text: Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management's cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber risk. This ERM Committee is composed of the Company's Executive Vice Presidents and each of the Company's Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology ("IT") leads the information security program, manages cyber governance and incident management. The Vice President of IT and the Director of Infrastructure and Security have over forty-five years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reports to the Board on critical cyber risk and security topics presented to the Audit Committee by management. In addition, informal and ad hoc conversations about cyber risk and industry developments frequently occur among Board members and management.


text: Incident Management We have implemented security procedures and measures in order to protect our information from theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cybersecurity incidents. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board. During 2024, we did not experience a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we make extensive efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A. Risk Factors—General Risk Factors."

companyName: LSB INDUSTRIES, INC.

ticker: LXU

secItem: Item 1C


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our patients, collaborators, health care providers, and prospective and future customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Consistent with overall policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company conducts global clinical trials. As a consequence, we have global cybersecurity threat operations function 24/7, with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, and other key business functions, third party vendors, as well as the members of the Board through the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, the Company's Vice President, Information Technology, other members of management and relevant management committees and councils.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and to the Board through the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, through the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that would meet the applicable established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least twice each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Chief Operating Officer.


text: The Company's Chief Operating Officer is the member of the Company's executive management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Operating Officer has served in various roles in research and development, operations, portfolio management and compliance for over 30 years, including serving as a member of the executive leadership team and Sr. Vice President, Operations and Project and Portfolio Management at other companies. The Chief Operating Officer earned a Master's of Public Health (MPH) in biostatistics and epidemiology and a B.A. in psychology from the University of Oklahoma Health Sciences Center. He also earned a B.S. in nursing from the University of Kansas Medical Center.


text: The Company's Chief Operating Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Operating Officer and the IT Security Operations Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Risks from the cybersecurity threats we have faced to date have not materially affected, and we believe are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. However, due to evolving cybersecurity threats, we may not be able to protect all information systems, and integrating information systems as we acquire new businesses or expand our business may expose us to unexpected liabilities or increase our vulnerability. See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee’s cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. “Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, mitigate or remediate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident impacting our data at a third-party vendor or customer. Contracts with third-party vendors, who have access to our network or who hold or store personal information on our behalf, contain provisions requiring such vendors to maintain a program that meets our information security standards. We periodically assess risk of vendor compliance with our information security program requirements, including the obligation that our vendors must notify First Advantage within a designated time period upon identifying certain cybersecurity events. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our cybersecurity team is led by our interim chief information security officer ("CISO"), who directs a unified cross-functional team that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at First Advantage. Our interim CISO has numerous years of experience at First Advantage and other organizations managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Collectively, the interim CISO and our cybersecurity team act in close coordination with senior leadership and other teams across First Advantage. In addition to our extensive in-house cybersecurity capabilities, we engage assessors, consultants, auditors, or other third parties to help assess, identify, and manage cybersecurity risks.


text: Our cybersecurity risk management process forms a critical component of our overall risk management and business strategy. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. Additionally, we utilize data encryption and access control, single sign-on and multi-factor authentication, and malware protection within our control environment. We also maintain a variety of incident response plans that are utilized when incidents are detected. These plans are designed to be flexible so that they may be adapted to an array of potential scenarios and provide for the creation of cross-functional cybersecurity incident response teams in the event of a cybersecurity incident. We regularly review our incident response plans and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident. Additionally, we require employees with access to our information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.


text: As part of our incident detection and response processes, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within First Advantage (including the interim CISO, Chief Financial Officer, and Chief Legal Officer) and to the Audit Committee and Board of Directors based on incident materiality. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our interim CISO, and our Chief Legal Officer. We maintain cybersecurity insurance, which provides coverage for certain costs related to cybersecurity incidents.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and related mitigation activities are also subject to oversight by the Audit Committee of our Board of Directors. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks, including management's response to any significant cybersecurity incidents. The Audit Committee receives regular reports, from our interim CISO and Chief Technology Officer, regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items, and reports to the Board of Directors at least quarterly.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Our business, brand, and reputation may be harmed as a result of security breaches, cyber-attacks, employee or other internal misconduct, computer viruses, or the mishandling of personal data" and should be read in conjunction with the information above."


text: Cybersecurity is an integral part of risk management at the Company, and we and Hess share a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We rely primarily on Hess' cybersecurity risk management program and processes, including policies, controls or procedures, which includes a cybersecurity incident response plan as well as our own property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: Hess Midstream LP

ticker: HESM


text: We and Hess design and assess the program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we or Hess meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our businesses.


text: Our cybersecurity risk management program is integrated into the overall enterprise risk management program overseen by Hess' Chief Risk Officer, who also serves as our Chief Financial Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our and Hess' business risks, including financial, compliance, EHS and governance matters, among other topics.


text: The Company's and Hess' cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our services as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all Hess employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: The Company has not identified risks from known cybersecurity threats during the year ended December 31, 2024, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Part I, Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology systems and infrastructure used by us, Hess or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: Our general partner's board of directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Company. The board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee primary responsibility for oversight of the Company's risk management practices, including oversight of cybersecurity and other information technology risks.


