text: Diamondback's cybersecurity risk management program, which it provides to us under the services and secondment agreement, includes: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise IT and operational technology ("OT") environments; • a security team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) its response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of its security controls; • security tools deployed in the IT and OT environments for protection against and monitoring for suspicious activity; • cybersecurity awareness training of its employees, including incident response personnel and senior management, including those who provide these services for us; • cybersecurity tabletop exercises for members of its cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Diamondback's cybersecurity governance program is led by its Senior Vice President and Chief Information Officer, with support from the internal information technology department. Diamondback's Senior Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. Diamondback's Senior Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, Diamondback's cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with its Computer Security Incident Response Plan. Progress and developments in Diamondback's cybersecurity governance program are communicated to members of its and our executive team. Diamondback's and our management takes steps to remain informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by Diamondback; and alerts and reports produced by security tools deployed in the enterprise IT and OT environments. While our board of directors is ultimately responsible for enterprise-wide risk oversight, the board's committees assist the board in fulfilling its oversight responsibilities in certain areas of risk. In particular, the board's audit committee is responsible, among other things, for risk management relating to legal and regulatory requirements, including cybersecurity, which plays an integral role in the risk management strategy and continues to be an area of increasing focus for our board, the audit committee and management.

companyName: VNOM Sub, Inc.

secItem: Item 1C


text: The audit committee of the board of directors receives quarterly updates on the status of Diamondback's cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur, to the extent relevant to our program. Board members receive presentations on cybersecurity topics from Diamondback's Senior Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, Diamondback's code of business conduct and ethics expects all employees to safeguard the electronic communications systems and related technologies of Diamondback and its subsidiaries, including us, from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to Diamondback's Chief Legal and Administrative Officer and Senior Vice President and Chief Information Officer. Diamondback's cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party service providers, suppliers and vendors. Diamondback's vendor management process may include reviewing the cybersecurity practices of such providers, contractually imposing obligations on the providers, conducting security assessments and conducting periodic reassessments during their engagement.


text: Risks from cybersecurity threats have not materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. Risk Factors of this report for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: Under agreements with NEE Management and NEER, NEE's affiliates provide or arrange for the provision to NEP of substantially all of NEP's information technology functions, including those relating to cybersecurity. NEP's board oversees the provision of these services.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: NEE operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE (information systems), including those used for the provision of functions to NEP, that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats), as well as on its operations, including its provision of services to NEP. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.


text: NEE operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats, including those related to NEP, which is led by a cybersecurity incident response team. NEE uses these resources to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems and monitors for impacts to external vendors or suppliers, including those related to NEP. Assessment of an incident includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and individuals serving as officers and directors of NEP.


text: NEE conducts an annual internal cybersecurity drill with the participation from time to time of local, state and federal agencies to test its capability of dealing with a simulated cyber-attack. NEE also participates in industry forums and trade groups, as well as, in NERC activities to learn and apply these learnings to its cybersecurity policies and procedures.


text: NEE uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards. Further, NEE has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE continues to take steps to protect against cybersecurity threats to its and NEP's critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing system solutions to NEE or accessing NEE's systems or data, including those related to NEP, is evaluated as part of the new vendor establishment process. NEE retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or NEP's contracts with third-party vendors accessing their systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets in the past and there may be such attacks in the future. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor NEP's business strategy, results of operations, or financial condition, NEE's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and NEP to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.


text: NEE's chief information officer, the vice president, IT infrastructure and cybersecurity and the chief information security officer are responsible for assessing and managing material risks from cybersecurity threats, including those related to NEP, and have careers that represent more than 75 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including NEP's chief financial officer, general counsel, and president and the Cybersecurity Governance Executive Committee comprised of various members of management, including NEE's vice president of internal audit and executive director of emergency preparedness. These NEE committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries as well as NEP.


text: The NEP board is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity updates from NEE's chief information officer and its vice president, IT infrastructure and cybersecurity. Significant active cybersecurity incidents and threats are communicated to board personnel as they occur.


text: Under agreements with NEE Management and NEER, NEE's affiliates provide or arrange for the provision to XPLR of substantially all of XPLR's information technology functions, including those relating to cybersecurity. XPLR's board oversees the provision of these services.


text: NEE operates a cybersecurity program which, among other objectives, seeks to identify potential unauthorized occurrences on or conducted through the electronic information resources owned or used by NEE (information systems), including those used for the provision of functions to XPLR, that may result in adverse effects on the confidentiality, integrity or availability of its information systems or any information residing on those systems (cybersecurity threats), as well as on its operations, including its provision of services to XPLR. The cybersecurity program includes controls to reduce the risk and potential impact of a cybersecurity incident and to align its processes, controls and implemented technologies with industry standard frameworks and regulations. In addition, outside experts assess NEE's cybersecurity program capabilities, technology environment and security controls to regularly evaluate effectiveness.


text: NEE operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats, including those related to XPLR, which is led by a cybersecurity incident response team. NEE uses these resources, and leverages third party resources, to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems, and monitors for impacts to their vendors or suppliers, including those related to XPLR. Assessment of incidents includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and individuals serving as officers and directors of XPLR.


