text: Our Board of Directors, with assistance from our Audit Committee, oversees our risk management program, which includes technology and cybersecurity risks. Our management team, including our Vice President - Information Technology ("VP - IT"), provides periodic updates on risk management to the Audit Committee and to the Board of Directors. Such periodic updates include presentations regarding cybersecurity matters, including any new cybersecurity threats, events, incidents, risks, risk management solutions, trainings or education, strategy pivots, or governance changes. The Audit Committee regularly reports its actions, findings and recommendations to the Board of Directors. The Audit Committee relies in large part on such periodic updates and presentations from our management team in developing its reports to the Board of Directors.

companyName: Coterra Energy Inc.

ticker: CTRA


text: We maintain a cybersecurity Incident Response Plan ("IRP") designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, threats and incidents. The IRP was developed in consultation with common cybersecurity frameworks, including NIST Cybersecurity Framework, to provide efficiency, familiarity and consistency in design. As part of our IRP, we have established a Cybersecurity Incident Management Team ("CIMT"), comprised of senior level executives and management, that defines overall policy and strategy when faced with a cybersecurity incident. The CIMT provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. Among our CIMT, our VP - IT holds the highest level of executive responsibility for assessing and managing cybersecurity threats, incidents, and risks, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations. Our VP - IT leads all components of our information technology functions and reports to our Executive Vice President and Chief Financial Officer.

secItem: Item 1C


text: The CIMT is supported by a dedicated Cybersecurity Incident Response Team ("CIRT"), comprised generally of security and networking team members with responsibilities to monitor and assess events, cybersecurity incidents, and technical activities throughout our organization. Our CIRT members possess critical skill sets, experience, and competencies related to the management of cybersecurity risks and matters. In particular, our VP - IT has over 28 years of experience in the field of information systems and cybersecurity and leads an experienced security and networking team with 67 years of additional combined experience in developing and executing cybersecurity strategies. Our CIRT members also hold over 29 certifications in risk and information security from organizations such as International Information System Security Certification Consortium (ISC2), The SANS Institute, Global Information Assurance Certification (GIAC), CompTIA and Cisco, including Certified Information Systems Security Professional (CISSP), GIAC, Certified Incident Handler Certification (GCIH), GIAC Critical Controls Certification (GCCC), GIAC Continuous Monitoring Certification (GMON), SANS Security Awareness Professional (SSAP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Auditor (CISA).


text: Our CIRT is supported by dedicated Information Technology ("IT") and Operational Technology ("OT") security resources, and further supported by various external parties, including but not limited to, cybersecurity service providers, assessors, consultants, auditors, and other third parties engaged on an as-needed basis.


text: The CIRT determines whether a cybersecurity incident warrants escalation to the CIMT. In the event of a cybersecurity incident, the IRP describes processes to detect, analyze, contain, eradicate and remediate such incident. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Conducting risk assessments to validate our cybersecurity policies, practices, and tools; • Employing appropriate next generation firewalls, endpoint detection and response (EDR) software, identity and access management (IAM), multifactor authentication (MFA), virtual private network (VPN), account change monitoring, encryption, patch management, web content filter, spam filter and reporting, and security information and event management (SIEM) software; • Conducting regular vulnerability scans of our IT and OT infrastructure; • Obtaining and applying vulnerability patches appropriately; • Conducting penetration tests and assessing recommended corrective actions; • Requiring employees to complete a security awareness training program; • Conducting regular phishing simulations and tabletop exercises to test familiarity with cybersecurity policies and procedures; and • Reviewing and evaluating developments in the cyber threat landscape.


text: Our IRP also describes processes to identify material risks from cybersecurity incidents associated with our use of third-party service providers.


text: Currently, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on our reputation, business strategy, results of operations or financial condition.


text: Our Board of Directors, with assistance from our Audit Committee and Cybersecurity Steering Committee, oversees our risk management program, which includes technology and cybersecurity risks. Our management team, including our Vice President - Information Technology ("VP - IT"), provides periodic updates on risk management to the Audit Committee and to the Board of Directors. Such periodic updates include presentations regarding cybersecurity matters, including any new cybersecurity threats, events, incidents, risks, risk management solutions, trainings or education, strategy pivots, or governance changes. The Audit Committee regularly reports its actions, findings and recommendations to the Board of Directors. The Audit Committee relies in large part on such periodic updates and presentations from our management team in developing its reports to the Board of Directors.