text: The audit committee oversees the implementation of our cybersecurity risk management program. The committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and Hess employee training activities. In addition, management updates the committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: We rely on Hess' management team – including the Chief Risk Officer, the Head of Information Technology and the Chief Information Security Officer ("CISO") – for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both Hess' internal cybersecurity personnel and retained external cybersecurity consultants. Hess' Chief Risk Officer, who also currently serves as our Chief Financial Officer, has nearly 20 years of experience in this role and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Hess' Head of Information Technology and Hess' CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, Hess' CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.


text: The management team is informed about and monitors the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Hess; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management Strategy We have implemented various processes and policies for identifying, assessing, and managing material risks from cybersecurity threats. Our cybersecurity risk management strategy is designed following the Cybersecurity Framework set by the National Institute of Standard and Technology, or NIST.

companyName: LeonaBio, Inc.

ticker: LONA


text: We assess our information technology, or IT, environment against the NIST Cybersecurity Framework, as well as various cyber-attack vectors, working to identify and remediate risks. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, for example, by enforcing single sign-on or multi-factor authentication where supported, and the use of mobile device management to secure company resources on employee personal devices. Additionally, we engage third-party cybersecurity experts to assess the security of our network and perform continuous system monitoring, and we engage a third party to perform internal audits of our IT General Controls, or ITGCs. We have implemented certain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, for example, by evaluating such service providers' own cybersecurity processes and reviewing available certification and audit reports, including International Organization for Standardization, or ISO, certifications for information security management systems, and System and Organization Controls, or SOC, reports.


text: At this time, we have not experienced cybersecurity incidents, or are aware of any risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Board of Directors Our board of directors is responsible for general oversight and regular review of information regarding our risks, including cybersecurity risks. Members of management communicate an overview of our current cybersecurity environment to our board of directors at least annually and provide updates to our board of directors regarding cybersecurity matters periodically throughout the year. Additionally, our third-party auditors inform the audit committee of our board of directors of our ITGC framework and control testing results, which include controls related to cybersecurity risks. Further, management has established cybersecurity incident response processes for escalating the communication of cybersecurity incidents up to the board of directors, as appropriate.


text: Material risks from cybersecurity threats are assessed and managed by a dedicated team comprised of internal and external IT professionals experienced in cybersecurity threat risk management, who ultimately report to our senior vice president, finance and accounting. Our senior vice president, finance and accounting has extensive operational and leadership experience overseeing accounting and finance functions at various organizations, including oversight of critical accounting and finance IT systems. Our senior IT consultant has over 20 years of experience with IT and cybersecurity risk management, having served in senior executive-level IT positions at multiple Fortune 500 companies and companies within the life sciences industry.


text: Our team of IT professionals, which continuously monitors our IT environment for cybersecurity threats and incidents, routinely reports on cybersecurity incident prevention, detection, mitigation, and remediation efforts to our senior vice president, finance and accounting and chief compliance officer. Additionally, we have established policies addressing processes for responding to potential cybersecurity incidents, including assessment, communication, and remediation protocols. Our incident response processes further provide for the escalation of cybersecurity incidents to our executive management team and board of directors, as appropriate.


text: The Company faces various risks from cybersecurity threats in connection with its business on a day to day basis, including, without limitation, information theft, destruction and inaccessibility; unauthorized disclosure of sensitive or confidential information; extortion; harm to clients and employees; reputational risk, legal and regulatory risk and increased costs to manage cyber risk, which could materially adversely affect our business, strategy, results of operations and financial condition. Our cybersecurity risks arise out of managing sensitive and confidential information of our clients, as well as our own confidential and proprietary information, and our dependence on information technology systems and networks to securely process, transmit and store this information and to communicate among our global locations and with third parties, including our clients and other key stakeholders involved in our clients' transactions. The cyber threat landscape is constantly evolving, and the increase in periodic work-from-home workforce and their reliance on technology that enables such work has increased the cyber threat landscape and related risks. While we do not believe we have, as of the date of this Form 10-K, experienced a cybersecurity incident that materially affected our business, our business strategy, our results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For further information, see "Our business is subject to various cybersecurity and other operational risks" and "We may incur losses as a result of unforeseen or catastrophic events, including the emergence of a pandemic, cybersecurity incidents and events, terrorist attacks, war, trade policies, military conflict, climate-related incidents, or other natural disasters" in Item 1A, Risk Factors of this Annual Report.

companyName: Moelis & Co

ticker: MC


text: We maintain a cybersecurity program, which includes processes for the continuous monitoring of our information systems in order to assess, identify and manage cybersecurity threats. We use known industry strategies to manage these cyber threats, including, without limitation, identity and access management, security awareness training, network security, physical access controls, endpoint security, encryption, incident response planning and vulnerability management. The relevant information collected from the tools is, among other things, leveraged to identify potential weaknesses, monitor threats that seek to identify and exploit these weaknesses and refine and adjust our security controls as the cyber threat landscape changes. Our cybersecurity program includes policies governing how employees access, use and interact with our firm assets and data deemed to be in our custody. Our security team considers industry cybersecurity best practices and applicable statutory and regulatory obligations when creating policies, implementing controls and engineering technology integrations.