text: NEE conducts periodic desktop exercises and an annual cybersecurity drill with the participation from time to time of local, state and U.S. federal agencies to test its capability of dealing with a simulated cyberattack. NEE also participates in industry forums and various trade groups, as well as in NERC activities, to learn and apply these incident preparedness learnings to its cybersecurity policies and procedures.


text: NEE uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards. Further, NEE has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE continues to take steps to defend against cybersecurity threats to its and XPLR's critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.


text: The cybersecurity capabilities of third-party vendors providing services to NEE or accessing NEE's systems or data, including those related to XPLR, are evaluated as part of the new vendor establishment process. NEE retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or XPLR's contracts with third-party vendors accessing their systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.


text: NEE operates U.S. critical infrastructure for XPLR. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets and there may be such attacks in the future. In addition, the advancement of artificial intelligence has given rise to new security risks. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor XPLR's business strategy, results of operations, or financial condition, NEE's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and XPLR to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.


text: NEE's vice president and chief information officer, vice president cybersecurity and executive director cybersecurity are responsible for assessing and managing material risks from cybersecurity threats, including, through the MSA, those related to XPLR. They have careers that represent more than 50 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee and the Cybersecurity Governance Executive Committee. These NEE committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries as well as XPLR.


text: The XPLR board is responsible for the oversight of risks from cybersecurity threats. XPLR continues to utilize, through the MSA, NEE's cybersecurity program and capabilities. Significant active cybersecurity incidents and threats are communicated to XPLR's board as they occur.


text: We have adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and established policies and processes for assessing, identifying, and managing material cybersecurity risks based upon cybersecurity threats, vulnerabilities, likelihood, and impact, and have integrated these processes into our overall risk management systems and processes, which are overseen by our Chief Operating Officer and Chief Financial Officer. We routinely assess cybersecurity risks that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Axonics, Inc.


text: We conduct annual assessments to identify cybersecurity risks based on known threats and vulnerabilities, as well as assessments after any material change in our business practices that may affect information systems exposed to such cybersecurity risks. These risk assessments include identification of reasonably foreseeable internal and external threats and vulnerabilities, the likelihood that such threats will occur, and the impact on our business that could result from such occurrences. We then evaluate the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we adjust existing and implement new controls responsive to changes in the risk environment and maintain those controls to mitigate and minimize identified risks. This process includes reasonably addressing any identified gaps in existing safeguards and regularly monitoring the effectiveness of our controls over time. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director of IT who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our controls and train our employees on these controls, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties, in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect the Company.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats and vulnerabilities. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our audit committee is responsible for evaluating our cyber security program, cyber risk environment, and related risks and, with management, reporting findings and actions under our cyber security program and cyber risk environment to the full board of directors.


text: Our Chief Financial Officer, Chief Operating Officer and Director of IT have substantial relevant expertise in the life sciences industry and formal training in the areas of information security and cybersecurity risk management, and are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to identify, protect against, detect, respond to, and recover from current and emerging cybersecurity risks, and plans and strategies to address those risks and mitigate harm caused by cyber incidents.


text: Our Chief Financial Officer provides periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Oversight and Governance Weatherford is committed to protecting its information systems. These efforts are led by the Chief Information Officer ("CIO"). Our program is designed to align with international best practices used in our industry, such as the Cyber Security Framework from the National Institute of Standards and Technology ("NIST").

companyName: Weatherford International plc

ticker: WFRD


text: Weatherford's cybersecurity has been developed by the CIO and the information security team, in coordination with our Board and key members of our finance, assurance and legal teams. The information security team, which has years of experience selecting, deploying, and operating cybersecurity technologies and initiatives around the world, uses a risk-based approach in an effort to facilitate protection, detection and rapid response to threats. We seek to validate our approach through NIST Cyber Security Risk Assessments conducted by third parties and tested through penetration tests and tabletop exercises, as well as internal and external audits.


text: Information security is a key part of the Company's Enterprise Risk Management ("ERM") program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. The Company has established an ERM Committee that meets regularly to evaluate risks and coordinate a consistent approach to risk mitigation across the enterprise, including risks related to cybersecurity. The ERM Committee is comprised of certain members of our cross-functional executive leadership team.


text: The CIO reports quarterly to senior management, including the Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and General Counsel, among others, on the status of company-wide cybersecurity initiatives, risks and other developments. The CIO or key members of the executive leadership team update the audit committee of our Board periodically on the cybersecurity landscape, the status of ongoing initiatives and any threats or other issues. The audit committee has ultimate oversight over the cybersecurity of the organization.


text: Employee Awareness and Training Weatherford offers multilingual training sessions and awareness campaigns to better equip our employees with knowledge and tools to safeguard our information systems. Cybersecurity training occurs during onboarding and refresher courses are taken annually. Weatherford performs simulated phishing campaigns to raise employee awareness and provide guidance on recognizing and reporting potential threats. Employees are encouraged to report on cybersecurity threats, data privacy incidents, or any other concerns.


text: Weatherford also provides guidance to support employees on acceptable use, remote access, encryption, cloud security, and anti-virus best practices. Weatherford has long included a safety moment at the beginning of major internal meetings, and cyber safety is an occasional topic.


text: We believe our ongoing training and awareness campaigns reinforce the importance of employees in preventing cybersecurity incidents, and further the goal of continuously promoting Weatherford's culture of safety, security and compliance.


