text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working independently but as part of a cohesive strategy to minimize risk, including the following: • Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and ensure associates are educated and prepared to address shared cybersecurity risks. • We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness. • We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies. • Our global cybersecurity program increasingly leverages intelligence-sharing capabilities about emerging threats within the Consumer Packaged Goods sector, across other industries, with specialized vendors, industry groups, and through public-private partnerships with government intelligence agencies. Such intelligence allows us to better detect and work to prevent emerging cybersecurity threats before they materialize. • The Company's cybersecurity policies, standards and processes are designed and implemented in light of the requirements of the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. • Our strategy to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through auditing, penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program.


text: We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading "A cybersecurity breach, disruption or misuse of our information systems, or our external business partners' information systems could have a material adverse effect on our business" in Item 1A. Risk Factors – Operational Risks.

companyName: PERRIGO Co plc

ticker: PRGO

secItem: Item 1C


text: The NGC, comprised solely of independent directors, is charged with oversight of risks related to global cybersecurity and operational resiliency. The NGC routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends and regulatory developments from the Chief Financial Officer ("CFO") and Senior Vice President, Information Technology and Services ("IT&S") Strategy and Business Partnering. The NGC meets separately in advance of each regular Board meeting and when needed in the event of a specific cybersecurity threat, and its Chair regularly reports out to the Board on key matters considered by the NGC. The Board is periodically briefed on related cybersecurity matters from other executives from Legal, Privacy, and IT&S, as well as external experts related to breach management, external attestation of the company's cybersecurity practices and processes, and evolving cybersecurity matters that may inform the company's cybersecurity strategy and approach. The Board has received and will continue to receive cybersecurity training.


text: Our overall information security efforts are led by the CFO and Senior Information Technology Executives. These leaders have substantial experience in cybersecurity including knowledge, skills, certifications, and background in cybersecurity.


text: We have a formalized breach management protocol that utilizes a cross-functional team to address global cybersecurity efforts that includes partnership with Legal, Risk, our CFO, IT&S Strategy and Business Partnering and Enterprise HR which lead matters when they occur. This collaborative approach, working with a wide range of key stakeholders to manage risk, allows us to effectively share and respond to threat intelligence. In the event of a specific cybersecurity threat or incident, management is notified in accordance with established escalation procedures. If appropriate, management then notifies the NGC, which may meet to describe the cybersecurity threat or incident before reporting out to the Board regarding the matter. We use forensic and other key third party service providers to assist the Company with its response in the event of a cybersecurity incident.


text: Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board of Directors and management. We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. While management is responsible for the day to day risk management, the Board of Directors, is responsible for the Company's overall risk oversight function, including cybersecurity risks. The Nominating & Governance Committee ("NGC") supports the Board of Directors by overseeing cybersecurity risks, policies and objectives. The Audit Committee supports the Board of Directors in overseeing the framework for risk assessments and enterprise risk management ("ERM") process. The Company's cybersecurity policies, standards and processes are designed and implemented in light of the requirements of the National Institute of Standards and Technology ("NIST") frameworks for cybersecurity and privacy.


text: Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working as part of a cohesive strategy to minimize risk including the following: • We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness. • Perrigo leverages the NIST cybersecurity framework to measure the capability of its cybersecurity program and we conduct third party assessments to measure the NIST ratings. • We maintain a cybersecurity risk register which is reviewed periodically with relevant stakeholders. Risks that are higher in impact are included within our Enterprise Risk Register which is reviewed with Executive Leadership and the Board of Directors. • Our processes used to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program. • Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and educate associates on cybersecurity risks. • We maintain cyber insurance coverage to help mitigate possible costs associated with a potential incident. • We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies.


text: We have processes in place designed to allow us to oversee and identify risks from cybersecurity threats associated with our use of third party service providers and suppliers through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and security rating platforms. We also include cybersecurity and information security language in our contracts where applicable. We require our suppliers and partners to report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties. We have established processes to contain the impact of potential security incidents on Perrigo's third party service providers.


text: As of December 31, 2024, we are unaware of any risks from cybersecurity threats (including previous cybersecurity incidents) that may have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading "A cybersecurity breach, disruption or misuse of our information systems, or our external business partners' information systems could have a material adverse effect on our business" in Item 1A. Risk Factors – Operational Risks.


text: Our overall information security efforts are led by the Chief Information Security Officer ("CISO"). The CISO has substantial experience in cybersecurity, including knowledge, skills, certifications, and background in the field. The CISO holds several key certifications including Certified Information Systems Security Professional ("CISSP"), Certified Secure Software Lifecycle Professional ("CSSLP") and Certified Ethical Hacker ("CeH").


text: While management is responsible for day-to-day risk management, the Board of Directors is responsible for the Company's overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The NGC, comprised solely of independent directors, supports the Board of Directors by overseeing cybersecurity risks, policies and objectives. As a part of its duties, the NGC regularly provides reports to the full Board of Directors.


text: The NGC routinely engages with the Chief Financial Officer ("CFO"), the CISO and Senior Vice President on a range of cybersecurity-related topics, including threats to the environment and vulnerability assessments, policies and practices, technology trends and regulatory developments. The NGC conducts regular committee meetings prior to each regular Board of Directors meeting and convenes additional sessions as necessary to address a specific cybersecurity threat.