text: We maintain a cybersecurity Incident Response Plan ("IRP") designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, threats and incidents. The IRP was developed in consultation with common cybersecurity frameworks, including the Center for Internet Security (CIS) Critical Security Controls Framework, to provide efficiency, familiarity and consistency in design. As part of our IRP, we have established a Cybersecurity Incident Management Team ("CIMT"), comprised of senior level executives and management, that defines overall policy and strategy when faced with a cybersecurity incident. The CIMT provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. Among our CIMT, our VP - IT holds the highest level of executive responsibility for assessing and managing cybersecurity threats, incidents, and risks, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations. Our VP - IT leads all components of our information technology functions and reports to our Executive Vice President and Chief Financial Officer.


text: The CIMT is supported by a dedicated Cybersecurity Incident Response Team ("CIRT"), comprised generally of security and networking team members with responsibilities to monitor and assess events, cybersecurity incidents, and technical activities throughout our organization. Our CIRT members possess critical skill sets, experience, and competencies related to the management of cybersecurity risks and matters. In particular, our VP - IT has over 29 years of experience in the field of information systems and cybersecurity and leads an experienced security and networking team with 71 years of additional combined experience in developing and executing cybersecurity strategies. Our CIRT members also hold over 31 certifications in risk and information security from organizations such as International Information System Security Certification Consortium (ISC2), The SANS Institute, Global Information Assurance Certification (GIAC), CompTIA and Cisco, including Certified Information Systems Security Professional (CISSP), GIAC, Certified Incident Handler Certification (GCIH), GIAC Critical Controls Certification (GCCC), GIAC Continuous Monitoring Certification (GMON), SANS Security Awareness Professional (SSAP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Auditor (CISA).


text: We recognize the critical importance of maintaining the trust and confidence of our customers, employees, and other stakeholders. To help mitigate the cybersecurity risks that we face, we maintain processes for identifying, assessing, and managing such risks.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Our incident response functions, which include our Security and Trust Organization ("S&TO") under the leadership of our Chief Security and Trust Officer, have established internal policies, processes, and procedures to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. We maintain policies and procedures for the escalation of cybersecurity incidents, assessed as potentially being or becoming material, to designated members of our senior management for further assessment. We also, as necessary, inform our independent registered public accounting firm of significant cybersecurity matters and any relevant developments.


text: To help identify, assess, and mitigate cybersecurity threats that we face to our business, S&TO, in addition to its own capabilities, partners with Cisco's Talos Threat Intelligence Group and third parties, including governments and peer companies, to share and receive threat intelligence and other information. S&TO actively monitors for and evaluates cybersecurity vulnerabilities, threats, and incidents observable on the internet and the dark web. In addition to monitoring risks from threats to our own business, we operate third-party risk management programs to help identify and manage risks from cybersecurity threats arising from third-party suppliers and service providers on which we rely. These programs leverage on-going security-focused risk assessments based on industry practices, audits, and contractual requirements.


text: We strive to embed security into our products and services through the Cisco Secure Development Lifecycle (CSDL). The CSDL introduces security and privacy considerations throughout the lifecycle of our products and services. In addition, S&TO advises business units and functional areas on addressing cybersecurity risks and monitors initiatives to mitigate and manage such risks over time. Our business units or functional areas are responsible for managing risks and ensuring that security policies and standards are implemented within the respective business unit or function. S&TO also conducts mandatory cybersecurity training for our employees and provides employees with tools to report suspected incidents.


text: S&TO engages third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our IT security controls and provide certifications for industry-standard security frameworks. In addition, we maintain a global privacy program to assess and manage privacy risks related to how we are collecting, using, sharing, and storing personal data, which is subject to assessment by an independent, third-party privacy assessor.


text: Our Chief Security and Trust Officer, who reports to our Executive Vice President, Operations, works collaboratively across our business to implement policies and procedures designed to protect our IT environment and our products and services from cybersecurity threats, and to promptly respond to cybersecurity incidents in accordance with our incident response policies and procedures. Our Chief Security and Trust Officer has extensive cybersecurity experience and has served in various roles in information technology and information security for over 25 years.


text: The Chief Security and Trust Officer provides regular reports on the status of cybersecurity risks, priorities, and focus areas to our executive leadership team. In addition, information on cybersecurity risks is further integrated into our broader enterprise risk management program through our internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes.