text: Recognizing the complexity and continuously developing nature of cybersecurity threats, Moelis periodically engages with a variety of external experts, including consultants, auditors and cybersecurity assessors in evaluating and testing our cyber risk management systems. Our collaboration with these third parties include, but are not limited to; threat assessments, consultation on security enhancements and regular periodic audits.


text: Our security program also contains a third-party risk management process which is designed to assess third-party vendors' information security posture and inform management on the potential cyber risk introduced by third-party products and services and the broader security team's recommendations for risk management.


text: Our cybersecurity program is overseen by a full-time security team led by our Chief Information Security Officer ("CISO"), reporting directly to our Chief Information Officer ("CIO"). Our CISO has over 20 years of experience in the field of cybersecurity, including prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has over 18 years of experience as a Chief Information Officer, over 35 years of experience in the field of information technology and oversees the cybersecurity function.


text: Our cyber security program includes a cyber incident response policy overseen by our CISO. This incident policy sets forth the procedures to be followed in the event of a cybersecurity event, including escalation, mitigation, and remediation steps. Our cyber security procedures provide criteria for the escalation of cybersecurity events to management of the other operational functions of the Company to participate in determining and executing on the response. Depending on the nature and severity of the incident, we have procedures for escalating notification to our executive officers and Board of Directors.


text: Our Board of Directors is responsible for oversight of our cybersecurity risks. Cybersecurity risk management is integrated into our broader risk management framework. Our Board meets at least quarterly to conduct a review of matters related to cybersecurity, including an assessment of the cybersecurity threat landscape, cyber risk mitigation initiatives, the status of projects to strengthen internal cybersecurity, and an update on security events during the period. In addition, management will escalate cybersecurity incidents to the Board of Directors between quarterly meetings in accordance with our escalation procedures.


text: In today's digital world, protecting our systems and data from cyberattacks and unintentional or malicious breaches is a priority for our leadership and Board of Directors. Our cybersecurity team is overseen by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance. This leadership team has decades of experience leading cybersecurity oversight and managing our organization's cybersecurity risks. Team members who support our information security program have relevant educational, industry experience, and technical certifications. The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents the Company has experienced. Directors with experience in cybersecurity and technology play crucial roles in strategy, innovation, and oversight of the Company's technology investments. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats.

companyName: TEGNA INC

ticker: TGNA


text: TEGNA uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has clearly defined policies and standards for all employees and technical systems. We use external subject matter experts to provide independent assessments of the cybersecurity program. Following the NIST Cybersecurity Framework, TEGNA utilizes internal reporting, policies, software, training programs, secure software development coding practices and hardware solutions to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion, detection and prevention systems, vulnerability and penetration testing and identity management systems. Our network is continuously monitored using prevailing industry tools, and our cybersecurity team promptly investigates any anomalies. TEGNA has an extensive patching and software update program, and performance metrics are reported to our Board. All new employees are required to take a cybersecurity training course, and we have mandatory quarterly training modules for all employees.


text: We maintain third-party vendor policies and practices to identify, prioritize, and mitigate and remediate third party risk. Third-party access is narrowly limited in scope, granting access only to necessary systems with the lowest level of privileges required. Third-party access is monitored, and accounts are reviewed and attested to on a quarterly basis. TEGNA relies on third parties to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: TEGNA has documented and tested incident response plans, which outline the steps to be followed from incident detection to containment, recovery, and notification, including notifying functional areas, as well as senior leadership and the Board, as appropriate. With assistance from third-party cybersecurity experts, TEGNA regularly conducts cybersecurity tabletop exercises with leadership and technical teams. TEGNA conducts compliance reviews of all cybersecurity policies and procedures at least annually and utilizes an outside cybersecurity firm to evaluate the overall program. Business units are required to attest to applicable TEGNA security controls monthly.


text: Notwithstanding the extensive approach TEGNA takes to cybersecurity, we face a number of cybersecurity risks in connection with our business. Although to date such risks have no t materially affected us, including our business strategy, results of operations or financial condition, we have from time-to-time experienced threats to our information systems and data. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors".


text: We assess, identify and manage material risks from cybersecurity threats through various policies, procedures and processes, including through our Enterprise Risk Management program (ERM), our information security policies and standards, workforce cybersecurity trainings and third-party assessments and programs.

companyName: STEPAN CO

ticker: SCL


text: The Company uses ERM principles to help identify, prevent, and mitigate potential risks, including cybersecurity and related risks. We base our ERM program on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Individuals representing Stepan's global locations and functions contribute to our risk assessments at least annually through surveys and in-person interviews. Members are polled quarterly to spot emerging risks and trends. The Company's Vice President, Chief Compliance and Risk Officer leads the ERM program and reports regularly to the Audit Committee of the Board of Directors on ERM matters.


text: The Company maintains cybersecurity programs according to the set of guidelines developed by the National Institute of Standards and Technology through the Cybersecurity Framework. The Company maintains a set of IT Security Standards that provides a framework of layered security protection. In addition, the Company maintains and communicates to its workforce a Use of Information Technology Policy to support the understanding of and commitment to safely using IT assets. This knowledge can help prevent accidental or intentional misuse of Company IT resources, which can compromise the confidentiality, integrity, and availability of sensitive data and systems. The Company requires cybersecurity training to raise awareness and educate employees about cybersecurity risks. The Company updates its training program at least annually.