text: Protection Systems Weatherford has made significant investments in cyber protection systems, including by engaging third party service providers to actively search and monitor information systems for vulnerabilities through penetration testing and other means. In addition, multi-factor authentication and strong passwords are used across all major Weatherford systems in an effort to prevent unauthorized access.


text: Weatherford personnel perform risk assessments on third-party products and platforms through a checklist-based review and interview process that aim to validate security controls. Third parties are often asked to provide additional documentation on security architecture, certifications and results of assessments. Cybersecurity approval is a key factor in approving a new third-party product or platform.


text: Detection and Response Weatherford uses multiple internal and external resources to continuously monitor our information systems for evidence of a threat, breach or other incident.


text: When a threat or other issue is identified, the information security team follows an incident response plan that outlines the process for investigating and addressing the issue. The incident response plan is focused on prompt interdisciplinary communication and coordination between the information security team and key members of the finance, legal, and communication teams, as well as senior management. The information security team also utilizes specific runbooks for various types of threats that are updated and expanded based on lessons learned and emerging best practices. Our incident response plan also provides for consideration of whether an incident is material, requiring disclosure to shareholders in SEC filings. Our team also has a disaster recovery plan, under which recovery testing occurs annually.


text: Weatherford expects to continually invest in the improvement of cybersecurity infrastructure, as systems and needs evolve and as the threat landscape changes. Because we employ a prevention-based improvement cycle that requires the response team for each threat or incident to consider the root cause of the issue and any lessons learned throughout the response process, we strive to make corrections and improvements in our policies and procedures that are designed to safeguard against future threats.


text: While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks. See "Item 1A –Risk Factors – Our business could be negatively affected by cybersecurity incidents and other technology disruptions" for more information about cybersecurity risk.


text: Weatherford's cybersecurity program has been developed by the CIO and the information security team with oversight from our Board of Directors and in coordination with key members of our finance, assurance and legal teams. The information security team is comprised of specialists with a mix of government and public-sector cybersecurity experience, combined, they have years of experience selecting, deploying and operating cybersecurity technologies and initiatives globally. Many of our professionals hold university degrees in cybersecurity, information technology, management of information systems and related fields, along with industry-recognized certifications such as CISSP, CASP+, CEH and other related certifications. The team leverages a risk-based approach in an effort to facilitate protection, detection and rapid response to threats. We seek to validate our approach through NIST Cyber Security Risk Assessments conducted by third parties and tested through penetration tests and tabletop exercises, as well as internal and external audits.


text: The CIO reports quarterly to senior management, including the Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and General Counsel, among others, on the status of company-wide cybersecurity initiatives, risks and other developments. The CIO or key members of the executive leadership team update the audit committee of our Board of Directors periodically on the cybersecurity landscape, the status of ongoing initiatives and any threats or other issues. The audit committee has ultimate oversight over the cybersecurity of the organization.


text: Employee Awareness and Training Weatherford offers multilingual training sessions and awareness campaigns to better equip our employees with knowledge and tools to safeguard our information systems. Cybersecurity training is an integral part of our employee development program, beginning with comprehensive onboarding sessions to establish foundational knowledge. To ensure ongoing awareness and preparedness, employees complete annual refresher courses, which reinforce best practices and address emerging cybersecurity threats. Additionally, Weatherford performs periodic phishing simulations and training to enhance employee vigilance against social engineering attacks. We also provide industry-specific cybersecurity training to relevant employees to address sector-specific risks and strengthen our organization's overall security posture. Employees are encouraged to report on cybersecurity threats, data privacy incidents, or any other concerns.


text: Protection Systems Weatherford has made significant investments in cyber protection systems, including by engaging third party service providers to actively search and monitor information systems for vulnerabilities through penetration testing and other means. In addition, we use a comprehensive suite of cybersecurity tools and software, aligned with government and industry best practices, including multi-factor authentication, complex passwords and advanced security controls, across all major Weatherford systems in an effort to strengthen defenses and prevent unauthorized access.


text: Weatherford personnel conduct risk assessments on third-party products and platforms through a structured checklist-based review and interview process that aim to validate implemented security controls and mitigate risk to our organization. This process includes evaluating security architecture, verifying certifications and reviewing results of external security assessments. Additional documentation may be requested to clarify technical measures, compliance reports or risk treatment plans. Cybersecurity approval is a key factor in approving a new third-party product or platform.


text: While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks. To date, no cybersecurity incident or issue has had a material impact on us. See "Item 1A –Risk Factors – Our business could be negatively affected by cybersecurity incidents and other technology disruptions" for more information about cybersecurity risk.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. There were no material cybersecurity breaches during 2023. See "Risk Factors – Security breaches, cyber-attacks and other disruptions could compromise our information, expose us to fraud or liability, or interrupt our operations, which would cause our business and reputation to suffer."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and management updates the Board of Directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board of Directors also receives briefings from management on our cybersecurity risk management program and presentations on cybersecurity topics from external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our external cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Financial Officer has been managing our information technology resources for over 16 years and has overseen our cybersecurity risk assessment and the implementation of our cybersecurity risk management program since its inception.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. There were no material cybersecurity breaches during 2024. See "Risk Factors – Security breaches, cyber-attacks and other disruptions could compromise our information, expose us to fraud or liability, or interrupt our operations, which would cause our business and reputation to suffer."