text: Our Board of Directors oversees risks related to cybersecurity threats to our business directly and through its Audit Committee. The Audit Committee receives regular reports on cybersecurity risks, priorities, and focus areas from our Chief Security and Trust Officer at least four times a year and receives a live presentation at least twice a year. Our Board of Directors also regularly receives updates from the Audit Committee on its oversight activities and, on occasion, receives updates directly from our Chief Security and Trust Officer. Additionally, the Chief Security and Trust Officer provides more frequent updates to the Board of Directors and Audit Committee if necessary due to a cybersecurity threat, incident, or other development.


text: As of the date of this Annual Report on Form 10-K, we do not believe our business, operating results, or financial condition have been materially affected by cybersecurity risks, including as a result of previously identified cybersecurity incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: To help identify, assess, and mitigate cybersecurity threats that we face to our business, S&TO, in addition to its own capabilities, partners with Cisco's Talos Threat Intelligence Group and third parties, including governments and peer companies, to share and receive threat intelligence and other information. S&TO actively monitors for and evaluates cybersecurity vulnerabilities, threats, and incidents observable on the Internet and the dark web. In addition to monitoring risks from threats to our own business, we operate third-party risk management programs to help identify and manage risks from cybersecurity threats arising from third-party suppliers and service providers on which we rely. These programs leverage on-going security-focused risk assessments based on industry practices, audits, and contractual requirements.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures designed to protect the security, confidentiality, integrity, and availability of our business systems and information. We base our cybersecurity risk management program upon and measure it against the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0.

companyName: HOLOGIC INC

ticker: HOLX


text: Our cybersecurity risk management program includes the following: • A dedicated staff of cybersecurity and risk management professionals; • Defined security policies and standards; • Annual mandatory employee cybersecurity and privacy compliance awareness training; • Cybersecurity tooling for detecting and responding to cyber incidents; • Cybersecurity incident response and major crisis plans that govern activities such as detection, coordination, remediation, recovery, and escalation to senior management and, where appropriate, our Audit and Finance Committee and our Board; • Disaster recovery plans; • Periodic tabletop exercises to promote awareness and improve internal processes; • Periodic penetration testing and vulnerability management processes; and • Third-party risk assessments for suppliers and vendors, which may require such third parties to sign data processing agreements, comply with particular security controls, or complete an additional security and privacy assessment.


text: Our program also utilizes third-party security providers for specialized areas, including penetration testing, staff augmentation, consulting and other on-demand cybersecurity services. We also leverage a managed security service provider to augment our cybersecurity organization and to provide additional monitoring and response capabilities.


text: We have integrated cybersecurity related risks into our enterprise risk management program, which is designed to identify, prioritize, assess, monitor and mitigate the various risks confronting our Company, including both external and internal cybersecurity risks. When identified, risks are reported to relevant business and governance leaders within the Company for appropriate action. When potential improvements are identified, we weigh the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. Further, the scope and impact of any future incident cannot be predicted. However, as of the date of this Form 10-K, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we face, please refer to the "Risk Factors" in Part I, Item 1A. of this Form 10-K.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer (CISO), who oversees a dedicated cybersecurity and risk management team, which works in partnership across the Company, under the direction of our Chief Information Officer (CIO). Our CISO has over 20 years of experience working in defense and cybersecurity and has served in various cybersecurity leadership roles within Fortune 500 companies. He and our cybersecurity team have extensive experience in leading and addressing IT risk management, security architecture and engineering, security operations, data security, and identity and access management. Our CISO also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: As part of management's oversight of our cybersecurity program, we also maintain an executive-level cybersecurity steering committee, comprised of Hologic's Chief Financial Officer, General Counsel, Head of Internal Audit, Chief Information Officer, Head of Human Resources, Head of Global Supply Chain, and Division President of Breast and Skeletal Health, to help address cybersecurity risks at an enterprise level. The cybersecurity steering committee is a decision-making body that coordinates and communicates the direction, current state, and oversight of our cybersecurity and risk management programs.


text: While our Board oversees our overall risk management process, as part of its oversight, the Board has delegated primary responsibility for the oversight of cybersecurity risks, including management's steps to monitor and control such risks, to our Audit and Finance Committee. On a quarterly basis, our CIO and CISO provide updates to the Audit and Finance Committee on the cybersecurity and related risk management programs, including recent developments and current risk assessments. Our CIO and CISO typically also meet in person with the Audit and Finance Committee twice annually for a more detailed discussion of significant threats, risk mitigation strategies, any security program assessments and identified improvements. Additionally, our CIO and CISO meet at least annually with the full Board and report on the Company's Information Technology program and more specifically, cybersecurity matters.