text: The Company engages a variety of IT assessors to evaluate and test the Company's cybersecurity and cybersecurity controls. Additionally, the Company engages IT consultants to provide tabletop exercises, ransomware simulations, cyber policy and standards development, cybersecurity, data security, and IT training events, cybersecurity and data security testing and monitoring, and cybersecurity implementation projects.


text: Although the Company has put in place the cybersecurity policies, procedures and processes described above, the Company remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition. As of the filing of this Form 10-K, we are not aware of any attacks, incidents, misuse or manipulation that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. For risks associated with cybersecurity threats, see the risk factor "Interruption of, damage to or compromise of the Company's information technology (IT) systems, failure to maintain the integrity of customer, colleague or Company data or illegal or fraudulent activities committed against the Company could harm the Company's reputation and have an adverse effect on the Company's business, financial position, results of operations and cash flows." included in "Part I—Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Company's Board of Directors (the Audit Committee) oversees the Company's cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company's Chief Information Officer. The Company's Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company's Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company's cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company's cybersecurity team provides periodic reports to such auditors.


text: The Company created an Enterprise Security Council ("ESC") that is comprised of senior IT management (including the CISO and CIO), Internal Audit and Compliance leaders which meet regularly to evaluate potential security risks to the Company and its IA.

companyName: MBIA INC

ticker: MBI


text: The CISO is responsible for performing a thorough examination of any identified or suspected cybersecurity incidents or violations. The CISO will collaborate with the Company's General Counsel and other relevant personnel during this formal review. Documentation detailing the event and an action plan, if required, will be generated by the CISO. Additionally, communication will be promptly established with the Cyber Incident Response Team ("CIRT"), and if deemed necessary, the Audit Committee.


text: The Audit Committee receives quarterly or more frequent as appropriate, briefings from the Company's senior management and CISO. The briefings concern, among other topics, the cyber threat landscape and associated risks to the Company, updates to the Company's cybersecurity program and associated policies, its ongoing strategy to prevent, identify and react to security incidents, internal and external vulnerability assessments, penetration testing results, and Internal Audit's periodic reviews of MBIA's security controls, policies, and procedures. The CIRT is comprised of senior leaders from across the company, which include Legal, Compliance, Investor/Media Relations, and Information Technology.


text: Our cybersecurity program is led by a team of skilled cybersecurity professionals, including dedicated internal cybersecurity resources and external advisors. In the normal course of business, we may collect and store sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We maintain a robust cybersecurity incident response plan, which details the incident response procedures, tactical and strategic team membership, and points of contact related to the response processes. The Company also maintains a detailed decision-tree-based playbook which is a supplement to the plan and focuses on specific types of incidents and the appropriate response steps. Cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach. The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are fully integrated into the Company's ERM program. The plan and playbook are structured to align with the National Institute of Standards and Technology ("NIST") Cybersecurity framework practices. The plan and playbook are reviewed at least annually. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Metallus Inc.

ticker: MTUS


text: The Company adheres to a periodic, third-party facilitated testing exercise of the cybersecurity incident response plan and playbook with the Company's tactical and strategic team members. The teams are comprised of key members of the organization and external advisors who hold critical importance in the handling of cybersecurity events. The exercise covers response procedures for prevalent cybersecurity incidents including but not limited to phishing, third-party breaches, and a standard incident response process. The documentation helps leaders make appropriate, pre-planned decisions. To assist, appendices detailing generalized incident response checklists and workflows from the Cybersecurity & Infrastructure Security Agency ("CISA") and the NIST are referenced and used as a framework. Lastly, the response plans contain instructions on collecting and incorporating lessons learned after a successful identification and remediation of a security event. The information security team also works in partnership with the Company's internal audit team to review information technology-related internal controls with our external auditor as part of our overall internal controls process.


text: In addition, the rapid evolution and increased adoption of artificial intelligence ("AI") and similar machine learning technologies may intensify our cybersecurity risks. In 2024, we established an AI council comprised of a cross-functional group of employees with an objective to deliver value by providing education regarding the uses, benefits and risks of AI and similar technologies in our business, establishing a governance framework and principles for our use of AI, and enabling deliberate experimentation with new technologies employing AI. At this time, our use of AI is focused primarily on data analytics and improving product quality and asset reliability.


text: In light of the pervasive and increasing threat from cyberattacks, the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cyberattacks. The Company's Information Technology ("IT") leadership team consults with and provides regular updates to the Board of Directors, as well as our chief executive officer and other members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of the information security program, timely reports regarding any cybersecurity incident that meets established reporting thresholds, and emerging threat landscape. In addition, the Company has an IT governance committee, which is comprised of the chief executive officer, IT and other officers of the Company. The IT governance committee meets quarterly, and as necessary, to discuss the cybersecurity program and other relevant topics. The IT team also consults regularly with the Board of Director's cybersecurity expert in between meetings. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors, at least semi-annually. The Board of Directors has oversight responsibility for our data security practices and we believe the Board of Directors has the requisite skills and awareness into the design and operation of our data security practices to fulfill this responsibility effectively.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data of our customers and employees ("Information Systems and Data").