text: Perrigo has an incident response team comprised of the CISO and senior leadership from Legal, Human Resources and Finance. We have a formalized breach management protocol and playbooks that are tested periodically. Perrigo uses a panel of forensic and third party service providers to assist the Company with its response in the event of a cybersecurity incident. We employ escalation procedures designed to notify management of certain specific cybersecurity threats or incidents. If deemed appropriate, management will notify the NGC, which may convene to discuss the cybersecurity threat before reporting to the Board of Directors on the matter.


text: We have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.

companyName: Zoom Communications, Inc.

ticker: ZM


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s). The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom's Chief Information Security Officer ("CISO").


text: Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and forensic investigators.


text: We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party's relevant security audits and assessments; conducting our own security assessments, and imposing contractual obligations related to information security.


text: For a description of the risks from cybersecurity threats that may materially affect us, see "Part I, Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. As outlined in its committee charter, the Cybersecurity Risk Management Committee of the Board ("Cybersecurity Risk Committee") assists the Board in fulfilling its oversight responsibility. Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer ("COO"), who reports directly to our Chief Executive Officer ("CEO"). Mr. Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company. Mr. Adams previously also served as Zoom's Chief Counsel to the COO and CISO.


text: The CISO provides regular briefings to our senior management and the Cybersecurity Risk Committee concerning relevant cybersecurity risks and the processes we have implemented to address them. The Cybersecurity Risk Committee and the Board also receive various reports, summaries, and presentations related to cybersecurity threats, risks, and mitigations.


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented certain technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide us with a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s), all as appropriate depending on the nature of the incident. The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom's Chief Information Security Officer ("CISO").


text: We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party's relevant security audits and assessments, conducting our own security assessments, and imposing contractual obligations related to information security.


text: As of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the risk factor titled "Our security measures, and those of the third parties with whom we work, have been compromised in the past and may be compromised in the future. If our security measures are compromised in the future or if our information technology fails, this could harm our reputation, expose us to significant fines and liability, impair our sales, and harm our business. In addition, our products and services may be perceived as not being secure. This perception may result in customers and users curtailing or ceasing their use of our products, us incurring significant liabilities, and our business being harmed" in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. As outlined in its committee charter, the Cybersecurity Risk Management Committee of the Board ("Cybersecurity Risk Committee") assists the Board in fulfilling its oversight responsibility. Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer ("COO"), who reports directly to our Chief Executive Officer ("CEO"). Mr. Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company. Mr. Adams previously served as Zoom's Chief Counsel to the COO and CISO.


text: Hilton has a dedicated Global Information Security team (collectively, the "GIS team") led by our Chief Information Security Officer ("CISO") that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The GIS team is organized into five functional areas: (i) cloud, network and infrastructure architecture security; (ii) application security; (iii) incident response; (iv) endpoint security and vulnerability management; and (v) governance, risk and compliance ("GRC"). Collectively, the GIS team has decades of dedicated cybersecurity experience with personnel certified in various disciplines, including data privacy, enterprise risk management, cloud security and ethical hacking.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: While the full board of directors has overall responsibility for risk oversight, for cyber security matters, it is supported by its Audit Committee, which regularly reports to the full board of directors. The Audit Committee assists the board of directors in monitoring cybersecurity risk by receiving quarterly reports and as needed updates from the Chief Information Officer and the CISO, that cover, among other things, our information security framework, threat assessment, response readiness and training efforts.


text: Hilton has adopted a Cybersecurity Policy that requires all employees to immediately report a potential cybersecurity incident to the GIS team, and all employees are required to certify their understanding of the Cybersecurity Policy on an annual basis. Our Global Cybersecurity Incident Response Plan ("CIRP") includes the criteria for determining if a cybersecurity incident is considered a qualifying cybersecurity incident ("QCI"), which requires management escalation and review, identifies the first response team and the leadership team responsible for supervising the response and provides guidelines for when and how to communicate such incident to the appropriate members of management and the Audit Committee.


text: The GIS team leverages several mechanisms to continuously identify and assess cybersecurity risks across the Company and utilizes a GRC platform to monitor identified risks and mitigation and remediation activities. The GIS team uses defined industry accepted risk management and controls frameworks to determine the potential likelihood and impact of each risk. Monitoring activities are designed and executed based on the materiality of the assessed likelihood and magnitude of impact of the risks that are identified. The GIS team, with the assistance of third-party consultants, performs application security reviews, penetration tests and gap assessments against certain cybersecurity frameworks. Management reviews any assessments performed by the third-party consultants and determines the final evaluations and communication plan, which the GIS team executes.


text: In the event of a reported potential cybersecurity incident, a first response team, which includes leaders of the GIS team, other members of management and the legal team, determines without undue delay whether it is a QCI as defined in the CIRP. If an incident is determined to be a QCI, the process included in the CIRP is initiated and such incident is communicated to the designated leadership team, including Hilton's general counsel. Further, appointed leaders collaborate on determining if the incident is material, as well as the resulting response, including any legal and financial reporting obligations of the Company. Information also is provided to additional members of senior management as appropriate. The remediation plan for the QCI is entered within Hilton's GRC platform and monitored and reviewed at least monthly to ensure effective implementation; depending upon the type of incident, additional reporting may be produced and monitored by the GIS team to ensure the effectiveness of the remediation plan. All cybersecurity incidents are tracked within our incident response platform, regardless of the potential materiality of the impact.