text: Our cybersecurity risk management program includes the following: • A dedicated staff of cybersecurity and risk management professionals; • Defined security policies and standards; • Annual mandatory employee cybersecurity and privacy compliance awareness training; • Cybersecurity tooling for detecting and responding to cyber incidents; • Cybersecurity incident response and major crisis plans that govern activities such as detection, coordination, remediation, recovery, and escalation to senior management and, where appropriate, our Audit and Finance Committee and our Board; • Back-up & recovery plans; • Periodic tabletop exercises to promote awareness and improve internal processes; • Periodic penetration testing and vulnerability management processes; and • Third-party risk assessments for suppliers and vendors, which may require such third parties to sign data processing agreements, comply with particular security controls, or complete an additional security and privacy assessment.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ( CISO), who oversees a dedicated cybersecurity and risk management team, which works in partnership across the Company, under the direction of our Chief Information Officer (CIO). Our CISO has over 20 years of experience working in defense and cybersecurity and has served in various cybersecurity leadership roles within Fortune 500 companies. He and our cybersecurity team have extensive experience in leading and addressing IT risk management, security architecture and engineering, security operations, data security, and identity and access management. Our CISO also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: The Company provides cybersecurity services to the Bank. In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. As further described below, we have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We also offset cyber risk through internal training and testing of our employees, among other processes, in accordance with our policies and procedures.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: We have developed policies and procedures to provide processes and guidelines for managing cybersecurity incidents with the goal of minimizing disruption, damage, protecting data, and helping recover from a cybersecurity incident as quickly as possible.


text: In addition, in furtherance of our fiduciary responsibility to protect and account for information and information systems that are recognized as critical bank assets, we have established policies that require, among other things, that we perform an information security risk and vulnerability assessment at least annually, and implement corresponding risk management controls; implement a defense-in-depth security architecture, which may include firewalled network segmentation, malicious software protection, and data loss prevention; leverage data loss prevention technology to assist in preventing unauthorized disclosure of non-public information; and engage independent third parties to review, audit, and test the information security control structure and program to ensure processes and controls are functioning properly.


text: As part of our overall cybersecurity risk management process, employees receive annual training on incident preparedness, response, and recovery which we believe to be commensurate with their responsibilities. Employees are given directions on where to report actual or suspected incidents, both with respect to cybersecurity incidents as well as other risks, such as office closures, robbery, physical security, and employee or client injury. In addition to employees, individuals with a leadership role in the cybersecurity incident response processes are trained on their responsibilities annually, and the processes and those responsible for implementing them will be tested at least annually to assist in improving performance of the incident handlers and to identify issues with policies, procedures, and communication process.


text: To manage the information security processes related to relationships with third parties and contractors, we maintain a policy which requires all third parties and contractors to implement controls and abide by a non-disclosure agreement, and we regularly evaluate existing critical third-party service providers to ensure they continue to meet our minimum information security practices. Proposed relationships with new third-party service providers are evaluated to ensure the technology provided is in alignment with our standards and guidelines.


text: We have not experienced a significant compromise, significant data loss, or any material financial losses related to cybersecurity attacks, and no risks from cybersecurity threats that are known to us are believed to be reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Risks and exposures related to cybersecurity attacks, however, are expected to remain high for the foreseeable future, due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of third-party service providers, internet banking, mobile banking, and other technology-based products and services.


text: While all employees, including members of our information technology ("IT") team, are required to report any known or suspected security event, pursuant to our policies and procedures, the following members of Company management and the Board of Directors are tasked specifically with the responsibilities described below: • Cybersecurity Incident Response Team ("CIRT") – The CIRT was established to provide quick, effective, and orderly responses to serious successful cybersecurity related incidents such as system and application outages, virus infections, hacker attempts, system compromises, improper disclosure of confidential information, system service interruptions, breach of personal identifiable information, or other technology related events with serious security implications or business disruptions.


text: The CIRT consists of various IT groups with the knowledge and expertise needed to execute the technical aspect of the Company's cybersecurity policies and procedures, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). As further described below, these officers are responsible for facilitating communications with the Risk Committee.


text: When an incident is reported, the CIRT determines the scope, scale and severity of the event and determines if the event is an incident. When the CIRT has determined an incident has occurred, the team is responsible for responding to such incident in a timely, cost-effective manner and reporting findings as necessary and appropriate, including communicating to other key stakeholders for the duration of such incident. In general, the CIRT reports such findings to the CISO, the CISO reports the information to the Chief Risk Officer ("CRO"), and the CRO ultimately reports those findings to the Risk Committee.