companyName: Definitive Healthcare Corp.

ticker: DH


text: Our Information Security function is overseen by our Chief Technology Officer ("CTO"), our information security team, security management, engineering operations, legal, risk management, and various third-party service providers, including our virtual Chief Information Security Officer ("vCISO"). In doing so, they identify, assess and manage the Company's cybersecurity threats and risks, using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal and/or external audits and threat assessments for internal and external threats, utilizing third-party threat assessments, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and incident response policy, incident detection and response capabilities, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications for certain platforms, encryption of certain data, network security controls and data segregation for certain environments, access controls for certain systems, physical security, asset management, tracking and disposal, systems monitoring, incident response table-top exercises, vendor risk management program, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cyber risk is addressed as a critical component of the Company's enterprise risk management program and is based upon entity-level controls found in our SOC2 compliance program, addressing all five trust service criteria: security, availability, confidentiality, privacy, and processing integrity. The Company recently received an unqualified opinion from an industry-recognized audit firm attesting to our SOC2 Type II compliance as of the date of such report.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, dark web monitoring services, forensic investigators, cybersecurity software providers, managed cybersecurity service providers, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, risk assessments for each vendor, reviewing certain vendors' security assessments and written information security programs, the imposition of information contractual obligations, and, in certain instances, security assessment calls with select vendors' security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including providing third-party attestations of compliance with certain cybersecurity frameworks, such as SOC2 or ISO 27001.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our "Risks Related to Data Privacy and Cybersecurity" under Part 1. Item 1A. Risk Factors in this Annual Report.


text: Our audit committee of the board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Information technology and Director of Information Security, each Senior Principal Security and Infrastructure Architect with over 20 years' experience managing large scale enterprise information technology and security systems and programs.


text: The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CTO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, Chief Legal Officer and Chief Executive Officer in their role as executive leadership for the Incident Response Team. The executive leadership team will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policy include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As part of our Enterprise Risk Management ("ERM") process, we identify risks and assign responsibility for managing each risk to the appropriate level of management. Cybersecurity is a risk identified in our ERM process. Management has implemented a comprehensive cybersecurity risk management strategy in line with industry standards and regulatory requirements. This strategy includes: • conducting an independent cybersecurity maturity assessment to evaluate the health of our overall cyber programs and developing a solid roadmap to continuously improve our defensive posture; • performing regular risk assessments, where we identify potential vulnerabilities and evaluate the likelihood of various cyber threats; • implementing security controls including email and browser protection, audit log monitoring, malware defenses, controlled use of administrative privileges, encryption protocols, and multi-factor authentication; and • implementing progressively challenging employee training and awareness programs, including simulated phishing campaigns, to reduce the risk of human error in the recognition and reporting of potential threats.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: We continuously monitor our networks and systems and integrate threat intelligence feeds to evaluate evolving cyber threats. We conduct regular testing and simulation exercises, including engaging third-party service providers to perform penetration testing, to identify and address weaknesses in our defenses and engage third-party service providers to perform cybersecurity risk assessments, which are based on the National Institute of Standards and Technology framework. Cyber risks are considered and addressed for those third-party relationships deemed critical to our operations, as well as those with access to or custody of confidential data or customer non-public information, including PHI, and those services or products accessed in a cloud environment or involving generative artificial intelligence or other machine learning technologies.


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for our enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.


text: Related to Cybersecurity Risks Our board of directors is responsible for overseeing the Company's risk management process. Our board of directors focuses on our general risk management strategy and the most significant risks facing the Company, and works to ensure that appropriate risk mitigation strategies are implemented by management. Our board of directors also is apprised of particular risk management matters in connection with its general oversight and approval of corporate matters.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Our board of directors has delegated oversight of the Company's risk management process to the Audit Committee of our board of directors (the "Audit Committee"). Among its duties, the Audit Committee reviews with management the Company's policies with respect to risk assessment and management of risks that may be material to us, including cybersecurity risk management. The Audit Committee receives, at a minimum, quarterly reports about legal and compliance matters, which can include reporting on cybersecurity incidents occurring or threats that have been thwarted or are being monitored during the prior period, as reported internally by the Chief Information Technology Officer ("CITO").


text: The CITO, who has served in this role for over nine years, regularly reports cybersecurity updates to our Chief Operating Officer who, in his dual role as Chief Financial Officer, is our primary liaison with the Audit Committee. To inform about these updates and help guide cybersecurity related activities across our organization, the CITO has assembled a cybersecurity focus group and steering committee that meets on a quarterly basis and is made up of experienced representatives from various of our cybersecurity risk management consultants, external network security experts and cloud storage providers. These meetings are chaired by the CITO and include discussion of our cybersecurity needs, taking into account the latest industry trends.


