text: Vetting the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.


text: While we have not experienced a cybersecurity incident that has had a material impact to date, the threat of potential incidents remains high. We continually evaluate our exposure to risks such as: Operational disruption from ransomware or other cyberattacks. Data breaches that could compromise customer or proprietary information. Regulatory and legal exposure arising from cybersecurity failures.

companyName: cbdMD, Inc.

ticker: YCBD

secItem: Item 1C


text: As part of our risk management framework, we regularly assess whether any cybersecurity incidents, or the likelihood of such incidents, could materially affect our business. We are also committed to continuous improvements to address emerging threats. Governance.


text: Our board of directors plays an active role in overseeing the company's approach to managing cybersecurity risks. The board receives regular updates from senior management regarding the company's cybersecurity strategy, potential risks, and any incidents that may arise. These updates ensure that the board remains informed and able to provide guidance on cybersecurity matters.


text: The board is also regularly briefed by management on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.


text: Management, led by the IT department, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The IT department is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.


text: The Company is committed to safeguarding its information systems and data against evolving cybersecurity threats. With operations spanning traditional publishing and the technology-driven Journal Technologies segment, the Company prioritizes robust cybersecurity measures to protect its operations, customers, and stakeholders. The Company employs a comprehensive cybersecurity risk management framework to identify, assess, and address risks that could impact business operations, sensitive client data, and the Company's portfolio of marketable securities. This framework incorporates: Technology Solutions: Prioritizing the security of Journal Technologies' court and justice software systems, which manage critical data and workflows. Traditional Business: Protecting the systems and data supporting the Company's publishing and printing operations. Financial Portfolio: Securing systems and processes related to the management of the Company's substantial marketable securities portfolio.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: The Company's Board of Directors as a whole supervises the Company's cybersecurity strategy and regularly reviews cybersecurity risks, incident reports, and risk mitigation initiatives.


text: Journal Technologies has a Chief Information Security Office (CISO) made up of internal cybersecurity practitioners who evaluate, identify, and mitigate significant risks posed by cybersecurity threats, with a focus on safeguarding the Company's technology, data, and intellectual property.


text: In August 2024, Journal Technologies hired a Director of Security Operations to lead the CISO team. With extensive IT leadership experience and a Certified Information Systems Security Professional (CISSP) credential, the Director oversees security strategies, incident response plans, and risk assessments. Reporting directly to senior management, the Director works closely with internal teams and external experts to align Journal Technologies' practices with industry standards.


text: The Company has also established a dedicated Cybersecurity Working Group, with members from both the Traditional Business and Journal Technologies, to collaborate on threat intelligence, incident response strategies, policy alignment, and security technology advancements. This partnership ensures both entities remain proactive in addressing evolving threats and benefit from shared expertise to implement coordinated security measures. The Company's senior management works closely with the CISO and the Cybersecurity Working Group to identify matters requiring the attention of the Board of Directors.


text: Threat Detection and Response: The Company employs enterprise security systems as the backbone of a defense in depth (DiD) strategy, such as patch management, intrusion detection, and network segmentation. A managed detection and response (MDR) solution from a world-class security company unifies our antivirus/malware (NGAV), endpoint detection and response (EDR), cyber threat intelligence, managed threat hunting capabilities, and security hygiene.


text: Employee Training and Awareness: The Company provides regular cybersecurity training for employees to enhance awareness of common threats, such as phishing and ransomware. All Journal Technologies employees undergo annual CJIS training and certification.


text: Risk Register: The Company maintains a central Risk Register as part of its cybersecurity risk management framework. This Risk Register identifies risks and their potential impacts, mitigation strategies, and ongoing monitoring efforts.


text: The Company evaluates third-party vendors prior to onboarding to ensure they have industry standard best practices in place and, when applicable, verified by an external audit firm. The Company monitors third-party providers for breaches or other cybersecurity events and annually review each vendor's SOC 2 audit reports.


text: Incident Response Planning: The Company maintains a formalized incident response (IR) plan to address and remediate cybersecurity incidents. The plan defines roles and responsibilities and includes runbooks for likely scenarios. The Company performs testing of the IR plan at least annually with the results reported to senior management.


text: Certifications: Several of the Company's security personnel on the CISO team have and maintain CISSP, GCIH (GIAC Certified Incident Handler) and OSCP (Offensive Security Certified Professional) certifications.


text: Business Continuity: The Traditional Business and Journal Technologies have each implemented a Business Continuity Plan and Disaster Recovery (BCP/DR) with procedures aimed at minimizing downtime and facilitating recovery of both internal and customer assets in the event of a service disruption. The plan includes clearly defined roles, step-by-step recovery processes, and prioritized action plans to address various scenarios, such as natural disasters, cyber incidents, and hardware failures. We regularly test and update our BCP/DRs.


text: Enforcing multi-factor authentication (MFA) for all systems Deploying anti-phishing solutions to detect and block suspicious emails Using single sign-on (SSO) solutions integrated with secure identity providers Simulating phishing attacks to measure awareness and improve training programs Implementing Security Information and Event Management (SIEM) systems for continuous monitoring and logging.


text: Incident Reporting and Disclosure The Company adheres to strict protocols for evaluating and reporting cybersecurity incidents. Any incidents determined to have a material impact—assessed based on financial, operational, or reputational factors—are raised with the Board of Directors and, if necessary, disclosed in accordance with regulatory requirements.


text: Coastal recognizes the critical importance of identifying, assessing and managing material risks from information security threats. One key way that Coastal mitigates information security threats is through the Company's information security program (the "Information Security Program"). Cybersecurity is an integral subset of information security and the Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented prior to a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access and integrity monitoring and reporting and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, IT and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.


text: Coastal engages third party assessors, consultants and auditors in connection with the Information Security Program, including to conduct external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners in order to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of financial institution experience, which includes, compliance, BSA, operations, physical security along with information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and on information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on 3 pillars: Technology Strategy, InfoSec/Cyber, and Data.


text: The SVP of Technology has served in that role since 2005 and the SVP, Head of Technology Operations and Implementation, who also supports the Information Security Program, has 23 years of financial technology experience, including previously as Director, Application Development and Vice President, Integration and Analytics. The Information Security Program is further supported by other members of Coastal's management team, including the President, Chief Risk Officer, and the Chief Audit Executive.


text: The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually. Cybersecurity risk management is also incorporated into Coastal's overall enterprise risk management framework, which is updated on an annual basis and subject to oversight by the Management Risk Committee and the Board.


text: Although Coastal has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected Coastal's business strategy, results of operations, or financial condition, there can be no guarantee that Coastal will not experience such an incident in the future. For a discussion regarding risks from cybersecurity threats, see "Item 1A. Risk Factors," including the risk factors titled "—We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and earnings" and "—We are dependent on our information technology and telecommunications systems and third-party service providers; systems failures, interruptions, security breaches and cybersecurity threats could have an adverse effect on our business, financial condition and results of operations." As noted above, we are a regulated financial institution and are subject to financial privacy laws and to oversight by federal banking agencies. For additional information on these laws and oversight, see "Item 1. Business—Regulation and Supervision."


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented before a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access, controls, data integrity monitoring and reporting, and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.


text: Coastal engages third party auditors and consultants in connection with the Information Security Program, including conducting external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third-party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of combined financial institution experience, which includes compliance, BSA, operations, physical security and information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on three pillars: Technology Strategy, InfoSec/Cyber, and Data.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data ("Information Systems and Data").

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Our information security function is led by our Vice President, Cybersecurity (our "Information Security Team"), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Vice President, Head of Information Technology, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including an incident response policy, vulnerability management policy, disaster recovery and business continuity plan, vendor risk management program, programs for incident detection and response, encrypting certain data, network security controls, data segregation, asset management tracking and disposal, penetration testing, employee training, access controls, physical security controls, systems monitoring, a dedicated cybersecurity officer; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity and Data Privacy Oversight Subcommittee (the "Privacy and Security Subcommittee") of the Nominating and Corporate Governance Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, including legal counsel; cybersecurity consultants; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes requiring certain vendors to complete security questionnaires, conducting risk assessments for certain vendors, reviewing security assessments, conducting security assessment calls with certain vendor security personnel, and imposing information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in Part I, Item 1A of this Annual Report, including in the section titled "Risks Related to Privacy and Security."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Privacy and Security Subcommittee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Vice President, Cybersecurity and includes our Chief Human Resources Officer, Vice President, Privacy, senior personnel from our legal, finance, and relevant business departments (the "Incident Management Team"). Our Vice President, Cybersecurity brings extensive experience in software development, IT, and cyber security, gained in over two decades in the telecommunications, financial services, defense, and healthcare sectors. Notably, he spent the last four years at a medical device company focused on insulin delivery, where he successfully established the product security program and played a pivotal role in obtaining clearance for its flagship product line.