text: We also have a process in place to manage cybersecurity risks associated with third-party service providers. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, as discussed under "Part I—Item 1A. Risk Factors," specifically the risks titled "Failures in, material damage to or interruptions in our information technology systems, software or websites, including as a result of cyber-attacks on our systems or systems operated by third parties that provide operational and technical services to us, costs associated with protecting the integrity and security of personal data and other sensitive information and difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations" and "Cyber-attacks could have a disruptive effect on our business," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: As part of our overall risk management program, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cybersecurity threats. We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity Framework"). This does not imply compliance with specific technical standards, specifications or requirements of the NIST Cybersecurity Framework, but signifies its use as a guiding principle.

companyName: Knowles Corp

ticker: KN


text: Our commitment extends to various programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. This includes regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. We also conduct "tabletop" exercises to simulate cybersecurity incidents to enhance our readiness and resilience in the face of potential cybersecurity threats. These exercises are conducted at both the technical level and senior management level. We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.


text: We have a well-defined cybersecurity incident response plan aimed at facilitating an effective response and handling of cybersecurity incidents. The incident response plan outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. We have also implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Our employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding our resources and information. This training is reinforced by testing initiatives, including periodic phishing tests. We also assess the cybersecurity risks presented by third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we maintain business continuity and disaster recovery plans, as well as cybersecurity insurance.


text: To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. That said, while we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third party providers. See "Item 1A. Risk Factors – Our business and operations could suffer in the event of security breaches, cybersecurity incident, other unauthorized disclosures, or network disruptions."


text: The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Vice President of Information Technology on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.


text: Our management team, led by our Vice President of Information Technology ("VP of IT"), has operational responsibility for our cybersecurity and information security framework and risk management. Our VP of IT has extensive cybersecurity knowledge and skills gained from over 20 years of experience in leading and managing global IT operations and security teams. In addition, our VP of IT has a Master of Science degree in Management of Information Systems from Rensselaer Polytechnic Institute. Our VP of IT is supported by a team of enterprise information system and security risk professionals. The VP of IT receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Administrative Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our VP of IT supervises any retained external cybersecurity consultants.


text: The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Chief Information Officer on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.


text: Our management team, led by our Vice President and Chief Information Officer ("CIO"), has operational responsibility for our cybersecurity and information security framework and risk management. Our CIO has extensive cybersecurity knowledge and skills gained from various roles in information technology and security for over 31 years, including serving as the Chief Information Officer at two large public companies. Our CIO is supported by a team of enterprise information system and security risk professionals. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Transformation Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our CIO supervises any retained external cybersecurity consultants.


text: We commit significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other information or operations technology assets. Our cybersecurity efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or otherwise cause damage.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our Board of Directors considers cybersecurity risk one of the significant risks to our business. As such, the Board of Directors has retained responsibility for overseeing policies and procedures related to cybersecurity and data privacy matters. The Board of Directors routinely evaluates our cybersecurity strategy to review its effectiveness. Management provides reports to the Board of Directors at least quarterly regarding cybersecurity and other information and operations technology risks.


text: The Company established a governance committee to provide governance and oversight of security and compliance related activities for security and IT in support of their effective and efficient management of risks, strategies, and operational imperatives for the Company. The committee is chaired by our Chief Information Officer and the membership includes a cross-functional team of executives from IT/cybersecurity, operations, customer service, commercial, risk and insurance, finance, and the legal department. The committee is structured to cultivate collaboration across the enterprise and to align and prioritize resources with our strategic plan.


text: The cybersecurity function is centralized under the Senior Vice President and Chief Information Officer, who has over three decades of experience in information technology. The cybersecurity function is comprised of a dedicated team of professionals who work continuously to monitor risks relating to cybersecurity resilience strategy, policy, standards, architecture, and processes. We identify and address cybersecurity risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements. This requires a comprehensive program involving advanced monitoring and defense technology along with recurring situational drills that exercise incident response and crisis management plans. We leverage dedicated internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. In the event a cybersecurity incident occurs, we maintain cybersecurity insurance to provide appropriate resources for both financial and cyber expertise. We have partnerships for penetration testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our technology environment.


text: Our cybersecurity oversight includes our internal control environment, cybersecurity standards, benchmarks, and internal governance committees. Annually, we assess, either internally or by an independent third-party, against multiple cybersecurity maturity models. We also leverage other industry standards and benchmarks, such as National Institute of Standards and Technology (NIST) standards, and Cybersecurity and Infrastructure Security Agency (CISA) best practices to inform our oversight strategy. The governance committee functions to ensure adherence and accountability to these standards and deploy appropriate resources to keep pace with the shifting cybersecurity threat landscape.


text: We have policies and procedures to oversee and manage the cybersecurity risks associated with both internal or external threats including the regular review of security reports, relevant cyber attestations, and other independent cyber ratings. These practices include technical controls and processes, as well as contractual mechanisms to mitigate risk. Additionally, we utilize cyber ratings, prepared by reputable external agencies which provide an independent ranking of our cybersecurity maturity and coverage, to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies reviewed annually by the Board of Directors. We have also implemented certain third-party risk management processes to vet, select, and monitor suppliers.