text: On an annual basis, the CITO presents to the Audit Committee a detailed overview of our IT department's operations, including staffing and risks inherent in this functional area in order to apprise the Audit Committee, among other things, of our cybersecurity risks, how they arise throughout our business and what management's mitigation strategies are. The Audit Committee periodically engages third-party specialists to perform maturity assessments of our cybersecurity program. The Audit Committee reports on these matters to our board of directors as needed. In addition, the CITO periodically presents directly to our board of directors on our cybersecurity program.


text: Cyber Risk Management and Strategy We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the cybersecurity risks we face, see Item 1A, Risk Factors. To help manage these risks, we have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and treatment of cybersecurity risks. These assessments are aligned with industry standards and leading practices, and provide a comparison based on practices at comparable organizations and recommendations for management to consider. In addition to these external assessments, compliance readiness is assessed at a minimum annually by our CITO, in the form of penetration testing and vulnerability assessments. This program extends to a review of the cybersecurity measures in place at the properties that we own as well as our corporate headquarters, and selected senior managers also have participated in a tabletop exercise curated by our external security consultant to test and improve our incident response planning. We also maintain processes around third-party vendor risk management, such as the submission of vendor questionnaires to critical vendors and the inclusion of contractual security requirements as appropriate.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annually or whenever there are material changes to the Company's systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: The Company's Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 19 years of healthcare IT experience with an emphasis in IT security and computer forensics. The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company's risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board of Directors at least annually or more regularly at the discretion of the ORC.


text: The Audit Committee of the Board of Directors is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Audit Committee and such report addresses overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and systems along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations. These processes include plans to be used in the event of a cybersecurity incident, including incident reporting and business continuity. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We store our data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. Although we have experienced cybersecurity incidents in the past, cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: Our executive team, along with our Audit Committee, assess and manage cybersecurity risk as part of our overall business strategy, financial planning and capital allocation. Our Audit Committee and Board of Directors engage with members of the executive team and are briefed on cybersecurity risks at least once each calendar year and with respect to any potentially material cybersecurity incidents. Our Chief Information Officer reports regularly, and at least annually, to our Audit Committee and such report may address overall assessment of our compliance with our cybersecurity policies, and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our Chief Information Officer has served in various senior information technology roles, responsible for information security for over 20 years.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Silence Therapeutics plc

ticker: SLN


text: Our information security function, which is led by our Vice President and Head of Information Technology, known as our Head of IT, and supported by our security management, risk management, and legal teams, helps identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, coordinating with law enforcement concerning threats, internal and external audits, leveraging internal and third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management, disaster recovery and business continuity plans, risk assessments, achievement of certain security certifications, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, employee training, penetration testing, and asset management and disposal.


text: Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence providers, cybersecurity consultants and software providers, managed cybersecurity service providers, and penetration testing service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor, review the vendor's written security program and/or requested security assessment and security questionnaire responses, and impose contractual obligations on vendors regarding their cybersecurity practices.


text: For a description of the risks from cybersecurity threats that may materially affect us, please, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks and the failure to maintain the confidentiality, integrity, and availability of our computer hardware, software, data and internet applications and related tools and functions, or those of third parties with whom we work, could result in damage to our reputation and/or subject us to costs, fines or lawsuits."


text: Our board of directors addresses the review of our IT and cybersecurity risk management as part of its general oversight function. The board of directors' audit and risk committee is responsible for overseeing our cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Head of IT, who has achieved ACC Internetworking Engineer and Global Secure Systems Internetworking Engineer qualifications and has over 25 years of experience leading international IT departments and owning responsibility for organizations' cybersecurity efforts.


text: Our Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Head of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Leadership Team, or ELT. The ELT works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and risk committee of the board of directors, as appropriate.


text: The board of directors' audit and risk committee receives annual reports from our Head of IT, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and risk committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management, and governance.

companyName: PJT Partners Inc.

ticker: PJT


text: Our Cybersecurity and Technology Risk Program (the "Program") is designed to protect critical assets, scale with business growth and identify and mitigate threats, enabling us to securely conduct the Company's business. The Program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The Program and other cybersecurity processes have been integrated into our overall risk management framework.


text: Information Security Policies and Procedures As part of the Program, the Company has adopted Information Security Policies and Procedures ("ISP") that utilize concepts set forth in the NIST Special Publications and Internal/Interagency Reports and other industry-accepted guidance.


text: The ISP sets forth the controls and activities designed to protect our systems and data, such as establishing network perimeter security, managing system access, monitoring user activity and maintaining physical security. Other components of the Program related to assessing, identifying and managing risks from cybersecurity threats include annual cybersecurity training for all employees, regular review and update of our business critical and financial systems and the use of a variety of tools and methods to manage access to, and maintain the integrity of, our information systems. Our employees are critical in helping mitigate our cybersecurity risk and we continue to raise awareness and engagement through our formal training, frequent phishing campaigns and communication from our information security team with reinforcement from senior leaders across the Company. We also perform annual external penetration tests to identify certain potential vulnerabilities, and maintain a business continuity plan, which is tested annually.


text: The Company engages third parties to test and advise on the Program, including to conduct our annual external penetration test. At times, the Company may engage external experts to support the Program by, for example, facilitating an internal audit, advising on a cybersecurity incident or advising on legal and regulatory requirements.