text: • Risk Committee – The Risk Committee of our Board of Directors is responsible for overseeing our enterprise-wide risk management program and corporate risk function, including cyber risk. The Risk Committee assesses whether the risk-management programs are capable of managing our significant risks and monitors whether our most significant enterprise-wide risk exposures are in alignment with our appetite for risk. • Enterprise Risk Management Committee ("ERMC") – The ERMC is a management committee of the Bank. The Risk Committee delegates oversight responsibility of the Company's cybersecurity programs to the ERMC. The ERMC presents summary reporting to the Risk Committee pertaining to the status of such programs. • Chief Risk Officer ("CRO") – Karlyn M. Knieriem has served as our Executive Vice President and CRO since 2022. As CRO, Ms. Knieriem is responsible for reporting serious incidents to external authorities pursuant to advice from internal or external legal counsel, unless otherwise delegated. Ms. Knieriem has over 25 years of experience in financial services across a variety of roles including finance, treasury, retail, credit, and risk management. • Chief Information Officer ("CIO") – Lori Meyer has served as our CIO since June 30, 2023, after serving in several leadership roles in the Company, including Director of Enterprise Program Management, Director of IT Business Management, Director of IT Business Relations, and Business Process Improvement Lead. As CIO, Ms. Meyer is responsible for oversight of the Company's cybersecurity policies and informing the ERMC on current computer security readiness, information security standards, procedures, regulatory compliance, data security and privacy concerns, and the remediation plans annually, or as needed. • Chief Information Security Officer ("CISO") – Dale Daugherty has served as our CISO since 2021. As CISO, Mr. Daugherty is responsible for establishing and monitoring the effectiveness of the Company's cybersecurity policies and reporting the status and a summary of cybersecurity incidents to the CRO, CIO, ERMC, and Risk Committee. In this role, Mr. Daugherty serves as an intermediary between the CRO and the CIRT. Since 2002, Mr. Daugherty has served in the roles of Information Security Officer, AVP – IT Audit Manager, and Director of IT Compliance, Risk, and Security for the Bank and holds the CISSP, CISA, GCIH, GCIA, and GSEC certifications. • Chief Human Resources Officer ("CHRO") – Rachel B. Turitto has served as our CHRO since 2019. As CHRO, Ms. Turitto is responsible for appropriate administration of the Company's cybersecurity policies with respect to employee-related cybersecurity incidents. Ms. Turitto joined us with over 15 years of diverse experience across multiple human resource disciplines, including human resource information systems.


text: The Company believes its risk management strategy and governance programs related to cybersecurity matters are appropriate for a growing banking system of its size, but we continue to monitor them and improve upon them as warranted under our programs, policies, and procedures. Finally, we maintain customary cybersecurity insurance that we believe is appropriate for our industry and comparable to our peers.


text: The Board oversees the Company's risk associated with cybersecurity matters with the support of the Risk Committee of the Board (the "Risk Committee"). Management is responsible for identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. All employees, including members of our information technology ("IT") team, are also required to report any known or suspected security event, pursuant to our policies and procedures.


text: The following members of Company management are tasked specifically with the responsibilities described below: • Cybersecurity Incident Response Team ("CIRT") – The CIRT was established to provide quick, effective, and orderly responses to serious successful cybersecurity related incidents such as system and application outages, virus infections, hacker attempts, system compromises, improper disclosure of confidential information, system service interruptions, breach of personal identifiable information, or other technology related events with serious security implications or business disruptions.