text: Our cybersecurity program is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework, version 2.0 ("NIST CSF"). We conduct regular scans, penetration tests, and vulnerability assessments to identify potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third party service providers, including cloud-based platforms.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: We believe we have invested in monitoring practices to reduce cybersecurity risks and continue to monitor our systems on an ongoing basis for compliance with applicable privacy regulations and any current or potential threats. We engage third-party service providers to enhance our risk prevention and mitigation efforts. We have periodically engaged third parties to serve in a consultative and advisory manner to review current and future strategies. We also purchase insurance to help protect us against the risk of cybersecurity breaches.


text: Board and Committee Oversight - Our Board of Directors has ultimate oversight of the Company's cybersecurity programs and strategy, with the Audit Committee maintaining oversight responsibility in reviewing cybersecurity and other information technology risks. The Audit Committee assess the steps management has taken to monitor, minimize or control such risks or exposures. The Company's Chief Information Officer presents a cybersecurity report to the Audit Committee each quarter. The report includes updates of recent cybersecurity threats, current key performance indicators of security controls and summaries of any recent incidents at the Company.


text: The Company's Chief Information Officer ("CIO"), supported by the Director of IT Security and Compliance, manages cybersecurity risk. Our CIO has over 25 years of experience in information technology and six years of experience with the Company. The Company's enterprise-wide cybersecurity strategy is supported by policies, procedures, security controls and training designed to protect the Company's IT systems, operations and sensitive data. Specifically, our Cyber Incident Response Plan provides a process by which our Company is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and includes engaging the Cybersecurity and Risk Management Committee ("CRMC"). The CRMC is a management committee established to identify, assess and manage material cybersecurity incidents, including the incident recovery process within the Company. Depending on the significance of the incident, the Cyber Incident Response Plan could include engaging affected internal and external parties, escalating the issue to executive management, notifying one or more members of our Audit Committee, maintaining communication with users and notifying law enforcement and government agencies as warranted.


text: For additional information regarding cybersecurity risks, see the risk factor captioned "Cybersecurity incidents may threaten our confidential information, disrupt operations and result in harm to our reputation and adversely impact our business and financial performance" under Part I, Item 1A "Risk Factors".


text: Our cybersecurity program is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework, version 2.0. We conduct regular scans, penetration tests, and vulnerability assessments to identify potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third party service providers, including cloud-based platforms.


text: Board and Committee Oversight - Our Board of Directors has ultimate oversight of the Company's cybersecurity programs and strategy, with the Audit Committee maintaining oversight responsibility in reviewing cybersecurity and other information technology risks. The Audit Committee assesses the steps management has taken to monitor, minimize or control such risks or exposures. The Company's Chief Information Officer ("CIO") presents a cybersecurity report to the Audit Committee each quarter. The report includes updates of recent cybe rsecurity threats, current key performance indicators of security controls and summaries of any recent incidents at the Company.


text: The Company's CIO, supported by the Director of IT Security and Compliance, manages cybersecurity risk. Our CIO has over 25 years of experience in information technology and seven years of experience with the Company. The Company's enterprise-wide cybersecurity strategy is supported by policies, procedures, security controls and training designed to protect the Company's IT systems, operations and sensitive data. Specifically, our Cyber Incident Response Plan provides a process by which our Company is informed about and monitors the prevention, detection, mitigation and remediation of c ybersecurity incidents and includes engaging the Cybersecurity and Risk Management Committee ("CRMC"). The CRMC is a management committee established to identify, assess and manage material cybersecurity incidents, including the incident recovery process within the Company. Depending on the significance of the incident, the Cyber Incident Response Plan could include engaging affected internal and external parties, escalating the issue to executive management, notifying one or more members of our Audit Committee, maintaining communication with users and notifying law enforcement and government agencies as warranted.


text: OpCo has entered into the Services and Secondment Agreement with Westlake and we, OpCo and Westlake have entered into the Omnibus Agreement. Pursuant to these Agreements, Westlake performs various services for us, including those related to cybersecurity. As such, this disclosure addresses our cybersecurity policies and practices, some of which are executed by Westlake under the Services and Secondment Agreement and the Omnibus Agreement.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: With Westlake's support, we maintain a comprehensive approach to cybersecurity and data protection, based on a risk-based, defense-in-depth strategy. Westlake follows industry standard cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework to design, assess and update our cybersecurity strategy, controls and processes. Westlake regularly assesses industry best practices and standards and endeavors to implement them in its efforts to manage cybersecurity risk for us. The focus is on protecting our highest-value information assets, which include manufacturing systems, financial systems, and confidential, personal, and private information.


text: To safeguard our networks and systems, Westlake has a dedicated cybersecurity organization overseen by its Chief Information Security Officer, which operates within its information technology department overseen by its Chief Information Officer. Westlake's cybersecurity organization employs multiple security controls, such as firewalls, spam protection, web filtering, endpoint detection and response software, controlled access, vulnerability management, redundancies, patching, and regular onsite and offsite backups. Westlake's cybersecurity organization also uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and risk-based performance monitoring.