text: The Company has processes to identify risks from cybersecurity threats associated with its use of third-party service providers. Each third-party service provider is evaluated at onboarding for compliance with our cybersecurity standards. Risks identified through this assessment are logged and remediation plans are discussed with appropriate stakeholders.


text: Cyber Incident Response Plan The Company has adopted a written Cyber Incident Response Plan (the "Plan") to guide our response to cybersecurity incidents. The Plan established the Cyber Incident Response Team ("CIRT"), which is responsible for leading the Company's response in the event of a cybersecurity incident and is comprised of the Company's Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO") and Chief Operating Officer as well as other senior management.


text: Cybersecurity Risks We do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully in "Part I. Item 1A. Risk Factors—Risks Relating to Our Business—Our business is subject to various cybersecurity and other operational risks" of this filing, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents may be insufficient. Accordingly, our controls and procedures may not be able to address or limit all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our Board retains responsibility for the oversight of management's role in assessing and managing cybersecurity risk. The Board is aware of the threats presented by cybersecurity incidents and is committed to taking measures to help prevent and mitigate the effects of any such incidents. The Company's management team, and either the CTO or the CISO or both, report at least twice annually to the Board on risks and issues including to evaluate the status of our cybersecurity efforts. The Board also discusses cybersecurity issues with external experts.


text: Management Oversight The CIRT also acts as a cybersecurity risk committee. The CIRT has responsibilities that include receiving and reviewing reports from the CTO and CISO on their management, monitoring and coordination of the Company's cybersecurity and technology risk management and any required remedial or corrective actions, reviewing reports from the CTO and CISO on the effectiveness of the ISP and serving as the primary response and escalation point for cybersecurity matters under the ISP.


text: CIRT members regularly report to the Operational Risk Committee, which is part of our overall risk management framework. The Operational Risk Committee is responsible for incorporating risk management considerations into our business activities. The Operational Risk Committee reports to the Executive Committee, our principal management-level policy-making committee that reports directly to the Board. Under the Plan, the Executive Committee is responsible for escalating and informing the Board about significant cybersecurity incidents and steps being taken by management to address them. In the event of an ongoing threat incident, the CIRT may engage directly with members of the Executive Committee in real-time.


text: Our CISO leads management's efforts to assess and manage cybersecurity risks through execution and enforcement of the Program, implementation of the ISP, reporting cybersecurity risks to senior managers of the Company, and meeting at least twice annually with the Board to discuss cybersecurity risks. The CISO works closely with the CTO, the Company's Executive Committee and other senior managers, including through his participation in the Operational Risk Committee and the CIRT. In addition to the processes described above, our CISO leads a team of information security specialists with which he holds dedicated cybersecurity meetings and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. Our CISO brings over 25 years of experience in the field of cybersecurity and technology infrastructure having held similar roles at leading global asset managers and investment banks. He has a broad technical background in information security strategy, risk management, and enterprise system design.


text: Information technology systems, including our mobile or online platforms, mobile payment and ordering systems, loyalty programs and various other online processes and functions, are critical to our business and operations. The Company faces risks associated with cybersecurity, including operational interruptions, financial losses, personal information leakage and non-compliance risks. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors — The occurrence of security breaches and cyber-attacks could negatively impact our business." and "—Unauthorized access to, or improper use, disclosure, theft or destruction of, our customer or employee personal, financial or other data or our proprietary or confidential information that is stored in our information technology systems or by third parties on our behalf could result in substantial costs, expose us to litigation and damage our reputation."

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Our information technology systems are protected through technological safeguards and management measures. We detect, identify, assess and mitigate cybersecurity risks by adopting standard risk management methodologies, which are developed based on the international cybersecurity management system standard ISO 27001 as well as the asset-oriented risk assessment framework. To minimize potential impact on business operations in the event of a cybersecurity incident, we have formulated, and regularly tested, our incident response plan. We also established a framework for data security and personal information protection, including measures to prevent data loss and detect and block abnormal accounts and activities, as well as systems and processes to prevent, detect and mitigate vulnerabilities. Our employees participate in regular cybersecurity training to enhance their awareness of cybersecurity risks. We engage in the periodic assessment of these processes and practices that are designed to address cybersecurity threats and incidents.


text: We regularly engage external consultants to assess and independently verify our cybersecurity risk management, striving for continuous optimization of our cybersecurity policies, cybersecurity risk management processes, and technical measures. These engagements assist us in ensuring our cybersecurity management practices and technical measures comply with applicable laws, regulations, industry standards and the Company's policies. The Company has maintained ISO/IEC 27001 certification since 2018 for certain online business.


text: We have established processes designed to manage cybersecurity threats associated with the use of third-party service providers. These processes include security evaluations before third-parties' admission, ongoing oversight and assessment of their security status, and adopting necessary security measures at termination of services.