text: Furthermore, we have established an organizational unit within the legal and compliance department that provides independent compliance testing and review for our regulatory obligations, industry standards, and policies and procedures. It supports the IT and cybersecurity department by conducting formal assessments of compliance measures, consulting on control development and enhancement, and facilitating third-party assessments.


text: In addition to the safeguards in place to minimize the likelihood and impact of a cyber incident, the Company has established response procedures to address in the event they may occur. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents in a timely, consistent, and compliant manner. Annually, the Company completes incident response, disaster response, and crisis management plan exercises to validate our current readiness. These exercises are intended to test our cybersecurity response plans and resources through simulated cybersecurity incidents, and may include engagement of outside cybersecurity legal counsel, other third-party partners, executive management, and our Board of Directors.


text: The Company seeks to ensure every employee understands their role in keeping ONE Gas safe from cyber incidents. As part of this commitment, we require our employees to complete recurring cybersecurity awareness training that provides immediate feedback and, if necessary, additional training or remedial action to employees.


text: We have experienced no material cybersecurity breaches. As such, we have not spent any material amount of capital on addressing impacts during this time, nor have we incurred any material breach expenses from penalties and settlements. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.


text: Our Board of Directors considers cybersecurity risk one of the significant risks to our business. As such, the Board of Directors has retained responsibility for overseeing policies and procedures related to cybersecurity and data privacy matters. The Board of Directors routinely evaluates our cybersecurity strategy to review its effectiveness. Management provides reports to the Board of Directors regarding cybersecurity and other information and operations technology risks.


text: The Company established a governance committee to provide governance and oversight of security and compliance related activities for physical security and IT in support of their effective and efficient management of risks, strategies, and operational imperatives for the Company. The committee is chaired by our Senior Vice President and Chief Information Officer and the membership includes a cross-functional team of executives from IT/cybersecurity, operations, human resources, customer service, commercial, risk and insurance, finance, and the legal department. The committee is structured to cultivate collaboration across the enterprise and to align and prioritize resources with our strategic plan.


text: The cybersecurity function is centralized under the Senior Vice President and Chief Information Officer, who has over three decades of experience in information technology. The cybersecurity function is comprised of a dedicated team of professionals who work continuously to monitor risks relating to cybersecurity resilience strategy, policy, standards, architecture, and processes. We identify and address cybersecurity risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements. This requires a comprehensive program involving advanced monitoring and defense technology along with recurring situational drills that exercise incident response and crisis management plans. We leverage dedicated internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for vulnerability testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our technology environment.


text: Further, cybersecurity risk has also been incorporated into the Company's enterprise risk management process such that cybersecurity risk is managed on a comprehensive basis as part of strategy setting and driving performance throughout the Company, which includes identifying, aggregating, monitoring, measuring, assessing and managing risks that could affect our ability to fulfill our business objectives or execute our corporate strategy.


text: Our cybersecurity oversight includes our internal control environment, cybersecurity standards, benchmarks, and internal governance committees. Annually, we assess, either internally or by an independent third-party, against multiple cybersecurity maturity models. We also leverage other industry standards and benchmarks, such as those from the National Institute of Standards and Technology (, Department of Energy and Cybersecurity and Infrastructure Security Agency best practices to inform our oversight strategy. The governance committee functions to ensure adherence and accountability to these standards and deploy appropriate resources to keep pace with the shifting cybersecurity threat landscape.


text: We have policies and procedures to oversee and manage the cybersecurity risks associated with both internal or external threats including the regular review of security reports, relevant cyber attestations, and other independent cyber ratings. These practices include technical controls and processes, as well as contractual mechanisms to mitigate risk. Additionally, we leverage cyber ratings, developed by reputable independent agencies, to assess our capabilities and compare to our peers. We have also implemented certain third-party risk management processes to assess, select, and monitor suppliers.


text: Response In addition to the safeguards in place to minimize the likelihood and impact of a cyber incident, the Company has established response procedures to address in the event they may occur. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents in a timely, consistent, and compliant manner. The response procedures are also designed to escalate information regarding cyber incidents promptly so that decisions regarding any required public disclosures and reporting can be made in a timely manner.


text: Annually, the Company completes incident response, disaster response, and crisis management plan exercises to validate our current readiness. These exercises are intended to test our cybersecurity response plans and resources through simulated cybersecurity incidents, and may include engagement of outside cybersecurity legal counsel, other third-party partners, executive management, and our Board of Directors.


text: The Company seeks to ensure every employee understands their role in keeping ONE Gas safe from cyber incidents. As part of this commitment, we provide our employees cybersecurity awareness training on a regular basis as well as regular security -focused announcements and seminars. We augment these educational trainings with live phishing exercises that simulate the current threat landscape. These exercises provide immediate feedback and, if necessary, additional training or remedial action. The Company also includes cybersecurity training as part of the on-boarding process of every employee.


text: Risk Management and Strategy NewtekOne maintains an enterprise-wide risk-management ("ERM") framework to identify, measure, mitigate, monitor and report material risks to NewtekOne. Our ERM process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Board. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.

companyName: NewtekOne, Inc.

ticker: NEWT


text: We have developed an enterprise-wide cybersecurity risk management system and strategy to safeguard our assets and operations, including the protection of the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems, as follows: Assessment, Identification, and Management of Material Risks:


text: 1.Comprehensive Risk Assessments: We conduct regular and comprehensive assessments to identify potential cybersecurity risks to our organization. These assessments encompass internal systems, networks, applications, and data repositories, as well as external threats and vulnerabilities within the broader digital ecosystem.


text: 2.Threat Intelligence Monitoring: We continuously monitor threat intelligence sources to stay abreast of emerging cyber threats and trends. This proactive approach enables us to anticipate potential risks and take preemptive measures to mitigate them.


text: 3.Risk Prioritization: Following the assessment phase, we prioritize identified risks based on their potential impact on our operations, data integrity, confidentiality, and reputation. This risk-based approach allows us to allocate resources effectively and focus on addressing the most significant threats first.


text: 4.Mitigation Strategies: We develop and implement robust mitigation strategies tailored to address specific cybersecurity risks. These strategies may include the deployment of technical controls, such as firewalls, intrusion detection systems, and encryption protocols, as well as the implementation of policies, procedures, and employee training programs to promote cybersecurity awareness and adherence to best practices.


text: Our cybersecurity risk management processes are fully integrated into our overall risk management system and corporate governance framework. This integration ensures that cybersecurity considerations are embedded within our strategic decision-making processes and are aligned with our broader business objectives. By integrating cybersecurity into our overall risk management system, we promote a comprehensive approach to risk mitigation and resilience-building across the organization.


text: 1.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. To complement the internal capabilities of our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and their team of professionals, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.


text: 2.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.


text: 1.Vendor Risk Management: We recognize that third-party service providers may introduce additional cybersecurity risks to our organization. As such, we have established a vendor risk management program to assess and monitor the cybersecurity posture of our third-party vendors and partners.


text: 2.Due Diligence: Prior to engaging with third-party service providers, we conduct due diligence assessments to evaluate their cybersecurity controls, practices, and compliance with industry standards and regulations. This due diligence process includes assessing the vendor's security policies, procedures, incident response capabilities, and contractual obligations related to cybersecurity.


text: 3.Ongoing Monitoring: We continuously monitor the cybersecurity performance of our third-party vendors throughout the duration of our engagement. This includes regular assessments, audits, and compliance reviews to ensure that vendors adhere to agreed-upon cybersecurity standards and contractual obligations.


text: 4.Remediation and Escalation: In the event that cybersecurity risks or deficiencies are identified within our third-party vendor ecosystem, we work collaboratively with the vendor to address and remediate these issues in a timely manner. Depending on the severity of the risk, we may escalate concerns to senior management or terminate the vendor relationship if necessary.


text: Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered a committee to provide more focused oversight. In the case of cybersecurity and technology risk, the Board's Risk Committee has that responsibility.


text: The Risk Committee is informed of risks from cybersecurity threats through regular reports from the Company's management, including our CISO and CTO. Our CISO and CTO, who are employees of our subsidiary NTS, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Risk Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to the Risk Committee, as well as the risk committee of the board of directors of Newtek Bank, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.


text: The Risk Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Risk Committee reviews these reports and discusses them with management. The Risk Committee reports to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Risk Committee.


text: While our Board and Risk Committee oversee risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within our subsidiary NTS, which is led by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO's team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the Company's and our subsidiaries' executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Risk Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.


text: Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He is a results driven leader who has managed multimillion dollar projects and solutions to successful completion. Our CTO has over 25 years of experience in enterprise technology services with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.


text: Risk Management and Strategy NewtekOne maintains a Risk Management framework to identify, measure, mitigate, monitor and report material risks to the Risk Committee of our Board. Our Risk Management process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Chief Risk Officer who reports to the Risk Committee and our CEO. The Risk Committee sets the risk appetite across NewtekOne while the executive leadership team and our associates identify and monitor current and emerging risks and manage those risks within our risk appetite. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.


text: We and NTS, and NTS's successor, IPM, which manages our IT infrastructure and cybersecurity under the direction of our CTO, have developed an enterprise-wide cybersecurity risk management system and strategy to safeguard our assets and operations, including the protection of the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems, as follows: Assessment, Identification, and Management of Material Risks:


text: 1.Comprehensive Risk Assessments: We conduct regular and comprehensive assessments to identify potential cybersecurity risks to our organization. These assessments encompass internal systems, networks, applications, and data repositories, as well as external threats and vulnerabilities within the broader digital ecosystem.


text: 2.Threat Intelligence Monitoring: We continuously monitor threat intelligence sources to stay abreast of emerging cyber threats and trends. This proactive approach enables us to anticipate potential risks and take preemptive measures to mitigate them.


text: 3.Risk Prioritization: Following the assessment phase, we prioritize identified risks based on their potential impact on our operations, data integrity, confidentiality, and reputation. This risk-based approach allows us to allocate resources effectively and focus on addressing the most significant threats first.


text: 4.Mitigation Strategies: We develop and implement robust mitigation strategies tailored to address specific cybersecurity risks. These strategies may include the deployment of technical controls, such as firewalls, intrusion detection systems, and encryption protocols, as well as the implementation of policies, procedures, and employee training programs to promote cybersecurity awareness and adherence to best practices.


text: Our cybersecurity risk management processes are fully integrated into our overall risk management system and corporate governance framework. This integration ensures that cybersecurity considerations are embedded within our strategic decision-making processes and are aligned with our broader business objectives. By integrating cybersecurity into our overall risk management system, we promote a comprehensive approach to risk mitigation and resilience-building across the organization.


text: 1.Internal Expertise: Our CTO is responsible for overseeing the Company's IT infrastructure and cybersecurity and reports to our executive management team and the Technology Steering Committee of our Board.


text: 2.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. Historically, the Company's subsidiary NTS and its team of professionals, including NTS' Chief Information Security Officer ("CISO"), who currently serves as our CISO, and CTO, and their team of professionals, have managed the Company's IT infrastructure, including our dedicated server hosting, managed cybersecurity, backup and disaster recovery, and other related services. As of the January 2, 2025, close of our divestiture of NTS to IPM, we and IPM entered into a Master Services Agreement pursuant to which IPM provides us with the same services NTS provided to the Company prior to the divestiture. Our CTO is responsible for overseeing IPM's provision of the managed technology services, including cybersecurity, to NewtekOne. In addition, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.


text: 3.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.


text: Our management is actively engaged in overseeing our third-party service providers. Our Enterprise Third Party Risk Management (TPRM) Policy establishes requirements and practices used to oversee and manage the activities of third parties with whom we have a relationship, under which we identify, measure, monitor, and manage third-party risk (including information cybersecurity risks) in alignment with our strategic objectives and in compliance with applicable law. Any identified threats, vulnerabilities, or cybersecurity incidents are addressed as appropriate through our CTO, CISO and IPM.


text: Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered committees to provide more focused oversight. In the case of cybersecurity and technology risk, in 2024 the Board formed the Technology Steering Committee which has that responsibility.


text: The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company's management, including our CTO. Our CTO and the CISO, who is employed by IPM, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to our CTO who reports to the Technology Steering Committee on a quarterly and more frequently as needed, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.


text: The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.


text: While our Board and Technology Steering Committee oversee cybersecurity and technology risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within IPM, with oversight by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO's team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the CTO, who coordinates with the Company's and our subsidiaries' executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Technology Steering Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.


text: Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He is a results driven leader who has managed multimillion dollar projects and solutions to successful completion. Our CTO has over 25 years of experience in enterprise technology solutions, with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with the Company's Chief Financial Officer to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: To help identify and assess risks, we and our Manager engage third-party advisors, leveraging standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT"), security systems or the IT security systems of our third-party providers, causing an IT security breach, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Material risks are identified and prioritized by management, and material risks are discussed periodically or as needed with the Board of Directors. The Board of Directors regularly reviews information regarding the Company's credit, liquidity and operations, including risks and contingencies associated with each area, including cybersecurity. In addition to the formal compliance program, the Board of Directors encourages management to promote a corporate culture that incorporates risk management into the Company's corporate strategy and day-to-day business operations.


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Former Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Former Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with officers and individuals at the Company to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks. The Former Manager's Chief Technology Officer and Chief Information Security Officer have extensive knowledge and skills, and collectively bring decades of experience in the cybersecurity industry.


text: To help identify and assess risks, we and our Former Manager engage third-party advisors, leveraging standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. Cybersecurity events are collected, evaluated and, when appropriate, escalated to the Chief Information Security Officer (CISO) for impact analysis utilizing the cybersecurity risk management policy.

companyName: Civeo Corp

ticker: CVEO


text: Cybersecurity risks are monitored and evaluated by management through an internal compliance program with oversight by internal audit. We engage a variety of cybersecurity partners to perform penetration testing and quarterly audits on our cybersecurity profile. These partnerships enable us to leverage specialized knowledge and insights, and are meant to help our cybersecurity strategies and processes in remaining risk appropriate. In order to promote a company-wide culture of cybersecurity risk management, management has also implemented a variety of required programs to both test and train our employees on cybersecurity fundamentals, including both annual and ongoing information security awareness training.


text: Our cybersecurity policies and procedures encompass data privacy, incident response, information security and risks from our use of third-party vendors. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: We also have conducted a cyber breach simulation exercise with the assistance of a third party cybersecurity consultant. The exercise focused on incident management and communication processes. Company business functions, executive management and members of the Board participated. The goal was to identify opportunities for greater efficiency, coordination, and alignment.


text: We face risks from various security threats, including cybersecurity threats to gain unauthorized access to sensitive information or to render data or systems unusable or hold them for ransom. Cybersecurity attacks in particular develop and evolve rapidly, including from emerging technologies, such as advanced forms of artificial intelligence. Such attacks include, but are not limited to, malicious software, attempts to gain unauthorized access to data, ransomware attacks and other electronic security breaches that could lead to disruptions in critical systems, unauthorized release of or denial of access to confidential or otherwise protected information and corruption of data. We have experienced, and expect to continue to confront, efforts by hackers and other third parties to gain unauthorized access or deny access to, or otherwise disrupt, our information systems and networks. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect. See Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Our Operations - Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions" for more information regarding the risks we face.


text: As discussed in Part I, Item 1A, "Risk Factors," under the heading "Financial/Accounting Risks – We may not have adequate insurance for potential liabilities and insurance may not cover certain liabilities," we maintain cyber risk insurance to mitigate our exposure to these threats.


text: Risk oversight is a responsibility of the Board. The Board has delegated responsibility for monitoring technology and cybersecurity risks to the Audit Committee. The Board reviews the Company's cybersecurity risk posture, strategy and execution on at least an annual basis while the Audit Committee receives cybersecurity updates quarterly.


text: The CISO and executive management play a pivotal role in informing the Audit Committee on cybersecurity risks. Executive management, including the CISO, regularly meets with the Audit Committee to discuss cybersecurity risks, review quarterly cyber metrics and oversee progress against our annual action plans. These briefings may encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and executive management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. Our CISO has cybersecurity expertise from over 18 years of experience in the field of cybersecurity. His background includes extensive experience as CISO at Civeo and previously for a Fortune 500 company. He also oversees our cybersecurity governance programs, assists with testing our compliance with applicable standards, leads our efforts to remediate known risks and leads our employee training program.


text: The CISO is informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The Company deploys a Security Operations Center team who monitor and escalate cybersecurity events. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan, which is intended to mitigate the impact of the incident and includes long-term strategies for remediation and prevention of future incidents.


text: The CISO regularly updates executive management on cybersecurity risks and incidents. Significant cybersecurity matters and certain strategic risk management decisions are escalated to the Audit Committee and the Board.


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Civeo leverages controls modeled in the Center for Internet Security (CIS) and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to evaluate our cybersecurity capabilities and to inform the implementation and configuration of certain systems, processes, and technologies. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. Cybersecurity events are collected, evaluated and, when appropriate, escalated to the Chief Information Security Officer (CISO) for impact analysis utilizing our cybersecurity risk management policy.


text: Our cybersecurity policies and procedures encompass data privacy, incident response, information security and risks from our use of third-party vendors. In order to help develop these policies and procedures, we monitor applicable privacy and cybersecurity laws, regulations and guidance in the regions where we do business, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Cybersecurity risks are monitored and evaluated by management through an internal compliance program with oversight by internal audit. We engage various third-party cybersecurity partners, such as auditors, assessors and consultants to perform penetration testing and audits on our cybersecurity profile. With the assistance of a third-party cybersecurity consultant, we also conducted three cyber breach simulation exercises in the last five quarters, focused on incident management and communication processes. These third-party partnerships enable us to leverage specialized knowledge and insights, and are meant to ensure our cybersecurity strategies and processes remain appropriately tailored to the company's risk profile. In order to promote a company-wide culture of cybersecurity risk management, management has also implemented programs to both test and train our employees on cybersecurity fundamentals, including both annual and ongoing information security awareness training.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect. See Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Our Operations - Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions" for more information regarding the risks we face.


text: While the Board maintains responsibility for risk oversight it has delegated responsibility for evaluating technology and cybersecurity risks to the Audit Committee. The Board reviews the Company's cybersecurity risk posture, strategy and execution on at least an annual basis while the Audit Committee receives cybersecurity updates quarterly.


text: The CISO and executive management play a pivotal role in informing the Audit Committee on cybersecurity risks. Executive management, including the CISO, meets regularly with the Audit Committee to discuss cybersecurity risks, review quarterly cyber metrics and oversee progress against our annual action plans. These briefings may encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and executive management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, and the CISO regularly updates executive management on cybersecurity risks and incidents.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO who has over 18 years of experience in the field of cybersecurity, including at Civeo and previously for a Fortune 500 company. The CISO implements and oversees processes for the monitoring of our information systems, which includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CISO also oversees our cybersecurity governance programs, assists with testing our compliance with applicable standards, leads our efforts to remediate known risks and leads our employee training program.


text: The Company deploys a Security Operations Center team who monitor and escalate cybersecurity events to the CISO. In the event of a cybersecurity incident, the Company maintains an incident response plan, which is intended to facilitate response, escalation, and mitigate the impact of the incident and includes long-term strategies for remediation and prevention of future incidents. Significant cybersecurity matters and certain strategic risk management decisions are escalated to the Audit Committee and the Board.


text: Cybersecurity is a part of our risk management framework, and we have established policies and processes designed to manage cybersecurity defenses, controls and programs, including ISO 27001 compliant security procedures. Our processes are evaluated by expert cybersecurity firms through various security assessments and audits, which help us identify and mitigate cyber-related risks to our businesses. We also engage with providers of information systems as part of our continuing efforts to enhance the effectiveness of our security measures. Our vendor risk management (VRM) program, through which we screen external providers, helps us identify and evaluate known risks associated with these third parties.

companyName: Element Solutions Inc

ticker: ESI


text: Our information security program is led by our Chief Information Security Officer (CISO) who manages a global information security team responsible for assessing and mitigating cyber-related threats. The cybersecurity expertise of our CISO and his team includes information security management roles, hands-on cyber incident response experience, forensic and network intrusion investigations and security risk assessments.


text: Our CISO regularly reports to senior management on cybersecurity risks and incidents, including the nature of threats, the state of our defense and detection capabilities, incident response plans and employee training activities, as applicable. In addition, as part of the Board's oversight of the Company's risk management program, our CISO provides periodic updates to the Board on the state of our cybersecurity management program in addition to, when needed, ad hoc information about any significant cybersecurity matters and/or strategic risk management decisions.


text: Our information security program is led by our Chief Information Security Officer (CISO) who manages a global information security team responsible for assessing and mitigating cyber-related threats. The cybersecurity expertise of our CISO and his team includes information security management as well as governance, risk and compliance (GRC) roles, hands-on cyber incident response experience, forensic and network intrusion investigations and security risk assessments.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology team, which is led by our Vice President, Digital Operations & Facilities, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct cybersecurity audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: Our Vice President, Digital Operations & Facilities, who reports directly to the Chief Operating Officer and has over 12 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework that is overseen by our Audit Committee of our board of directors and our board of directors. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Risk Factors" for additional information on cybersecurity risks we face.


text: Our board of directors, as a whole and at the Audit Committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. Our Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives biannual updates on cybersecurity and information technology matters and related risk exposures from our Chief Operating Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We have developed and implemented a cybersecurity risk management program that is designed to assess, identify, and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity and availability of our critical systems and information. These processes are managed and monitored by our information technology team, which is led by our Vice President, Information Technology & Facilities, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting our data and information technology environment. For example, we conduct cybersecurity audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Vice President, Information Technology & Facilities, who reports directly to the Chief Operating Officer and has over 15 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework that is overseen by our Audit Committee of our board of directors and our board of directors. In the last fiscal year, we have not experienced any cybersecurity incidents that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents See "Risk Factors" for additional information on cybersecurity risks we face.


text: Our Audit Committee has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives biannual updates on cybersecurity and information technology matters and related risk exposures from members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We maintain a cybersecurity team responsible for the development and implementation of a program intended to protect the confidentiality, integrity and availability of our critical systems and information. A component of our program is a cybersecurity Incident Response Plan ("IRP") which has been built by the team utilizing current and historical industry knowledge and experience.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Key elements of our risk management procedures and processes include: • risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • attack and response simulations at the technical level and execute tabletop response exercises at the management level; • a third-party risk management process for service providers; and • cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.


text: The cybersecurity team reports to the Chief Information Officer and in January 2024, we hired a Chief Information Security Officer ("CISO") with significant experience in leading cybersecurity teams to assume the leadership of management's responsibilities and governance discussed below.


text: We evaluate our cybersecurity risk management processes and continue to integrate our procedures into our overall enterprise risk management program, which shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Incidents are investigated by the cybersecurity team as they are identified and may be resolved or escalated based upon the specific details and severity of each incident. Incidents are evaluated throughout the investigation and remediation processes and incidents determined to be insignificant may be resolved by the cybersecurity team without further escalation at that time. Incidents determined to be more severe, such as those that may have compromised the confidentiality, integrity and availability of our critical systems and information, are escalated by the cybersecurity team to notify legal counsel, our Cybersecurity & Privacy Executive Steering Committee, our Board of Directors, or various regulators, as required.


text: Our cybersecurity team evaluates the risk profile of new third party service providers and maintains communication channels with key third party service providers to evaluate and respond to possible effects of incidents within a service provider's organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.


text: As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database ("Data Incident"). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.


text: We have received, and continue to pursue, reimbursements from insurance carriers for costs incurred as a result of the Data Incident. Based on our assessment, the incident has not had a material impact, and we do not believe the incident has materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: As a result of the Data Incident, numerous putative class action lawsuits have been filed against us purporting to represent various classes of persons whose personal information was affected by the Data Incident. These class actions assert a variety of common law and statutory claims based on allegations that we failed to use reasonable security procedures and practices to safeguard customers' personal information, and seek monetary and statutory damages, injunctive relief and other related relief. In addition to those putative class action lawsuits, individual claims have been filed or threatened against us as well.


text: We have also received inquiries from numerous state regulators related to the Data Incident. We are responding to these inquiries and cooperating fully with regulators. See Note 11 for further discussion.


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as critical to the enterprise and is responsible for reviewing our cybersecurity risk profile, including management's design, implementation and enforcement of our cybersecurity risk management program. The Board of Directors receives periodic updates from our Chief Information Officer ("CIO") on cybersecurity risks and threats. Board members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: The Board has determined that retaining responsibility for risks related to cybersecurity oversight is appropriate, given the complexity of the risks associated with cybersecurity and the attention required to appropriately review and monitor such risks. The full Board lends its collective experience and attention to discussing and overseeing potential risks identified by management and stays up to date on management's risk-mitigation processes related to cybersecurity.


text: Our CIO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has the primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has significant global experience in managing and leading IT and cybersecurity teams. Members of the cybersecurity team hold various credentials and certificates with respect to information systems and they participate in continuing education.


text: Key elements of our risk management procedures and processes include: • risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team composed of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • attack and response simulations at the technical level and execute tabletop response exercises at the management level; • a third-party risk management process for service providers; and • cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.


text: The cybersecurity team reports to the Chief Information Officer ("CIO") and in January 2024, we hired a Chief Information Security Officer ("CISO") with significant experience in leading cybersecurity teams to assume the leadership of management's responsibilities and governance discussed below.


text: Our cybersecurity team evaluates the risk profile of new third-party service providers and maintains communication channels with key third-party service providers to evaluate and respond to possible effects of incidents within a service provider's organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.