text: Both Westlake's Chief Information Officer and its Chief Information Security Officer have extensive experience in assessing and managing cybersecurity risks, including through decades of collective experience in information technology and cybersecurity roles of increasing responsibility both at Westlake and in prior positions. Westlake prioritizes cybersecurity awareness among employees and contractors through various training exercises, including formal programs and simulated phishing events. Westlake maintains incident response plans, playbooks, and engages third-party cybersecurity firms for simulated cyberattacks and penetration testing to identify potential risks. Westlake also has a third-party cybersecurity firm on retainer for incident assistance and response. Periodic internal self-assessments are conducted by Westlake's cybersecurity organization using the National Institute of Standards and Technology Cybersecurity Framework.


text: From time to time, we and OpCo experience cybersecurity threats and attempted breaches and other incidents. Westlake classifies and tracks these events based on significance and implements remediation actions that it considers appropriate to address the risks to the Partnership and OpCo relating to such incidents. Although we and OpCo have not experienced material impacts to our business strategy, results of operations or financial condition from any such incidents in the past three years, we cannot guarantee that a material incident will not occur in the future. See "Item 1A. Risk Factors—Failure to adequately protect critical data and technology systems could materially affect our operations."


text: The board of directors has authorized and approved our entry into the Services and Secondment Agreement and the Omnibus Agreement with Westlake, and has thereby charged Westlake's Corporate Risk and Sustainability Committee with assisting the board of directors with its oversight of cybersecurity risks, which is a component of our overall enterprise risk management program. As a result, Westlake's Corporate Risk and Sustainability Committee assists with the oversight of our cybersecurity risks. Westlake's Corporate Risk and Sustainability Committee includes directors with cybersecurity experience and expertise, primarily through supervision of information technology departments as executive officers. The board of directors also receives regular updates from Westlake's Chief Information Officer on cybersecurity risks, incidents and trends, and ongoing and planned projects impacting the Partnership and OpCo. Westlake's Chief Information Officer and our senior management receive regular status reports on the Partnership's and OpCo's cybersecurity risks from Westlake's cybersecurity organization. Further, incident updates are reported to our senior management and the board of directors as Westlake's Chief Information Officer and cybersecurity organization consider appropriate, depending on the severity of the incident.


text: As part of our incident response planning, Westlake also maintains cross-functional response teams involving personnel outside of its cybersecurity organization, both globally and regionally, in order to be prepared to respond to an incident.


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: Ashford Inc.


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer and the Chief Technology Officer. The Cyber Incident Response team meets bi-weekly to review incidents that have occurred. The Chief Technology Officer reviews weekly reports which contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a cross-organizational approach to addressing cybersecurity risk. We are committed to maintaining robust governance and oversight of cybersecurity risk and have implemented mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. The Board of Directors, its Audit Committee and our management, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), contribute to our cybersecurity and risk management processes designed to help us respond in a timely and effective manner to emerging threats in a dynamic cybersecurity landscape.

companyName: Qorvo, Inc.

ticker: QRVO


text: Cybersecurity risks are identified as part of our Enterprise Risk Management Program and regular cybersecurity assessment and planning. We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage cybersecurity risks. We engage with industry groups for benchmarking and awareness of cybersecurity best practices. We monitor internal and external cybersecurity developments that may affect our systems and our supply chain partners' systems, and have procedures to assess those issues for potential cybersecurity impact or risk.


text: The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, our CIO and our CISO regularly brief the Audit Committee on cybersecurity matters. In its oversight role, the Audit Committee receives reports on cybersecurity, including internal and external cybersecurity audits, on at least a quarterly basis. We have procedures led by our CISO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Audit Committee would be informed of an incident by our executive team.


text: Our CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO works with a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. This team manages and works to enhance the IT security structure with the goal of preventing significant cybersecurity incidents and increasing the resilience of our systems to minimize the business impact should an incident occur. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals on the information security team. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements, customer expectations, business priorities and emerging cybersecurity risks, and we expect to continue to make investments to maintain the security of our data and infrastructure. The underlying controls of the cyber risk management program are based on industry standards for cybersecurity and IT, including the National Institute of Standards and Technology ("NIST") frameworks and ISO 27001 requirements, although this does not mean that we meet all technical standards, specifications or requirements under NIST or ISO 27001 standards.


text: In addition, we provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats and to remind them of the importance of handling and protecting our information. We engage third-parties to conduct evaluations of our security controls, including testing both the design and operational effectiveness of our controls. We also participate in cybersecurity information-sharing with our peers, industry groups and government agencies.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require our key suppliers to comply with our security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us and require each to notify us in the event of any known or suspected cyber incident.


text: We face numerous cybersecurity risks in connection with our business. Such risks can impact our systems, results of operations and financial condition. We have, from time to time, experienced threats to and breaches of our data and systems, including malware, ransomware and computer viruses. Our customers, suppliers, subcontractors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. As of the date of this Form 10-K, we have not identified any risks from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition. For more information about the cybersecurity risks we face and the potential impacts on our Company due to a cybersecurity incident, please refer to Item 1A - Risk Factors - "Risks Related to Intellectual Property, Cybersecurity and Information Technology and Data Privacy".


text: We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements, customer expectations, business priorities and emerging cybersecurity risks, and we expect to continue to make investments to maintain the security of our data and infrastructure. The underlying controls of the cyber risk management program are based on industry standards for cybersecurity and IT, including the National Institute of Standards and Technology ("NIST") frameworks and ISO 27001 requirements, although this does not mean that we meet all technical standards, specifications or requirements under NIST or ISO 27001 standards.


text: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats and to remind them of the importance of handling and protecting our information. We engage third parties to conduct evaluations of our security controls, including testing both the design and operational effectiveness of our controls. We conduct regular vulnerability testing and tabletop exercises to test our readiness for a variety of potential incidents. We also participate in cybersecurity information-sharing with our peers, industry groups and government agencies.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and require our key suppliers to comply with our security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us. We also require each key supplier to notify us in the event of known or suspected cyber incidents.


text: We face numerous cybersecurity risks in connection with our business. Such risks can impact our systems, results of operations and financial condition. We have, from time to time, experienced threats to, and breaches of, our data and systems, including malware, ransomware and computer viruses. Our customers, suppliers, subcontractors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. As of the date of this Form 10-K, we have not identified any risks or incidents from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition. For more information about the cybersecurity risks we face and the potential impacts on our Company due to a cybersecurity incident, please refer to Item 1A - Risk Factors - "Risks Related to Intellectual Property, Cybersecurity, Information Technology and Data Privacy".


text: The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, our CIO and our CISO regularly brief the Audit Committee on cybersecurity matters. In its oversight role, the Audit Committee receives reports on cybersecurity, including internal and external cybersecurity audits, on at least a quarterly basis. We have procedures led by our CISO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and determine the appropriate or required external notifications. Based on an incident's nature and severity, the Audit Committee would be informed of an incident by our executive team.


text: Our CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CIO, who reports to our Chief Financial Officer, has over 30 years of experience in various IT and cybersecurity leadership roles throughout the industry. Our CISO has over 24 years of experience in cybersecurity, encompassing leadership roles in cybersecurity architecture, risk and compliance, incident response, cybersecurity operations, and identity management. The CISO works with a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. This team manages and works to enhance the IT security structure with the goal of preventing significant cybersecurity incidents and increasing the resilience of our systems to minimize the business impact should an incident occur. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals on the information security team.


text: To help address cybersecurity threats, we have developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader ERM program. We are committed to a risk-centric, layered information security approach to secure our data, systems, and services. We prioritize our data security initiatives and processes based on our assessment of known and anticipated threats to our data security. Utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, we strive for continuous improvement and utilize a metrics-based approach to identify and mitigate data security risks that could potentially impact our business operations or clients.

companyName: H&R BLOCK INC

ticker: HRB


text: We maintain multiple levels of protection to mitigate data security risks, and we regularly test our systems to discover and address potential vulnerabilities, including without limitation: • using a multi-layered, zero-trust principled approach to secure systems; • systematic monitoring of our sites and services to detect and respond to unauthorized activity; and • regular security audits and vulnerability assessments conducted by our dedicated internal information security team, our internal auditors, and by external third parties.


text: In addition, we engage in a broad range of activities to secure and protect the data that we obtain through our business operations including, but not limited to: • continued development and enhancement of our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access; • security and business controls to appropriately limit access to and use of personal information, including adaptive and multifactor authentication; • comprehensive data protections, including encryption, to facilitate the secure storage, use, and transmission of sensitive data; • annual privacy/data security training to all employees and contractors and regular awareness and testing activities year-round regarding social engineering threats, such as phishing, for employees; • background checks on our employees, as permitted; • due diligence requirements and controls for third parties (e.g., service providers) with access to sensitive data throughout the lifecycle of the relationship; and • a dedicated global information security team that partners with all technology groups to monitor, prioritize, and remediate risks to the enterprise.


text: The Audit Committee of the Board of Directors has the primary responsibility of assisting our Board in the oversight of policies and processes pertaining to the ERM program and specifically considers risks and controls relating to, among other things, data and cybersecurity. Risks associated with cybersecurity threats are a top priority for ongoing oversight by the ERM team and the Enterprise Risk Committee. Our Vice President, Legal and Corporate Secretary, oversees the activities of the Enterprise Risk Committee and, together with the Chief Information Security Officer (CISO), briefs the Audit Committee and the Board of Directors on information security risk matters as a part of regular ERM reports, with a deep dive focused on information security at least annually (or more frequently if appropriate).


text: In addition, the Audit Committee receives regular reports on cybersecurity matters from the Chief Legal and Administrative Officer (CLAO) and the CISO. The Board of Directors is also updated by the CLAO and CISO on a periodic basis. Our CLAO, who reports directly to the President and CEO, has over 30 years of leadership experience across multiple industries in roles responsible for overseeing and managing risk. Our CISO, who reports directly to the CLAO, has extensive cybersecurity knowledge and skills gained from over 30 years of experience in consulting and technology roles, with more than 18 years of Information Security specialization. Our CISO is responsible for understanding, managing, and communicating cybersecurity risks internally to our management (including the Enterprise Risk Committee on which he serves), and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our CISO heads the Information Security team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by us to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also periodically engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats, and Incidents We have been, and continue to be, the subject of cybersecurity threats, and we describe how risks from these threats, if realized, are reasonably likely to materially affect us. See further discussion of these items in our Item 1A. Risk Factors of this Form 10-K. As of the date of this report, we have not identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations, or financial condition, in the future.


text: Our risk management program is designed to identify, assess and mitigate risks across our company. When considering financial, operational, regulatory, reputational and legal risk, our program is well matched for our size and complexity. Our Chief Technology Officer, in conjunction with the Chief Operating Officer, is currently responsible for managing our information security program. Given the increasing risk involving cybersecurity and the Bank's evolving needs and reliance on technology, our strategy involves the addition of a Chief Information Security Officer. The Chief Information Security Officer will be primarily responsible for the cybersecurity component of our risk program. These responsibilities include performing and maintaining a cyber risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, access levels, third party risk and vendor management and business continuity planning. This key role will be developed as we expand our overall risk management program.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: Our objectives for managing cybersecurity risk is to greatly minimize the impacts of external threats. This includes, but is not limited to, efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed to comply with industry standards, such as the National Institute of Technology Cybersecurity Framework. We successfully leverage several associations, industry groups, audits and enhanced monitoring to promote the effectiveness of our program. Our Chief Technology Officer, who reports to our Chief Operating Officer, collaborates regularly with peer banks and other industry groups to identify and implement best practices. Our program is regularly reviewed in an effort to address emerging trends and threats.


text: We maintain multiple controls in an effort to manage cybersecurity threats. We employ various preventative and detective controls to monitor, block and prevent suspicious activity including those that provide real-time alerts and response. We have systems designed to mitigate cyber risk, which includes ongoing training for employees, preparedness and tabletop exercises, and recovery testing. We maintain a robust vendor management program that identifies, assesses and documents risk associated with external service providers. We proactively monitor email servers for malicious activity and limit remote work only to qualified positions. We leverage internal and external auditors to review processes, systems and controls related to our information security program to ensure they are operating effectively. Management proactively responds to all recommendations designed to strengthen or improve our operating environment.


text: We maintain a detailed Incident Response Plan which outlines the steps we would implement in the event of an actual or potential cybersecurity event. The Incident Response Plan includes timely notification of an escalation to the appropriate levels of management and Board of Directors. The Incident Response Plan is reviewed and updated at least annually and mandates coordination and collaboration across all levels of management and all areas of the Bank.


text: The Board of Directors reviews components of the information security program on annual basis including policies, procedures, risk assessments, table top testing results, attestations, budgets and strategies. These components are presented by Executive Management as part of the regular board meeting schedule and strategic planning process.


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: ATLANTIC INTERNATIONAL CORP.

ticker: ATLN


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.


text: In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors or an officer appointed by our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.


text: Risk management and strategy Via Renewables, Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Managing Material Risks & Integrated Overall Risk Management Via Renewables, Inc. has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integrated part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Via Renewables, Inc. engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Via Renewables, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established a robust oversight mechanism to ensure effective governance in managing risks associated by cybersecurity threats because we recognize the significant of these threats to our operations integrity and stakeholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Chief Operating Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. The Chief Operating Officer provides comprehensive briefings to the Audit Committee on a regulatory basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and Chief Operating Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Via Renewables, Inc. The Audit Committee conducts an annual review of the Company's cybersecurity program and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risk rests with the Director of Infrastructure. With over 26 years of experience in the field of cybersecurity, the Director of Infrastructure brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of Infrastructure oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Director of Infrastructure is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director of Infrastructure implements and oversees processes for the regulatory monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Director of Infrastructure is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to the Board of Directors The Director of Infrastructure, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Operating Officer (COO) of all aspects related to cybersecurity risks and incidents. The CFO and COO regularly inform the Chief Executive Officer (CEO) of such risk and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Via Renewables, Inc. Furthermore, significant cybersecurity mattes, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risk rests with the Director of Infrastructure. With over 27 years of experience in the field of cybersecurity, the Director of Infrastructure brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of Infrastructure oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Director of Infrastructure is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director of Infrastructure implements and oversees processes for the regulatory monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities.


text: In the event of a cybersecurity incident, the Director of Infrastructure is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: The Company has multi-layer processes to assess, identify and manage material risks from cybersecurity threats. These processes are integrated into the Company's enterprise risk management as part of its overall risk management strategy.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: A cross-functional team of senior leadership assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The team includes senior leaders in areas of importance to Company priorities, including the Company's Chief Privacy Officer, who is also our Vice President of Information Technology and the Chief Legal Officer. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors.


text: The Chief Privacy Officer oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information security team, and outside resources. The VP, Chief Privacy Officer, who has 30 years of IT and IT security experience, 20 of which are at the Company, employs a team of information technology experts, including a dedicated Cyber Security Analyst. The VP, Chief Privacy Officer and the Cyber Security Analyst are further supported by other members of the IT department.


text: The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following:


text: The VP, Chief Privacy Officer, dedicated Cyber Security Analyst, and other key members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures, and provide for continuity of operations.


text: The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements.


text: The Company employs an information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. The Company engages external third parties to advise on emerging threats to stay current and strengthen our security capabilities. The Company performs penetration testing and other exercises within internal and external networks for potential vulnerabilities.


text: The Company additionally performs annual tabletop exercises with the information technology team pertaining to infrastructure and cyber security related events, to test the Company's incident response and business continuity plans in the event of a cybersecurity incident.


text: Bi-annually the Company engages a third party to conduct an audit of the Company's cybersecurity systems and processes to test their adequacy and efficacy. The results are shared with senior leadership and the Audit Committee of the Board, and incorporated into strategic security plans. The Company maintains cybersecurity insurance, which is assessed annually for the appropriateness of coverage levels and emerging trends.


text: The Company also has in place an Incident Response Plan that enables it to quickly categorize, respond, and escalate to senior leadership and the Audit Committee of the Board, real or potential cybersecurity incidents in a manner designed to mitigate overall business impact.


text: In connection with the Company's review and approval for potential new vendors, the Company assesses the data types or Personally Identifiable Information that the vendor may maintain, store or access and reviews the adequacy of their cybersecurity procedures and legal protections. Legal counsel and the VP, Chief Privacy Officer review the cyber and contractual protections and consider the overall risk profile considering the type of agreement, data involved, vendor, and jurisdiction, among other factors. Vendors deemed to have insufficient controls balancing the relevant criteria will not be approved.


text: The Board of Directors is kept apprised of material risks from cybersecurity threats through the Audit Committee. The Audit Committee is responsible for overseeing threats to the Company, including those involving cyber threats, and reviewing the Company's protocols and procedures to mitigate those threats. On a quarterly basis, the VP, Chief Privacy Officer, presents to the Audit Committee on the Company's cybersecurity compliance and risk management practices. These presentations address, among other things, the results of audits and reviews of our security information systems and other cybersecurity measures, the current threat environment and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. The Audit Committee discusses the adequacy and efficacy of the controls and shares the information with the Board as part of its risk oversight function. Outside of quarterly presentations, the Audit Committee is informed of incidents that in senior leadership's discretion require more immediate Audit Committee attention.


text: To date, the Company has not, to its knowledge, experienced any cybersecurity threats or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to the risk factor titled " Our inability or failure to execute our business continuity and response plan following a major disaster such as a natural disaster, terrorism, social unrest or a cybersecurity incident affecting our corporate facilities could materially adversely affect our business" in "Item 1A, Risk Factors" in this report for additional information about risks related to cybersecurity matters.


text: A cross-functional team of senior leadership assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The team includes senior leaders in areas of importance to Company priorities, including the Company's Chief Privacy Officer, who is also our Senior Vice President of Information Technology and the Chief Legal Officer. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors.


text: The Chief Privacy Officer oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information security team, and outside resources. The SVP, Chief Privacy Officer, who has over 30 years of IT and IT security experience, 21 of which are at the Company, employs a team of information technology experts, including a dedicated Cyber Security Analyst. The VP, Chief Privacy Officer and the Cyber Security Analyst are further supported by other members of the IT department.


text: The SVP, Chief Privacy Officer, dedicated Cyber Security Analyst, and other key members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures, and provide for continuity of operations.


text: The Company employs an information security and training program for our employees, including annual mandatory computer-based training, regular internal communications, and ongoing end-user testing throughout the year to measure the effectiveness of our information security program. The Company engages external third parties to advise on emerging threats to stay current and strengthen our security capabilities. The Company performs penetration testing and other exercises within internal and external networks for potential vulnerabilities.


text: In connection with the Company's review and approval for potential new vendors, the Company assesses the data types or Personally Identifiable Information that the vendor may maintain, store or access and reviews the adequacy of their cybersecurity procedures and legal protections. Legal counsel and the SVP, Chief Privacy Officer review the cyber and contractual protections and consider the overall risk profile considering the type of agreement, data involved, vendor, and jurisdiction, among other factors. Vendors deemed to have insufficient controls balancing the relevant criteria will not be approved.


text: The Board of Directors is kept apprised of material risks from cybersecurity threats through the Audit Committee. The Audit Committee is responsible for overseeing threats to the Company, including those involving cyber threats, and reviewing the Company's protocols and procedures to mitigate those threats. On a quarterly basis, the SVP, Chief Privacy Officer, presents to the Audit Committee on the Company's cybersecurity compliance and risk management practices. These presentations address, among other things, the results of audits and reviews of our security information systems and other cybersecurity measures, the current threat environment and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. The Audit Committee discusses the adequacy and efficacy of the controls and shares the information with the Board as part of its risk oversight function. Outside of quarterly presentations, the Audit Committee is informed of incidents that in senior leadership's discretion require more immediate Audit Committee attention.


text: To date, the Company has not, to its knowledge, experienced any cybersecurity threats or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. In the last three years, the Company has not experienced any material cybersecurity incidents and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to "Item 1A, Risk Factors— Risks Related to Information Technology and Data Security" in this Annual Report for additional information about risks related to cybersecurity matters.


text: Avanos has implemented a comprehensive cybersecurity program to identify, assess and manage material risks from cybersecurity threats. In addition, we have instituted executive management and board oversight of the risks arising from cybersecurity threats. Cybersecurity Risk Management and Strategy.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: We have a proactive strategy to manage the material risks stemming from cybersecurity threats. Our cybersecurity program follows the Cybersecurity Framework as defined by the National Institute of Standards and Technologies. The Cybersecurity program is the responsibility of our internal IT Security Team, which is overseen by our Vice President, Chief Information Officer (the "CIO").