text: Our Board of Directors maintains overall responsibility for overseeing the Company's risk management framework, and cybersecurity represents an important component of the Company's overall risk management framework. The Board regularly reviews risks that may be material to the Company. The Audit Committee assists the Board in the oversight of cybersecurity and other technology risks. Through receiving regular reports from the Chief Technology Officer ("CTO") and the Chief Legal Officer, the Audit Committee discusses with management cybersecurity risk mitigation and incident management, and reviews management reports regarding the Company's cybersecurity governance processes, incident response system and applicable cybersecurity laws, regulations and standards, status of projects to strengthen internal cybersecurity management, the evolving threat environment, vulnerability assessments, specific cybersecurity incidents and management's efforts to monitor, detect and prevent cybersecurity threats. On top of that, significant cybersecurity incidents will be immediately reported to the Board in accordance with the Company's incident response plan.


text: Yum China Compliance Oversight Committee (the "Compliance Committee"), primarily comprised of leaders and representatives from our information technology, supply chain, legal, finance, HR and public affairs functions, as well as internal audit group, is responsible for assisting the Board and Audit Committee in overseeing the Company's cybersecurity risks. The Compliance Committee meets regularly to discuss legal and regulatory developments on cybersecurity, assess the Company's emerging cybersecurity risks and mitigation plans, and determine strategy to promote cybersecurity compliance. Through ongoing communications, the Compliance Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our CTO, as a member of the Compliance Committee, served various positions in the Company's information technology department for more than 20 years and began leading the department in 2017.


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. The Company maintains cybersecurity insurance as part of its overall insurance programs.


text: We recognize the importance of developing, implementing, and maintaining measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and to address potential cybersecurity incidents that may materially affect our business.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the NIST Cybersecurity Framework, in assessing the threat landscape and continuously monitoring our environment.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to our data and systems, including malware and computer virus attacks. However, such risks and threats have not materially affected our business strategy, results of operations, or financial condition to date.


text: Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could potentially impact Organogenesis. We are developing and implementing processes for overseeing and managing these risks and are committed to maintaining robust governance and oversight of these risks. Those processes include assessing the third parties' cybersecurity practices and where applicable, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them including conducting ongoing monitoring of their compliance with those requirements.


text: We have also identified the potential for cybersecurity risks stemming from the use of artificial intelligence (AI) tools developed by third parties. We have implemented policies and training programs to govern the use of AI by our employees. Additionally, the Company's Audit Committee regularly reviews our uses of AI as part of its ongoing risk oversight responsibility.


text: Our cybersecurity organization, led by our Assistant Vice President of IT and our Director of Information Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Within our team, our current Director of Information Security has professional cybersecurity certifications. The Company's Board of Directors administers risk management oversight through the Audit Committee of the Board. Our Audit Committee receives quarterly updates about the effectiveness of the Company's cybersecurity and information security programs, vulnerability and threat detection, progress relative to the Company's cybersecurity roadmap, and the status of projects to strengthen our information security systems. The Audit Committee discusses with Company management and the Board the Company's processes with respect to risk assessment and risk management.


text: We maintain a cyber risk management program which includes processes for identifying, assessing, and managing risks for all of our information technology ("IT") systems, services and applications, including cybersecurity threats. Our program aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the IMO guidelines.

companyName: Excelerate Energy, Inc.

ticker: EE


text: These processes include analyzing potential risks from the use of IT components and our use of third-party service providers, engaging third-party service providers to identify potential cybersecurity threats, conducting penetration tests to detect vulnerabilities, conducting employee trainings, monitoring network activities, ensuring patches are applied timely, analyzing and reacting to threat intelligence, and layering controls to prevent unauthorized access to IT assets. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition.


text: Our IT risk management processes are integrated into our Enterprise Risk Management (ERM) program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. Our ERM program is overseen by our Enterprise Risk Committee ("ERC"). Our ERC is comprised of various members of senior management, including our Chief Information Officer ("CIO") and internal audit and compliance department leaders. The ERC is responsible for the governance of enterprise risks assessments, identification and management of internal risks, and development of related mitigation strategies. See "Risk Factors – Information system failures, cyber incidents or breaches in security could adversely affect us" for further information on how cybersecurity threats could harm our business, financial condition, and results of operations.


text: If a cybersecurity incident were to occur, we would utilize our incident response plan. This plan governs our process of assessing the incident and our internal and external communications strategy. Our response would be led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, we may escalate notification to our board of directors.


text: The cyber risk management program is overseen by our CIO who has over 20 years of experience in leading all aspects of IT. This is done in coordination with our Vice President, IT Audit and Security, who has over 25 years of experience in cybersecurity and other IT security roles, including the management of cybersecurity and compliance teams.


text: The Audit Committee of our board of directors ("Audit Committee") is responsible for the oversight of risks from cybersecurity threats and the process by which the board is informed about such risks. Our CIO reports to the Audit Committee on a periodic basis on data protection and cybersecurity matters. In addition, the Audit Committee receives regular updates on exposures, threats and mitigation plans directly from our IT department.


text: We rely on both internal information technology systems and networks, and those of third-party vendors and contractors, to acquire, transmit, store and otherwise process information in connection with our business activities. Our ability to effectively manage our business depends on the security, reliability and adequacy of our and our third-party contractors' and vendors' technology systems. As such, we have implemented an information security program designed to identify, assess, and manage risks from cybersecurity threats.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE