, and significant emerging technology. The Audit Committee regularly reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape, in addition to the results of third-party reviews and assessments of our security controls. Our CDIO or CISO provide regular cybersecurity updates in the form of written reports and presentations to the Audit Committee at its quarterly meetings, which are also provided to the full Board. We also have protocols by which certain cybersecurity incidents are escalated and, where appropriate, reported to the Audit Committee in a timely manner.


text: We recognize the importance of assessing, identifying and managing material risks associated with any "cybersecurity threat," as such term is defined in Item 106(a) of Regulation S-K. We assess cybersecurity risk on an annual basis and whenever management deems there to be a significant change to exposure or external threats. We also have several enterprise-wide and business unit-specific cybersecurity processes, technologies, and controls to aid in our efforts to identify, evaluate, and respond to such cybersecurity risk. As part of our cybersecurity risk management processes, we leverage our membership in the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) and utilize carefully vetted third-party information technology systems vendors to conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing. We consider cybersecurity risks associated with our use of third-party information technology vendors during the selection process and include ongoing monitoring as part of our cybersecurity processes. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident," as such term is defined in Item 106(a) of Regulation S-K.

companyName: TELLURIAN INC. /DE/


text: Chaired by Jonathan Gross, who holds the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD) and Carnegie Mellon University, the Cybersecurity Committee of the Company's Board of Directors is responsible for assisting the Board of Directors in fulfilling its oversight responsibilities with respect to (i) cybersecurity risks and (ii) policies and practices to monitor and mitigate cybersecurity risks. The Company's Board of Directors and its Cybersecurity Committee are briefed regularly on Tellurian's cybersecurity risks and other cybersecurity-related matters. Additionally, we have established the Cybersecurity Management Committee to provide executive oversight of our cybersecurity risk management processes. The Cybersecurity Management Committee is chaired by Michael Dean, our Chief Information Security Officer (CISO), who has over 30 years of cybersecurity management and information technology leadership experience, and includes our Chief Executive Officer, President, General Counsel and Chief Accounting Officer, among other members of our management team. The Cybersecurity Management Committee holds regular meetings at least quarterly and special meetings as necessary to review identified cybersecurity threat risks or incidences and monitor the operation of our incident response plan. As part of our incident response procedures, our CISO is required to report any identified material cybersecurity incident promptly to our Chief Executive Officer, our President and the Cybersecurity Committee.


text: We are committed to protecting our intellectual property, customer and employee data, and the information technology systems critical to keeping our customers, employees, contractors and others aligned and allowing our operations to function properly. Our Board of Directors and its committees are involved on an ongoing basis in the oversight of our material enterprise-related risks, including cybersecurity risks. Our processes for oversight of cybersecurity-related risks are fully integrated into our overall enterprise risk management program, which is led by our General Counsel. We assign a member of our executive management team to report material information to our Board of Directors regarding each of our most significant enterprise risks. We have identified a separate risk for enterprise cybersecurity. The Audit Committee, in connection with the Chief Information Officer, provides primary oversight for cybersecurity risk for the company.

companyName: MARCUS CORP

ticker: MCS


text: The information security operations team within our information technology function reports to our Chief Information Officer, who regularly updates our Board of Directors and the Audit Committee. The function is governed by various policies on different aspects of cybersecurity. Our Board of Directors and the Audit Committee, as applicable, then reviews such information, including management's proposed mitigation strategies and plans, to monitor our progress on mitigating the risks.


text: Our Chief Information Officer and General Counsel meet regularly with the Board of Directors and its committees to review relevant areas including: • Key metrics of the information security/cybersecurity program; • The purchase of cybersecurity risk insurance to mitigate exposure to the company; • Monitoring and testing of backup and disaster recovery process; • Cybersecurity incident response and remediation procedures; and • Metrics of the company's training and compliance program on information security and awareness of cyber risk.


text: In addition, we have a management Cybersecurity Committee, which functions as a steering committee, to provide oversight and strategic direction for the cybersecurity program. The Cybersecurity Committee is comprised of our Chief Information Officer & Theatres Chief Information Technology Officer ("CIO"), Hotels Chief Information Technology Officer, Vice President of Information Security, General Counsel, and Chief Financial Officer. The Cybersecurity Committee meets quarterly to review the cybersecurity program, including risks and the status of key initiatives.


text: Our CIO has served in various roles in information technology for over 35 years. Our Hotels Chief Information Technology Officer holds an undergraduate degree in business administration and a master's degree in management of information systems and has served in various roles in information technology for over 30 years. Our Vice President of Information Security has served in various roles in information technology and information security for over 15 years, and has attained the professional certifications of PCI-ISA and PCI-DSS. Our General Counsel and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have significant experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats.


text: In addition to our Cybersecurity Committee, an information security operations team is in place, which monitors the environment for cybersecurity incidents on a continuous basis. We have also established incident response plans to assess and manage cybersecurity incidents. These plans, which are tested at least annually, include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to the company, are escalated to the Cybersecurity Committee. The Cybersecurity Committee, in coordination with internal and external advisors and legal counsel, is responsible for determining the materiality of cybersecurity incidents and coordinating any necessary disclosures. A materiality decision framework, which includes both quantitative and qualitative factors, is in place to guide the materiality decision. Critical cybersecurity incidents which are determined to be material are escalated to the Audit Committee, and when appropriate, to the Board of Directors.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective knowledge, tools, and awareness to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. The personnel training occurs at the time of hiring and at least once annually thereafter. The Cybersecurity Committee, along with other members of executive management, practices the incident response process through an annual tabletop exercise facilitated by external consultants.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, disaster recovery testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: A third-party risk management program is in place to address the risks posed by third parties. Through this program, the company evaluates the type of data that is shared with the third party and gains an understanding of the third party's cybersecurity risk profile. Higher risk third parties complete a vendor security self-assessment designed to provide a deeper level of understanding of the third party's risks and controls. Based on the results of this assessment, the entity may be added to our third-party monitoring solution, which provides updates and alerts related to the company's externally facing security posture.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the company, including its business strategy, results of operations or financial condition.


text: We are committed to protecting our intellectual property, customer and employee data, and the information technology systems critical to keeping our customers, employees, contractors and others aligned and allowing our operations to function properly. Our Board of Directors and its committees are involved on an ongoing basis in the oversight of our material enterprise-related risks, including cybersecurity risks. Our processes for oversight of cybersecurity-related risks are fully integrated into our overall enterprise risk management program, which is led by our General Counsel. We assign a member of our executive management team to report material information to our Board of Directors regarding each of our most significant enterprise risks. We have identified a separate risk for enterprise cybersecurity. The Audit Committee, in consultation with the Chief Information Officer, provides primary oversight for cybersecurity risk for the company.


text: Our CIO has served in various roles in information technology for over 35 years. Our Hotels Chief Information Technology Officer holds an undergraduate degree in business administration and a master's degree in management of information systems and has served in various roles in information technology for over 30 years. Our Vice President of Information Security has served in various roles in information technology and information security for over 15 years. Our General Counsel and Chief Financial Officer each holds undergraduate and graduate degrees in their respective field, and each has significant experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Risk Management Strategy In addition to our Cybersecurity Committee, an information security operations team is in place, which monitors the environment for cybersecurity incidents on a continuous basis. We have also established incident response plans to assess and manage cybersecurity incidents. These plans, which are tested at least annually, include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to the company, are escalated to the Cybersecurity Committee. The Cybersecurity Committee, in coordination with internal and external advisors and legal counsel, is responsible for determining the materiality of cybersecurity incidents and coordinating any necessary disclosures. A materiality decision framework, which includes both quantitative and qualitative factors, is in place to guide the materiality decision. Critical cybersecurity incidents which are determined to be material are escalated to the Audit Committee, and when appropriate, to the Board of Directors.


text: As a professional services firm that processes confidential and sensitive information, such as personal information, cybersecurity risk management is an integral part of our enterprise risk management strategy. Our cybersecurity risk management program has been designed based on industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework and ISO/IEC:27001, and provides a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with our use of services, applications and products provided by third-party vendors and service providers.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: Our cybersecurity risk management program is coordinated by cross-functional teams, including risk management, legal and compliance, business resiliency management and information security. These teams develop, implement and maintain our compliance policies, programs and training, business resiliency, disaster recovery and information security frameworks, solutions and procedures. They also work closely with our business, internal audit, finance and IT staff to identify, assess and mitigate risks, including those associated with our use of third-party vendors and service providers, and to monitor and take steps designed to prevent security incidents in our technology environment.


text: Our cybersecurity risk management framework includes (1) procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), (2) technical IT controls designed to manage risks associated with cybersecurity incidents (such as multifactor authentication and requirements for VPN or private channel access to our systems), and (3) formal policies and procedures designed to address cybersecurity incidents. Our formal policies and procedures designed to address cybersecurity incidents include steps for verifying and assessing the severity of a cybersecurity incident, identifying the source of a cybersecurity incident (including whether it is associated with a third-party service provider) and implementing cybersecurity countermeasures and mitigation strategies. Additionally, we have procedures for informing senior management and our Board of Directors of potentially material cybersecurity incidents. We also periodically engage third-party security consultants to assess our cybersecurity program and to perform penetration testing on our security environment and controls. In addition, cybersecurity training is provided to all newly hired colleagues and then at least annually for all colleagues. We also conduct regular ongoing cybersecurity awareness campaigns and phishing tests and provide training in response to such tests as appropriate.


text: Our Board of Directors has overall oversight responsibility for the Company's risk management and receives updates from management throughout the year on cybersecurity matters and other material risks facing the Company. Additionally, the Audit Committee regularly reviews the Company's policies and practices with respect to risk assessment and risk management, including cybersecurity risks, and reports to the full Board of Directors on a regular basis. The Audit Committee is responsible for overseeing the Company's enterprise risk management policies and processes, including discussing with management the Company's major risk exposures and the steps that have been taken to monitor and control such exposures, including those arising from cybersecurity risks.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis. Management's efforts include establishing processes designed to ensure that potential cybersecurity risks are monitored, putting in place mitigation and remedial measures and implementing and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). Our CIO has significant expertise and over a decade of experience working in technology. Our CISO has over twenty years of experience working in cybersecurity and maintains a Certified Information Systems Security Professional certification. Our CISO and CIO receive reports from our cybersecurity team and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity team is comprised of experienced information systems security professionals and information security managers with many years of experience and various security certifications.


text: Management, including the CIO and CISO, regularly reviews with the Board of Directors and the Audit Committee the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Audit Committee outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, please see "Risk Factors – Cybersecurity, Data Protection and Technology Risks" in this annual report on Form 10-K.


text: As a professional services firm that processes confidential and sensitive information, such as personal information, cybersecurity risk management is an integral part of our enterprise risk management strategy. Our cybersecurity risk management program has been designed based on industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and provides a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with our use of services, applications and products provided by third-party vendors and service providers.


text: Our cybersecurity risk management framework includes (1) procedures designed to assess the data privacy and cybersecurity practices of third-party vendors and service providers (including risk assessments and contractual protections), (2) technical IT controls designed to manage risks associated with cybersecurity incidents (such as multi-factor authentication and requirements for VPN or private channel access to our systems), and (3) formal policies and procedures designed to address cybersecurity incidents. Our formal policies and procedures designed to address cybersecurity incidents include steps for verifying and assessing the severity of a cybersecurity incident, identifying the source of a cybersecurity incident (including whether it is associated with a third-party service provider) and implementing cybersecurity countermeasures and mitigation strategies. Additionally, we have procedures for informing senior management and our Board of Directors of potentially material cybersecurity incidents. We also periodically engage third-party security consultants to assess our cybersecurity program and to perform penetration testing on our security environment and controls. In addition, cybersecurity training is provided to all newly hired colleagues and then at least annually for all colleagues. We also conduct regular ongoing cybersecurity awareness campaigns and phishing tests and provide training in response to such tests as appropriate.


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, please see "Risk Factors – Cybersecurity, Data Protection and Technology Risks" in this annual report on Form 10-K.


text: Cybersecurity risk is a part of our overall enterprise risk management assessment. Our cybersecurity program is modeled on the National Institute of Security Technology Cybersecurity Framework (NIST CSF) which provides the governance structure for our identification of, protection against, detection of, response to and recovery from cybersecurity threats and incidents, including those associated with our use of third-party applications and service providers.

companyName: MASCO CORP /DE/

ticker: MAS


text: Key components of our cybersecurity program include: • an enterprise organizational framework that consists of enterprise leaders that oversee our cybersecurity governance, including policies and standards, and functional business unit leaders that implement our cybersecurity policies; • the identification of our cybersecurity risks and vulnerabilities and the implementation of protections against cybersecurity threats and incidents, including regular training to our employees; • continual global threat monitoring and detection, in partnership with third-party service providers; • a process for assessing the severity of cybersecurity threats, identifying whether the cybersecurity threats are associated with a third-party service provider, and implementing an appropriate response and resolution to cybersecurity incidents, as necessary; and • risk-based cybersecurity audits led by our internal audit function, which include cybersecurity control maturity assessments (based on NIST CSF), as well as attack simulations and penetration testing performed by third-party service providers.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management and compliance programs, including cybersecurity. Our Board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which we are exposed, implement the appropriate protections to address such risks, identify cybersecurity threats and respond to and resolve cybersecurity incidents.


text: Management is responsible for identifying and assessing material cybersecurity risks on an ongoing basis and for developing, managing and implementing our cybersecurity program to assure that our potential cybersecurity risk exposures are monitored and appropriate mitigation measures are implemented. Our cybersecurity program is overseen by our Vice President, Information Technology and our Director, Enterprise Security. Our Vice President, Information Technology has significant professional experience in leading the information technology function and our Director, Enterprise Security has held various roles in cybersecurity and is an ISC2 Certified Information Security Professional (CISSP). Each periodically participates in various industry cyber forums and communicates industry best practices to the appropriate internal information security professionals.


text: Our cybersecurity program is managed and implemented by a team of enterprise level and business unit level information security professionals, partnering with third party advisory services, as needed. The team's focus is on our operational response to cybersecurity threats, exposure analysis, security governance and the design and implementation of our security controls. Our Incident Response Plan, developed by management, governs our process to respond to, remediate and resolve material cybersecurity incidents, including providing appropriate internal and external communication of such incidents.


text: At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments. In addition, our internal audit function provides regular updates to our Audit Committee on the results of our cybersecurity audits and related mitigation activities. In 2023, as part of our enterprise risk management update to our Board, our Vice President, Information Technology discussed risks and trends associated with information technology, including cyber-attacks, and current and future planned actions to mitigate such risks. In addition, in 2023, our Vice President, Information Technology reviewed with our Board updates related to our operational and resource readiness with respect to cyber incidents, our incident response processes and emerging cybersecurity risks.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We are subject to cybersecurity attacks, which could adversely impact our results of operations and financial position" in this annual report on Form 10-K.


text: Management is responsible for identifying and assessing material cybersecurity risks on an ongoing basis and for developing, managing and implementing our cybersecurity program to assure that our potential cybersecurity risk exposures are monitored and appropriate mitigation measures are implemented. Our cybersecurity program is overseen by our Vice President, Information Technology and our Director, Cybersecurity. Our Vice President, Information Technology has significant professional experience in leading the information technology function and our Director, Cybersecurity has held various roles in cybersecurity and is an ISC2 Certified Information Security Professional (CISSP). Each periodically participates in various industry cyber forums and communicates industry best practices to the appropriate internal information security professionals.


text: Our cybersecurity program is managed and implemented by a team of enterprise level and business unit level information security professionals, partnering with third party advisory services, as needed. The team's focus is on our operational response to cybersecurity threats, exposure analysis, security governance and the design and implementation of our security controls. Our Incident Response Plan and attendant processes, developed by management, governs our process to respond to, remediate and resolve material cybersecurity incidents, including providing appropriate internal and external communication of such incidents.


text: At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments. In addition, our internal audit function provides regular updates to our Audit Committee on the results of our cybersecurity audits and related mitigation activities. In 2024, as part of our enterprise risk management update to our Board, our Vice President, Information Technology discussed risks and trends associated with information technology, including cyber-attacks, and current and future planned actions to mitigate such risks. In addition, in 2024, our Vice President, Information Technology reviewed with our Board updates related to our operational and resource readiness with respect to cyber incidents, our incident response processes and emerging cybersecurity risks.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We are subject to cybersecurity attacks, which could adversely impact our results of operations and financial position" in this annual report on Form 10-K.


text: Matthews uses a number of means to assess cyber risks related to its third-party service providers, including processes governing interconnections with third-party systems and regular review of critical vendors' cybersecurity positions for potential risks. Third-party service provider assessments begin during onboarding and continue throughout the relationship, based upon an assessment of third-party risk. Those assessments include review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), and direct interaction with key vendors to assess and address risks. Contracts with third-party service providers contain appropriate protective provisions for the Company including audit rights, third-party notification obligations, and security requirements for the retention of data.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Matthews maintains a cybersecurity Incident Response Plan. In the event of a cybersecurity incident, designated personnel including members of Information Technology ("IT"), finance, legal, communications, human resources and any affected unit or department are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.


text: Matthews has experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to the Company's business, Matthews may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, the Company is not aware of any such attacks that have occurred since the beginning of fiscal 2024 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While the Company has implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, refer to Item 1A - "Risk Factors - The Company relies on information technology to operate the Company's business. Security breach incidents and breakdowns of information technologies, or failure to comply with laws governing data privacy and data protection, could disrupt the Company's operations, subject the Company to legal claims, and impact the Company's financial results."


text: Cybersecurity risks are overseen by the Audit Committee of the Board of Directors of the Company. The Audit Committee and the Board of Directors oversee and periodically review the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans. The Chief Information Officer ("CIO") and Director of IT Security provide regular reports to the Audit Committee, which include information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, direct or emerging threats to the Company, program maturity and strategy, third-party risk management, and benchmarking against its industry peers.


text: Management's Role Managing Risk Matthews' CIO and Director of IT Security are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO reports directly to the Company's Chief Financial Officer, and the Director of IT Security reports to the CIO. The CIO, Director of IT Security, and the Company's cybersecurity team have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure.


text: The Director of IT Security is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents. With the support of legal, the Director of IT Security is responsible for global regulatory compliance related to cybersecurity regulations and industry standards. The Director of IT Security also advises on the implementation of cybersecurity risk management in the Company's products and services as they are being developed.


text: As part of its risk management process, the Matthews management team also identifies, assesses and evaluates risks impacting the Company's operations, including those risks related to cybersecurity, and raises them for internal discussion, and where it is determined to be appropriate, issues are also raised to the Board of Directors for consideration.


text: affected unit or department are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.


text: Matthews has also established a cross-functional Artificial Intelligence ("AI") Council to ensure that artificial intelligence is used legally, ethically, effectively, and commercially successfully across its business. The Matthews AI Council includes key members of its IT and legal functions, including its Chief Information Security Officer ("CISO"). The Matthews AI Council serves as an extension of its cybersecurity program with a specific focus on artificial intelligence systems.


text: The Company maintains cybersecurity insurance coverage intended to protect against loss of business and other related consequences resulting from cyber incidents. Matthews reviews its insurance coverage annually for adequacy against operations and information systems. However, there can be no assurance that the Company's cyber liability insurance coverage will be available to it or provide adequate coverage in the event of a cybersecurity incident.


text: Notwithstanding the vigorous approach Matthews takes to cybersecurity, the Company may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. Matthews has experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to the Company's business, Matthews may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, the Company is not aware of any such attacks that have occurred since the beginning of fiscal 2025 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While the Company has implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, refer to Item 1A - "Risk Factors - The Company relies on information technology to operate the Company's business. Security breach incidents and breakdowns of information technologies, or failure to comply with laws governing data privacy and data protection, could disrupt the Company's operations, subject the Company to legal claims, and impact the Company's financial results."


text: At Matthews, the Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management efforts. The Company's Audit Committee regularly reviews and evaluates cybersecurity risks, the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans, and the procedures and policies implemented by management to identify, manage, and mitigate such risks. The Chief Information Officer ("CIO") and CISO provide regular reports to the Audit Committee, which include information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, direct or emerging threats to the Company, program maturity and strategy, third-party risk management, and benchmarking against its industry peers.


text: Management's Role Managing Risk Matthews' CIO and CISO are primarily responsible for assessing and managing cybersecurity risks. The CIO reports directly to the Company's Chief Financial Officer, and the CISO reports to the CIO. The CIO, CISO, and the Company's cybersecurity team have decades of experience in various roles managing information security, developing cybersecurity strategy and implementing, planning and operationalizing a comprehensive global IT infrastructure. In addition, the Company's legal team dedicates full-time internal resources to support the CISO in assessing and addressing compliance issues related to the various data protection and data privacy considerations arising from regulations, statutes and laws in the jurisdictions the Company operates.


text: The CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents. With the support of legal, the CISO is responsible for global regulatory compliance related to cybersecurity regulations and industry standards. The CISO also advises on the implementation of cybersecurity risk management in the Company's products and services as they are being developed.


text: Cybersecurity risk management is overseen both as a critical component of our overall Enterprise Risk Management program and as a standalone program. We have implemented a risk-based, multilayered approach to assessing, identifying, and managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.

companyName: MCCORMICK & CO INC

ticker: MKC


text: The team devotes significant resources to our cybersecurity risk management, which focuses on developing and implementing strategies and processes to protect the confidentiality, integrity, and availability of our assets and those of our consumers, customers and employees and seeks to continually improve our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. As part of this effort, the team periodically benchmarks our practices against the NIST Cyber Security and Privacy Frameworks, and other good practice control methods, which include updating technology, developing data privacy and security policies and procedures, implementing and assessing the effectiveness of controls, monitoring and routine testing of our information systems, conducting risk assessments of third-party service providers, providing data privacy and cybersecurity awareness training to employees and designing business processes to protect private data and mitigate the risk of cybersecurity incidents. We periodically conduct tests on our systems to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. We believe that these actions provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks, and we have not had a material cybersecurity threat or attack to date.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, and software and cloud-based service providers. We proactively evaluate the cybersecurity risk of our third-party service providers by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform ourselves during contracting and vendor selection processes. Third-party service providers security issues are documented, tracked, and monitored in order to mitigate risk.


text: Our employees, including part-time and temporary employees, undertake an annual cybersecurity training program, which is augmented by additional training and communications on information security and data privacy matters throughout the year.


text: We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to such cybersecurity threats or incidents. The plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping our Management Committee, the Audit Committee, the Board, and other key stakeholders informed and involved as appropriate. The plan is aligned to NIST guidance. It also includes the involvement of any personnel who may detect incidents, respond to incidents, resolve incidents, and manage communications and responsibilities with authorities about those incidents. The plan applies to all personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by us.


text: Further, we currently maintain a cybersecurity insurance that provides coverage for certain types of incidents; however, such insurance may not be sufficient in type or amount to cover claims related to all cyber threats or risks.


text: While we have not experienced any material cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Our Board and the Audit Committee are actively engaged in the oversight of our cybersecurity and data privacy program. The Board, at least annually, and the Audit Committee, periodically throughout the year, receive regular reports from our Chief Information Security Officer ("CISO") and members of the information security team on, among other things, recent developments, the state of the information security program, assessments of risks and threats to our information security systems, information security considerations arising with respect to our peers and third parties, third-party and independent reviews, and processes to maintain and strengthen information security systems. Under the oversight of the Audit Committee, we engage third-party experts to assess the state of our cybersecurity and data privacy program. The Audit Committee also provides regular updates to the Board, and the Board would be notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Management Committee, the Audit Committee or the Board in a timely manner.


text: We have an Executive Cybersecurity Steering Committee that is facilitated by our CISO, which is designed to engage business leadership and employ best practices, including ongoing enhancements to governance, risk and compliance. Our internal audit function also performs independent testing on aspects of the operations of our cybersecurity program and the supporting controls based upon its risk-based internal audit plan and reports the results of these audits in its periodic reports to the Audit Committee. Our CISO currently reports to our Chief Information and Digital Officer and is responsible for training and leading a dedicated information security team tasked with protecting data and preventing, identifying, and appropriately addressing cybersecurity threats. The CISO is a Certified Information Systems Security Professional with over 20 years of experience developing and maturing information security programs, including experience with leading privacy, enterprise risk, records management, business continuity and operational risk programs, among others.


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of the Company's risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, manage, monitor and report current and emerging non-financial risks. As part of this framework, the Company has an Enterprise Risk Management ("ERM") Committee which is chaired by the Company's Chief Risk & Compliance Officer. Our Chief Information Security Officer ("CISO") is also a member of the ERM Committee. The ERM Committee oversees the Company's risk management framework, including the implementation of the framework components across the Company and promotes a strong Company-wide culture of risk management, compliance and control.

companyName: S&P Global Inc.

ticker: SPGI


text: Engagement of Third-party Support We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers.


text: Impact of Risks from Cybersecurity Threats We are regularly subject to cybersecurity attacks. None of the risks from cybersecurity threats we've faced to date have materially affected, and we do not believe are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition. Governance.


text: Board Oversight of Cybersecurity Threats The board of directors of the Company (the "Board") has oversight responsibility for the Company's risk management framework, including technology and cybersecurity risks facing the Company.


text: Our Board, and Nominating and Audit Committees, gave significant consideration over the past several years to the appropriate Board and Committee oversight structure for risks associated with technology and cybersecurity. The full Board receives briefings from management on enterprise-wide technology, cybersecurity risk management and the overall technology and cybersecurity environment by management. Specifically, the full Board receives biannual reports from the Chief Digital Solutions Officer and the CISO.


text: The Board coordinates with the Audit Committee and Finance Committee to ensure active Board- and Committee-level oversight of the Company's technology and cyber risk profile, enterprise technology and cyber strategies, and information security initiatives. In addition, the Board has delegated primary responsibility for oversight of the Company's key risks, including cybersecurity, to the Audit Committee. The Audit Committee reviews technology and cybersecurity risks, as well as the Company's risk mitigation processes and internal control procedures to protect sensitive business information. The Audit Committee also receives regular updates from the Chief Digital Solutions Officer and the CISO on the Company's technology and cybersecurity programs. In addition, the Finance Committee oversees management's strategy with regard to technology and associated risks, including cybersecurity risks, when considering major capital expenditures and acquisitions. The Board also receives regular updates from the Audit Committee and Finance Committee on their in-depth Committee-level reviews.


text: Role of Management In addition to the risk management activities undertaken by the ERM Committee, our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has more than 26 years of technology industry leadership, cybersecurity expertise and engineering and operations experience. The corporate information security organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Central to this organization is our cyber incident response team, which is responsible for the Company's protection, detection and response capabilities. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, and (iii) remediation and (iv) preparation for future incidents. Incident responses are led by our Information Security team and supported by Legal, Compliance and other functions as appropriate. The CISO and the Chief Digital Solutions Officer provide regular updates to the Board and the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of the Company's risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, manage, monitor and report current and emerging non-financial risks. As part of this framework, the Company has an Enterprise Risk Management ("ERM") Committee which is chaired by the Company's Chief Risk Officer. Our Chief Information Security Officer ("CISO") is also a member of the ERM Committee. The ERM Committee oversees the Company's risk management framework, including the implementation of the framework components across the Company and promotes a strong Company-wide culture of risk management, compliance and control.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers.


text: Impact of Risks from Cybersecurity Threats We are regularly subject to cybersecurity attacks. None of the risks from cybersecurity threats we've faced to date have materially affected, and we do not believe are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition. For further information about risks we face from cybersecurity threats, see the risk factor entitled "Our size, scale and role in the global markets increases our risk for cyber attacks and other cyber-security risks. Our information systems and networks and those of our third-party service providers are exposed to risks related to cybersecurity and protection of confidential information, including material non-public information, which could have a material adverse effect on our business, financial condition or results of operations" in Item 1A, Risk Factors in this Annual Report on Form 10-K. Governance.


text: Role of Management In addition to the risk management activities undertaken by the ERM Committee, our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has more than 27 years of technology industry leadership, cybersecurity expertise and engineering and operations experience. The corporate information security organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Central to this organization is our cyber incident response team, which is responsible for the Company's protection, detection and response capabilities. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, and (iii) remediation and (iv) preparation for future incidents. Incident responses are led by our Information Security team and supported by Legal, Compliance and other functions as appropriate. The CISO and the Chief Digital Solutions Officer provide regular updates to the Board and the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.


text: Securing the Company's business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks.

companyName: CVS HEALTH Corp

ticker: CVS


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.


text: The Company has implemented a Cybersecurity Incident Response Plan (the "Plan"), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company's senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and Chief Privacy Officer ("CPO").


text: The Company's information technology systems and processes are assessed by independent third parties, as appropriate to their business requirements, for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls ("SOC") 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CISO leads management's assessment and management of cybersecurity risk. The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer. The CDDATO, CISO and the CPO, regularly review cybersecurity matters with management. The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.


text: The Board is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and related exposures, as part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks program to the Nominating and Corporate Governance Committee. As part of this oversight, the Nominating and Corporate Governance Committee reviews the Company's cybersecurity program periodically, and at least annually. The Company's CDDATO and CISO update the Nominating and Corporate Governance Committee periodically, and at least annually, and the full Board as needed, on the Company's cybersecurity program, including with respect to particular cybersecurity threats, incidents or new developments in the Company's risk profile. The CISO is a member of the Company's disclosure committee, and the CPO advises the disclosure committee on cybersecurity matters on an as-needed basis. During 2023, the Board conducted a review of its overall committee structure, membership and responsibilities in an effort to enhance its oversight. As part of this review, the Board has determined that it will shift the delegation of the oversight of the Company's cybersecurity risks program to the Audit Committee effective March 2024.


text: Risk Management and Strategy A.Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats The Company has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into and embedded in its overall enterprise risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: The Enterprise Risk Management Committee oversees cybersecurity risks Company-wide while the Company's Chief Technology Officer ("CTO"), a member of the Enterprise Risk Management Committee, oversees the Information Security business unit's cybersecurity management programs and activities. The Company's cybersecurity risk management program includes the following key elements: • formal cybersecurity risk assessment designed to help identify material cybersecurity risks to the Company's critical systems, information, services, and its broader enterprise information technology environment led by the Company's Information Security business unit and reported to its Enterprise Risk Management Committee; • a team comprised of information security, information technology, infrastructure, and compliance personnel responsible for directing the Company's cybersecurity risk assessment and security processes and its cybersecurity incident response; • third-party cybersecurity service provider, as needed, to conduct independent review and testing of the Company's cybersecurity risks and report to the Company; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness and prevention training for all employees; • a Security Incident Response Plan designed to respond to cybersecurity incidents, which is regularly tested; • a Vendor Risk Management Process for vetting third party service providers with access to the Company's information technology systems.


text: The Information Security business unit regularly evaluates the Company's cybersecurity risk profile and reports to the Board of Directors (the "Board"). In the event that a significant cybersecurity incident is identified, the Company engages a third-party cybersecurity incident response consultant, as needed, to provide an independent evaluation of the incident.


text: B.Oversight of Cybersecurity Risks Associated with Third Party Service Providers The Company oversees and identifies material risks from cybersecurity threats related to its use of third-party service providers in accordance with its Vendor Risk Management Process. The contracts with service providers are reviewed during the onboarding process, renewal periods, and as necessary. The contracts require service providers to report cybersecurity incidents that impact the Company's data or information systems or that can otherwise disrupt its operations to the Company on a timely basis.


text: C.Impact of Cybersecurity Threats on Business Strategy and Results of Operations The Company has experienced cybersecurity incidents in the past, and has been impacted by cybersecurity incidents experienced by its service providers, but none has materially affected the Company's operations. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risks Related to Technology and Cybersecurity" in "Part I – Item 1A. Risk Factors" for additional information.


text: A.Board of Directors' Oversight of Risks from Cybersecurity Threats The Company's Board considers cybersecurity risk as critical to the enterprise. The full Board oversees the Company's Enterprise Risk Management program which incorporates cybersecurity risks together with other top operational, reporting and compliance risks the Company manages. The full Board is kept apprised by Management of the Company's cybersecurity risk assessment results, and an escalation process exists to inform the Board of high-severity cybersecurity incidents that may occur. In addition, the Board periodically engages independent third-party technology experts to test the Company's information technology systems, including cybersecurity.


text: The Company's Enterprise Risk Management Committee provides the Board with an overview of cybersecurity risks regularly. Additionally, the Company's Chief Executive Officer ("CEO") provides the Board with an Information Security Incident Report for Board meetings, which summarizes new incidents that did not require "off-cycle" escalation to the Board, and status updates on previously reported high severity incidents, as well as a cybersecurity incident analysis report issued by a third-party cybersecurity service provider.


text: B.Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Company's Information Security business unit primarily manages the day-to-day operations of monitoring cybersecurity risks to the Company's information systems, takes prevention, detection, and remediation measures for cybersecurity incidents, makes initial assessment of reported cybersecurity incidents, and reports such incidents to the Company's CEO, Chief Operating Officer ("COO"), CTO, Board and Enterprise Risk Management Committee as well as certain regulatory bodies, as needed. The following five management personnel are primarily responsible for assessing and managing the Company's material risks from cybersecurity threats: • Gabriel Tirador, Chief Executive Officer: The Company's CEO, along with its COO, oversees the Technology team who monitors the Company's information technology systems for suspicious events. The Company's CEO reports to the Board regarding cybersecurity incidents and issues. The Company's CEO, COO and CTO oversee the use of third-party cybersecurity consultants by the Information Security business unit to engage in periodic evaluations. Mr. Tirador has over 30 years' experience in the property and casualty insurance industry and in the Company and is an inactive Certified Public Accountant. As CEO of the Company, he has overseen its Technology business unit for over 20 years, among other business units. • Victor Joseph, President and Chief Operating Officer: The Company's President and COO oversees the technology team who monitors the Company's information technology systems for suspicious events. Mr. Joseph has overseen the technology team since 2022. Mr. Joseph has been employed by the Company in various capacities since 2009, and was appointed Executive Vice President and COO in January 2022 and President and COO in January 2024. • Theodore R. Stalick, Senior Vice President and Chief Financial Officer: The Company's CFO oversees its enterprise risk management program which, among others, includes oversight of cybersecurity risk management and serves as Chairperson of the Company's Enterprise Risk Management Committee. Mr. Stalick has been the Company's CFO since 2001. Mr. Stalick is a Certified Public Accountant and has a Bachelors Degree in Business Administration, Accounting and Finance concentration, and an MBA, Business Analytics concentration. • Wilson Pang, Vice President and Chief Technology Officer: The Company's CTO regularly provides the Board with updates on cybersecurity risk management or significant reported cybersecurity incidents. The Company's CTO works with the Company's CEO, COO and Head of Information Security to determine the severity of cybersecurity incidents. The Company's CTO also works with its Head of Information Security to direct action in the event of a severe cybersecurity incident. Mr. Pang has over 20 years' experience in the technology industry. He has served in Chief Technology Officer and Chief Data Officer roles in several public companies and has deep expertise in technology, data, and artificial intelligence. He has a Master's and a Bachelor's Degree in electrical engineering.