text: As the leader of our Information Security Team, our Vice President, Cybersecurity, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, requesting and allocating budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy and security incident handling procedure are designed to escalate certain cybersecurity incidents to members of management who are part of the Incident Management Team. The Incident Management Team works to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the cybersecurity incident response policy and security incident handling procedure include escalating certain cybersecurity incidents to our disclosure committee and, if appropriate, to the Privacy and Security Subcommittee.


text: The Privacy and Security Subcommittee meets periodically, and receives regular reports from our Vice President, Cybersecurity and, as appropriate, other members of the Information Security Team concerning any significant cybersecurity threats and risk and the processes we have implemented to address them. The Privacy and Security Subcommittee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, generally. The Privacy and Security Subcommittee provides regular reports to the Nominating and Corporate Governance Committee of significant matters related to the Privacy and Security Subcommittee's responsibilities, and the Nominating and Corporate Governance Committee together with the VP, Cybersecurity in turn provide regular reports to our Board of Directors on such significant matters.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data (Information Systems and Data).


text: Our information security function is led by our Vice President, Cybersecurity (our Information Security Team), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Chief Information Officer, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity and Data Privacy Oversight Subcommittee (the Privacy and Security Subcommittee) of the Nominating and Corporate Governance Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Privacy and Security Subcommittee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Vice President, Cybersecurity and includes our Chief Human Resources Officer, Vice President, Privacy, senior personnel from our legal, finance, and relevant business departments (the Incident Management Team). Our Vice President, Cybersecurity brings extensive experience in software development, IT, and cyber security, gained in over two decades in the telecommunications, financial services, defense, and healthcare sectors. Notably, he spent four years at a medical device company focused on insulin delivery, where he successfully established the product security program and played a pivotal role in obtaining clearance for its flagship product line.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials ("Information Systems and Data").

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team, IT department and other relevant team members work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; interruptions to our commercial operations, clinical trials or other operations; harm to our reputation; loss of revenue or profits; loss of sales and other adverse consequences." Our board of directors addresses our cybersecurity risk management as part of its general oversight function.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, legal, human resources, compliance, risk and privacy functions, among others. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our IT department have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.


text: Certain members of our management team and IT department are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.


text: The board of directors receives regular reports from management concerning our cybersecurity risk management program. The board also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.


text: Commencing in 2024, our Nominating / Corporate Governance Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.


text: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks, with the assistance of a third-party IT managed service provider. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools in certain environments, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of certain threats and actors; conducting vulnerability assessments in certain environments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating certain threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of certain data, network security controls on certain networks, data segregation, Wi-Fi segregation, access controls for certain environments, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; interruptions to our commercial operations, clinical trials or other operations; harm to our reputation; loss of revenue or profits; loss of sales and other adverse consequences."


text: Our Nominating / Corporate Governance Committee has oversight of our cybersecurity risk management program and reports to our board of directors on cybersecurity matters.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors and/or the Nominating / Corporate Governance Committee.


text: The Nominating / Corporate Governance Committee receives regular reports from management concerning our cybersecurity risk management program, and also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management advisors, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: AGIOS PHARMACEUTICALS, INC.

ticker: AGIO


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President, Information Technology and Facilities, or the VP of IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our VP of IT has worked in the information technology field for over 20 years at both biotechnology companies and management consulting firms, and holds a Bachelor of Science in Management and a Masters of Business Administration. We also maintain a team of experienced senior level engineers who design, implement and operate our information technology ecosystem, helping to implement cybersecurity best practices throughout our information technology infrastructure and governance processes. We periodically assess our processes against cybersecurity frameworks, such as the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, Center for Internet Security, or CIS, Controls, and International Organization for Standardization, or ISO, 27001.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Table of Content s Our Vice President, Information Technology and Facilities, or the VP of IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our VP of IT has worked in the information technology field for over 20 years at both biotechnology companies and management consulting firms, and holds a Bachelor of Science in Management and a Masters of Business Administration. We also maintain a team of experienced senior level engineers who design, implement and operate our information technology ecosystem, helping to implement cybersecurity best practices throughout our information technology infrastructure and governance processes. We periodically assess our processes against cybersecurity frameworks, such as the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, Center for Internet Security, or CIS, Controls, and International Organization for Standardization, or ISO, 27001.


text: Zurn Elkay's management and Board recognize the importance of robust oversight of cybersecurity risk, information security, and technology risk in maintaining the trust and confidence of our customers, partners, employees, and stockholders. The Audit Committee, on behalf of the Board, oversees the Company's material financial and other risk exposures, including risks related to cybersecurity. Our Board has extensive cybersecurity experience, including two members of the Audit Committee who have received a certificate in cybersecurity oversight from the Carnegie Mellon University Software Engineering Institute. Cybersecurity risk also is monitored, assessed and managed as part of the Company's integrated Enterprise Risk Management program on an ongoing basis. A cybersecurity governance council, comprised of executive leaders, meets at least quarterly to review the Company's cybersecurity program and its effectiveness. This cybersecurity governance council receives updates and reports from the Company's global cybersecurity team (discussed below) on the cybersecurity program and its effectiveness relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. The Chief Information Officer (CIO) provides periodic updates to the Audit Committee on any material initiatives and key updates on the cybersecurity program and its effectiveness, including any material threats. The CIO also provides an annual update regarding information security to the full Board. The CIO has more than 35 years of information technology experience, including approximately 17 years serving as a CIO.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect and respond to cybersecurity threats, including threats associated with the use of third-party service providers, the Company has a robust cybersecurity program. The Company's global cybersecurity team, overseen by the CIO, implements policies and procedures and uses a balanced approach to validate the effectiveness of the program, leveraging third party expert security resources, information technology resources, executive business leadership, internal and external audit, third-party vendors and other IT and business partners. The program uses a combination of standards and best practices from the National Institute of Standards and Technology, Center of Internet Security, third-party vendor partners, and other industry forums. Annually, the program is assessed both internally and externally, including a thorough industry benchmarking, maturity assessments, best practice reviews, and risk assessments, with control validation occurring monthly internally (focused on core critical controls), quarterly (focused on vulnerabilities/cyber-incident simulations) and annually (focused on a review of best practices) via third-party vendors and partners, and annually via external third parties, including the conduct of internal/external penetration tests and tabletop exercises. Third-party service providers are assessed initially based on security questionnaires and the access of third-party service providers is audited annually and/or with any change in circumstances. Third-party service providers are also monitored through a combination of security information and event management technology and managed detection response services. The CIO provides key results and findings from these assessments to the cybersecurity governance council and Audit Committee. The Company has a robust incident response plan intended to help provide timely remediation to cybersecurity incidents and also to help provide notice of any material incidents to the appropriate internal and external entities.


text: To help associates acquire the knowledge to support the protection of our environment, the Company provides comprehensive annual security awareness training, periodic information updates, and regular testing/training programs. In addition, the Company annually purchases a cybersecurity insurance policy.


text: The Company depends heavily on information technology infrastructure to manage our business objectives and operations, support our customers' requirements and protect sensitive information. To date, the Company has not experienced a cybersecurity threat or cybersecurity incident that has materially affected the Company, including our business strategy, results of operations or financial condition. While the Company has a robust cybersecurity program in place and has taken steps to maintain and enhance its cybersecurity, a material security breach could impede the Company's ability to carry on business in the normal course.


text: As we have previously described in Item 1A, Risk Factors, there have been significant and increasing instances of data and security breaches, malicious interference with technology systems and industrial espionage involving companies in numerous industries, including cloud providers, and cybersecurity threats are becoming more complex. In addition, at times a large percentage of our workforce may be working remotely in response to outbreaks of infectious disease, which may heighten these risks. While we have taken steps to maintain and enhance our cybersecurity by implementing additional security technologies, internal controls, network and data center resiliency, redundancy and disaster recovery processes and backup systems, upgrading our remote work environment and by obtaining insurance coverage, these measures may be inadequate and our technology systems could be vulnerable to disability, failures, or unauthorized access. As a result, any inability by us to successfully manage our information systems, or respond effectively to any attack on or interference with our systems, including matters related to system and data security, privacy, reliability, compliance, performance and access, problems related to our systems caused by natural disasters, security breaches or malicious attacks, and any inability of these systems to fulfill their intended business purpose, could impede our ability to record or process orders, manufacture and ship in a timely manner, account for and collect receivables, protect sensitive data of the Company, our customers, our employees, our suppliers and other business partners, comply with our third party obligations of confidentiality and care, or otherwise carry on business in the normal course. Any such events could require costly remediation beyond levels covered by insurance and could cause us to lose customers and/or revenue, including as a result of legal or regulatory claims or proceedings, or damage our reputation, any of which could have a material adverse effect on our business and operating results. We are also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on us. We collect, store, access and otherwise process various types of confidential or sensitive data, including proprietary business information, personal data and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.


text: Zurn Elkay's management and Board recognize the importance of robust oversight of cybersecurity risk, information security, and technology risk in maintaining the trust and confidence of our customers, partners, employees, and stockholders. The Audit Committee, on behalf of the Board, oversees the Company's material financial and other risk exposures, including risks related to cybersecurity. Our Board has extensive cybersecurity experience, including two members of the Audit Committee who have received a certificate in cybersecurity oversight from the Carnegie Mellon University Software Engineering Institute. Cybersecurity risk also is monitored, assessed and managed as part of the Company's integrated Enterprise Risk Management program. A cybersecurity governance council, comprised of executive leaders, including the two members of the Audit Committee with cybersecurity experience, meets at least quarterly to review the Company's cybersecurity program and its effectiveness. This cybersecurity governance council receives updates and reports from the Company's global cybersecurity team (discussed below) on the cybersecurity program and its effectiveness relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. The Chief Information Officer (CIO) provides periodic updates to the Audit Committee on any material initiatives and key updates on the cybersecurity program and its effectiveness, including any material threats. The CIO also provides an annual update regarding information security to the full Board. The CIO has more than 36 years of information technology experience, including approximately 18 years serving as a CIO.


text: As we have previously described in Item 1A, Risk Factors, there have been significant and increasing instances of data and security breaches, malicious interference with technology systems and industrial espionage involving companies in numerous industries, including cloud providers, and cybersecurity threats are becoming more complex. In addition, at times a large percentage of our workforce may be working remotely, which may heighten these risks. While we have taken steps to maintain and enhance our cybersecurity by implementing additional security technologies, internal controls, network and data center resiliency, redundancy and disaster recovery processes and backup systems, upgrading our remote work environment and by obtaining insurance coverage, these measures may be inadequate and our technology systems could be vulnerable to disability, failures, or unauthorized access. As a result, any inability by us to successfully manage our information systems, or respond effectively to any attack on or interference with our systems, including matters related to system and data security, privacy, reliability, compliance, performance and access, problems related to our systems caused by natural disasters, security breaches or malicious attacks, misuse of artificial intelligence tools, and any inability of these systems to fulfill their intended business purpose, could impede our ability to record or process orders, manufacture and ship in a timely manner, account for and collect receivables, protect sensitive data of the Company, our customers, our employees, our suppliers and other business partners, comply with our third party obligations of confidentiality and care, or otherwise carry on business in the normal course. Any such events could require costly remediation beyond levels covered by insurance and could cause us to lose customers and/or revenue, including as a result of legal or regulatory claims or proceedings, or damage our reputation, any of which could have a material adverse effect on our business and operating results. We are also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on us. We collect, store, access and otherwise process various types of confidential or sensitive data, including proprietary business information, personal data and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.


text: As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company. As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers. In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services. These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers. Our Governance, Risk and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.

companyName: APPIAN CORP

ticker: APPN


text: Board Governance Disclosure One of the Board's key functions is informed oversight of our risk management process, which includes responsibility for ensuring management has processes in place designed to identify, evaluate, manage, and mitigate cybersecurity risks to which it is exposed. The Board receives regular updates, on at least a quarterly basis, from our senior management team on such cybersecurity risks, developments in cybersecurity, and updates to the Company's information security management program. The Board is also involved in strategic decisions related to the impact of these risks on our business.


text: Management Governance Disclosure Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters. Our CISO, who joined Appian in May 2021, brings over 17 years' experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries. We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.


text: As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company. As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers. In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services. These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers. Our Governance, Risk, and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.


text: Management Governance Disclosure Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters. Our CISO, who joined Appian in May 2021, brings over 18 years' experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries. We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.


text: At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to MongoDB Atlas, which is certified against ISO 27001:2013, ISO 27017:2015, ISO 27018:2019, SOC 2 Type II, Payment Card Industry Data Security Standard v.4, and Cloud Security Alliance ("CSA") Security, Trust, Assurance, Information Security Registered Assessors Program and Risk ("STAR") Level 2. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.

companyName: MongoDB, Inc.

ticker: MDB


text: Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. In addition, on a quarterly basis, certain members of our board of directors meet with our Chief Information Security Officer, ("CISO"), and other senior executives to perform more in-depth reviews of the Company's cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies and report back to the Audit Committee regarding the matters reviewed. Ahead of each such quarterly meeting, management, including the CISO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Audit Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Audit Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.


text: Our cybersecurity programs are under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated security leaders are certified and experienced information systems security professionals and information security managers each with well over a decade of experience. Our CISO and information security team, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to our Business and Industry" in this annual report on Form 10-K.


text: At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to MongoDB Atlas, which is certified against ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 9001:2015, SOC 2 Type II, Payment Card Industry Data Security Standard v.4, and Cloud Security Alliance ("CSA") Security, Trust, Assurance, Information Security Registered Assessors Program and Risk ("STAR") Level 2. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.


text: Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Security Committee, which was established this past year. The Security Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. On a quarterly basis, the Security Committee meets with our Chief Information Security Officer, ("CISO"), and other senior executives to perform more in-depth reviews of the Company's cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies. Ahead of each such quarterly meeting, management, including the CISO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Security Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Security Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.


text: Our cybersecurity programs are under the direction of our CISO, who receives reports from our security teams and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and key security leaders are certified and experienced information systems security professionals, security engineers, and information security managers each with well over a decade of experience. Our CISO and security teams, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.


text: As one of the world's largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our clients. Our cybersecurity risk management program is an integral part of our overall enterprise risk management program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Our Board and its committees oversee the Company's risk management processes, including but not limited to those relevant to cybersecurity risks, and are regularly briefed by management on risk management considerations. One of the primary tools that facilitates the Board's oversight and mitigation of risk is the Company's Enterprise Risk Management ("ERM") Program, which is designed to look holistically at risks which may cause a material, adverse impact to the Company's operations, reputation, or value. As part of the ERM Program, our Chief Operating Officer directs and chairs the ERM Steering Committee, which is comprised of members of senior management, including our Chief Financial Officer, General Counsel, Chief Information Officer, Chief Information Security Officer, Chief Administrative Officer, and Chief Ethics and Compliance Officer.


text: Under the ERM Program, our Chief Operating Officer prepares for the Board a quarterly update of our enterprise risks, including but not limited to enterprise cybersecurity risks, and conducts with the Board an annual risk identification and mitigation analysis. In addition to updates provided through the ERM Program, the Board is regularly updated by members of management, including the Chief Accounting Officer, Chief Legal Officer, and members of the ERM Steering Committee concerning significant risks facing the Company and processes that have been implemented to mitigate these risks, including but not limited to cybersecurity risks. Additionally, throughout the year, each of our sector presidents who leads one of our major market units provides a comprehensive overview of their market, including risks and challenges. See "Item 1C. Cybersecurity—Governance—Management's Responsibilities" below for additional information regarding our cybersecurity risk management program.


text: We also conduct periodic internal and third-party assessments, threat simulations, and exercises to test the effectiveness of our cybersecurity defenses and controls, including associated policies and procedures. We undertake efforts to address and mitigate risks from vulnerabilities identified during such assessments, simulations, and exercises.


text: Management's Responsibilities Our cybersecurity risk management program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who are responsible for our information security strategy, policies, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CIO has over 25 years of information technology and program management experience, addressing complex information technology and cybersecurity challenges for large-scale enterprises in the U.S. Department of Defense, U.S. federal agencies, and commercial organizations. Our CISO, a Certified Information Systems Security Professional ("CISSP"), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.


text: As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.


text: To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of the Booz Allen and client information provided to the supplier, we also require suppliers to complete our security questionnaires (based on data categorization) and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.


text: Our CIO and CISO also lead our Cyber Fusion Center ("CFC"), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure.


text: The Cyber Incident Response Team ("CIRT") is responsible for the incident response process and provides direction and guidance to users of Booz Allen information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support and resources are required.


text: Board of Directors' Roles and Responsibilities The Audit Committee is responsible for oversight of the Company's risk management and mitigation, including but not limited to the Company's cybersecurity risks, and is regularly briefed by our CIO and CISO regarding the Company's cybersecurity risk management program, cybersecurity incidents involving the Company, vendors, suppliers, subcontractors and other third parties, as well as associated mitigation actions taken, in order to assess and manage associated risks and potential harm and damages. The Audit Committee reports to the Board on cybersecurity risks to the Company on a periodic basis.


text: Even with our extensive and systematic approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the cost related to cybersecurity threats or disruptions may not be fully insured.


text: During the period covered by this Annual Report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or our financial condition. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, reputation, or financial condition. See Item 1A., "Risk Factors," for a discussion on cybersecurity risks and how they could materially affect the Company.


text: As one of the world's largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our customers. Our cybersecurity risk management program is an integral part of our overall Enterprise Risk Management ("ERM") program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.


text: Cybersecurity oversight is embedded in our ERM Steering Committee, chaired by the Chief Operating Officer and including senior executives such as the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"). This committee is responsible for: • Identifying, assessing, and managing cybersecurity risks within the broader ERM framework; • Aligning cybersecurity risk management priorities and strategies with business objectives; • Monitoring periodic internal and third-party assessments, threat simulations, and security exercises to evaluate cybersecurity defenses; and • Addressing identified vulnerabilities through mitigation efforts and risk response strategies. See "Item 1C. Cybersecurity—Governance—Management's Responsibilities" below for additional information regarding our cybersecurity risk management program.


text: Management's Responsibilities Our cybersecurity risk management program is led by our CISO, who is responsible for our information security strategy, policies, compliance, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CISO, a Certified Information Systems Security Professional ("CISSP"), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.


text: As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to, cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.


text: To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of our and our customers' information provided to the supplier, we also require suppliers to complete our security questionnaire and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.


text: Our CISO also leads our Cyber Fusion Center ("CFC"), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure. The CFC partners with a third party managed systems security provider ("MSSP") to augment 24x7 cyber incident monitoring.


text: The Cyber Incident Response Team ("CIRT") is responsible for the incident response process and provides direction and guidance to users of our information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify and respond to potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Crisis Management Team, Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support or resources are required.


text: Board of Directors' Roles and Responsibilities The Board oversees the Company's risk management processes, including those relevant to cybersecurity risks, and the Audit Committee provides focused governance of cybersecurity, ensuring that cybersecurity threats, vulnerabilities, and incident response measures are continuously assessed and managed. The Audit Committee receives regular briefings from the CISO on risks related to internal systems, third-party relationships, and emerging cybersecurity threats. The Audit Committee provides updates to the Board on significant cybersecurity risks and the Company's mitigation strategies.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NEVRO CORP


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on assessment of their criticality to our operation and respective risk profile, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations,business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents, as well as any incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology personnel who in turn manage our retained external cybersecurity consultants. Our management team's experience includes significant responsibility for developing and maintaining cybersecurity risk management programs and for managing cybersecurity risks prior to joining us.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal information technology environment.


text: Our CISO oversees our cybersecurity risk management in partnership with our Chief Financial Officer, General Counsel, Chief Compliance and Privacy Officer and other members of management. These members of management monitor and are informed of the prevention, mitigation, detection and remediation of cybersecurity incident through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Our CISO has worked for over 30 years in information technology, including the areas of infrastructure, security and application architecture. In the last 15 years, he has worked in security for healthcare, pharmaceutical and technology companies, the last six years as CISO. He earned his Bachelor of Science in Electronic Engineering from Universidade Federal do Rio de Janeiro in Brazil.


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.

companyName: LXP Industrial Trust

ticker: LXP


text: Our enterprise risk management framework was developed in conjunction with a third-party that objectively assessed key stakeholder responses to questionnaires on our operations and business functions, including information technology and cybersecurity. Our internal controls over financial reporting include key controls covering certain information technology and cybersecurity processes that are documented and tested annually.


text: The Audit and Cyber Risk Committee of our Board of Trustees assists our Board of Trustees on oversight of management in connection with regularly assessing our key risks and engaging in enterprise-wide risk management as they relate to cybersecurity and our technology and information systems, including with respect to strategies, objectives, capabilities, initiatives, policies and investments. A member of our Board of Trustees and the Audit and Cyber Risk Committee of our Board of Trustees is a recognized cybersecurity expert as a member of the Tech & Cybersecurity Advisory Committee for U.S. Senator Mark Warner and having been an investor in and director of private and public technology-focused companies.


text: We employ a Director of Information Technology who works exclusively on information technology and cybersecurity matters and has over 28 years of related experience. We employ a Director of ESG and Corporate Operations who spends part of her business time on information technology matters, specifically business applications, and has 11 years of related experience. Both employees report to our Chief Operating Officer.


text: Due to our size and the size of our employee base, we use third-party vendors to assist us with our network and information technology requirements. Since 2019, BDO USA, LLC ("BDO") has acted as our outsourced chief technology officer/chief information security officer ("CTO/CISO") and provided us with the following services through a dedicated partner in BDO Digital's Security & Compliance: • Overseeing chief security role and informing leadership of cybersecurity risks and the role of staff in protecting information, including, but not limited to: Monitoring emerging risks, suggesting and overseeing implementation of mitigations; Championing security awareness and training programs; and Reporting significant security events to leadership.


text: • Guidance regarding incidence response, business continuity and disaster recovery program, strategy and testing. • Oversight and guidance on vendor risk management processes and individual vendor profiles. • IT strategy advice. • Monitoring the relationship with our information technology managed services provider. • Technical, policy and procedure recommendations.


text: Together with our Director of Information Technology, BDO reports frequently to our Chief Operating Officer and General Counsel and to the Audit and Cyber Risk Committee of our Board of Trustees on a quarterly basis.


text: We outsource our information technology managed services to a third-party provider of customized private cloud solutions featuring virtual desktops and servers. Our Director of Information Technology, together with BDO, oversees the third-party managed service provider ("MS Provider").


text: We maintain a critical systems vendor management program with the assistance of a third-party provider of vendor risk intelligence data, including cybersecurity vulnerabilities, business health and credit risk.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated incident response plan. Our incident response plan was developed to guide the internal response to incidents taking into account a recognized third party cybersecurity framework. Pursuant to our incident response plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the incident response team is made up of two teams: the information security response team and the business response team. The information security response team is generally led by our Chief Operating Officer and includes our CTO/CISO, our Director of Information Technology, our MS Provider account manager, our Chief Financial Officer and other members of our senior leadership. The business response team includes primary and secondary contacts for each impacted business area. These individuals assist with any necessary customer notification procedures. The incident response team regularly reports to senior management, including the CEO, in the event of a significant incident, and our Chief Operating Officer and Chief Financial Officer provide reports to our Audit and Cyber Risk Committee and our Board of Trustees.


text: The Audit and Cyber Risk Committee oversees, on behalf of the Board of Trustees, our information technology and cybersecurity strategy and initiatives. Our Board of Trustees has determined that one of the members of our Audit and Cyber Risk Committee is an information technology/cybersecurity expert and has significant experience in, among other areas, emerging technologies and coordinating national security and technology policy. On at least a quarterly basis, our Chief Operating Officer, CTO/CISO and Director of Information Technology report to our Audit and Cyber Risk Committee on information technology matters, including cybersecurity. Our Audit and Cyber Risk Committee then updates the Board of Trustees following management's update. On a periodic basis, our Audit and Cyber Risk Committee commissions an external assessment of our cybersecurity practices and receives a report from the third-party firm performing our internal audit function. The most recent assessment was completed in 2023.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from, and reporting cybersecurity events.


text: Prevention and Preparation As noted above, we utilize our MS Provider for cloud-based information technology services. This third-party solution includes 24/7 monitoring and is built to the NISI/ISO framework. We also engage a nationally recognized public accounting firm to perform periodic cybersecurity assessments, which entail performing a qualitative current state evaluation of our cybersecurity program in line with specific domains within the recognized third party framework. In addition, we take the following preventative measures: • We engage a third party to perform internal and external penetration tests on an annual basis. • We require multi-factor authentication for our network and primary applications. • We utilize geolocation-based blocking.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is annual employee training on cybersecurity around phishing, malware and other cyber risks. We use a third-party provider of security awareness training and simulated phishing for our email phishing reporting and cyber security training. Our employees are required to complete quarterly cybersecurity training programs.


text: We maintain comprehensive business continuity and disaster recovery plans, which update on at least an annual basis and we test through tabletop exercises on an annual basis. We do not maintain any on-premises data or servers.