text: • Dustin Howard, Head of Information Security: The Company's Head of Information Security supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment. The Company's Head of Information Security also oversees the creation of remediation action plans with the affected business units. Mr. Howard has over 30 years' experience managing various aspects of information technology, and has extensive expertise in information security, compliance, and information technology infrastructure and service delivery. He has served in Head of Information Security, Chief Information Officer and Vice President roles in several public companies and has maintained Certified Information Systems Security Professional ("CISSP") certification since 2001. He has a Bachelor's Degree in Business Administration and a Master's Degree in Information Systems.


text: The five management personnel above also serve in the Company's Enterprise Risk Management Committee and are informed about and discuss updates to the cybersecurity risk management programs and cybersecurity incidents, including any prevention and detection measures as well as mitigation and remediation measures for any reported cybersecurity incidents. The Enterprise Risk Management Committee oversees the Company's overall risk management processes that include oversight of material risks from cybersecurity threats. The CEO and CFO are also members of the Company's Disclosure Committee. The CTO and Head of Information Security participate in Disclosure Committee meetings, as needed, to facilitate discussion and provide information on cybersecurity incidents reported. The CEO, CTO and Head of Information Security provide the Board with information and updates on cybersecurity risks and incidents as in-house technology and cybersecurity experts during Board meetings or as needed.


text: Depending on the nature and severity of the reported cybersecurity incidents, the Enterprise Risk Management Committee may recommend activation of the Crisis Management Plan under the Company's Business Continuity Management Program. The Disclosure Committee is informed by the CEO of significant cybersecurity incidents for purposes of determining materiality.


text: Risk Management and Strategy A. Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats The Company has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into and embedded in its overall enterprise risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: A. Board of Directors' Oversight of Risks from Cybersecurity Threats The Company's Board considers cybersecurity risk as critical to the enterprise. The full Board oversees the Company's Enterprise Risk Management program which incorporates cybersecurity risks together with other top operational, reporting and compliance risks the Company manages. The full Board is kept apprised by Management of the Company's cybersecurity risk assessment results, and an escalation process exists to inform the Board of high-severity cybersecurity incidents that may occur. In addition, the Board periodically engages independent third-party technology experts to test the Company's information technology systems, including cybersecurity.


text: Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability. Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program. The Chief Security Officer (CSO) is responsible for

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Part I Item 1A, 1B, and 1C establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program. The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program. The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies. Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies. Entergy and the Registrant Subsidiaries' risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations. Entergy and the Registrant Subsidiaries' risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America's electric grid, to protect sensitive information, and to maintain secure business operations. Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners. Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.


text: Entergy and the Registrant Subsidiaries maintain access-management controls, including a layered multi-factor authentication process for network and system access, and a defense-in-depth security ecosystem that includes advanced threat detection from independent third parties and federal agencies, security logging and monitoring, and independent third-party penetration and vulnerability assessments. Relevant employees and contractors must complete cybersecurity trainings periodically to heighten security and threat awareness, promote best practices, and meet regulatory requirements. Additional multi-layered prevention and detection processes and technologies to mitigate and minimize the effects of cybersecurity risks include email security, continuous monitoring, vulnerability scanning, anti-virus and anti-malware software, backups and recovery strategy, network segregation, third-party security, and information protection.


text: Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents. This includes the Entergy Incident Response Team Plan, which outlines Entergy's procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident. The plan details the roles and responsibilities of Entergy's officers who would be engaged in such a response to an emergency incident, including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan.


text: As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats. To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise. A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection. Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from third-party vendors. In addition, Entergy and the Registrant Subsidiaries utilize technology and threat intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.


text: While Entergy and the Registrant Subsidiaries have experienced cybersecurity incidents, except as otherwise summarized above or discussed elsewhere in this report, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected them including their business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors" in Part I, Item 1A for a detailed description of the risks related to cybersecurity.


text: Corporate Governance The Board of Directors is responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk. The Audit Committee has the primary responsibility for overseeing risk management, including oversight of cybersecurity risk management practices and performance. The Audit Committee generally receives reports at each regular quarterly meeting provided by the Chief Information Officer, the CSO, the CISO, and the General Auditor on the cybersecurity management program. The reports focus on the programs and protocols in place to mitigate cybersecurity risks, led by the CSO. Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.