text: • Enterprise Risk Management Committee ("ERMC") – The ERMC is a management committee of the Bank and has primary oversight responsibility of the Company's cybersecurity programs. • Chief Risk Officer ("CRO") – Tawnya Schoolitz is serving as our interim CRO, after serving in several leadership roles in the Company, including Chief Compliance Officer. In her current role, Ms. Schoolitz is responsible for reporting serious incidents to external authorities pursuant to advice from internal or external legal counsel, unless otherwise delegated. • Chief Information Officer ("CIO") – Lori Meyer has served as our CIO since June 30, 2023, after serving in several leadership roles in the Company, including Director of Enterprise Program Management, Director of IT Business Management, Director of IT Business Relations, and Business Process Improvement Lead. As CIO, Ms. Meyer is responsible for oversight of the Company's cybersecurity policies and informing the ERMC on current computer security readiness, information security standards, procedures, regulatory compliance, data security and privacy concerns, and the remediation plans annually, or as needed. • Chief Information Security Officer ("CISO") – Dale Daugherty has served as our CISO since 2021. As CISO, Mr. Daugherty is responsible for establishing and monitoring the effectiveness of the Company's cybersecurity policies and reporting the status and a summary of cybersecurity incidents to the CRO, CIO, ERMC, and Risk Committee. In this role, Mr. Daugherty serves as an intermediary between the CRO and the CIRT. Since 2002, Mr. Daugherty has served in the roles of Information Security Officer, AVP – IT Audit Manager, and Director of IT Compliance, Risk, and Security for the Bank and holds the CISSP, CISA, GCIH, GCIA, and GSEC certifications. • Chief Human Resources Officer ("CHRO") – Rachel B. Turitto has served as our CHRO since 2019. As CHRO, Ms. Turitto is responsible for appropriate administration of the Company's cybersecurity policies with respect to employee-related cybersecurity incidents. Ms. Turitto joined us with over 15 years of diverse experience across multiple human resource disciplines, including human resource information systems. • Risk Committee – The Risk Committee reviews periodic updates on cybersecurity matters from the CISO, CIO and the CRO. These updates include the information security risk and vulnerability assessment, the overall status of the information security program, and compliance with regulatory guidelines. In addition, reporting includes periodic assessments of business resiliency including oversight and management of incidents.


text: (a) As discussed in Item 1A, Risk Factors, we face risks associated with security breaches and other significant disruptions of our IT networks and related information systems, which are essential to our business operations. Due to our Defense/IT strategy and the nature of the customers and activities it serves, we may have a heightened likelihood of being targeted for cyber-attacks or -intrusions, including by governments, organizations or persons hostile to the USG.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our cybersecurity risk management efforts are informed by a cyber risk assessment, a continuous evaluation of our risks and vulnerabilities and risk tolerances. Our processes for assessing, identifying and managing cybersecurity risks are led by our Vice President – Information Technology and Chief Information Officer (our "CIO"), a management-level position reporting directly to our Executive Vice President and Chief Financial Officer (our "CFO"). Our CIO, a Certified Information Systems Security Professional ("CISSP") with over 20 years of information systems and information security leadership experience, leads our information technology team members, many of whom have USG security clearances and include one additional CISSP certified team member, in supporting our cybersecurity risk management efforts. This team's efforts are further informed through their participation in external cybersecurity-related panels, industry presentations and advisory boards, tabletop exercises and information-sharing collaborations and partnerships.


text: Our information technology team executes a series of preventive, detective and responsive measures aimed towards managing our cybersecurity risks, including the following:


text: >administering a series of processes and automated tools to monitor and alert for potentially malicious activities and vulnerabilities on our network, systems, applications and devices, with the ability to terminate processes and isolate potential vulnerabilities;


text: >employing tools and controls to support our efforts in identity and access management and device and user management and authentication;


text: >ongoing cybersecurity maintenance activities, including scheduled maintenance time windows for comprehensive system updates to occur, with additional ad hoc updates occurring as needed, monitoring of all Company devices for timeliness of security updates and pushing time-sensitive updates to our system infrastructure and devices, as appropriate; >recurring, redundant backups of our applications, servers and data, with replication to remote storage locations;


text: >assessing audit reports issued on controls of certain outsourced, or externally-hosted, systems or applications; and >periodically evaluating our readiness by performing testing of our process and system for responding to cyber events, including our ability to recover following such events.


text: >on an ongoing basis for certain aspects of our information technology team's recurring monitoring and alert processes and round-the-clock support, as needed; and >periodically to perform penetration testing and vulnerability scanning of our systems, websites and properties, run or support tabletop exercises and complete cyber risk-based assessments of us.


text: >purchase and contracting controls aimed at preventing our entry into purchases or service arrangements: with entities blocked or banned by OFAC or the Federal Trade Commission; or outside of manufacturer authorized distribution channels; and >education of our employees, including cybersecurity-related training and periodic reminders and promotions regarding potential risks.


text: Our CIO routinely apprises our CFO regarding cyber risk management activities and provides updates and data, as needed, to our executive team to facilitate decisions regarding our cyber risk posture and related considerations regarding our enterprise risk management assessment. Our CIO and CFO provide to the Audit Committee of our Board of Trustees: quarterly updates on our cybersecurity risk management strategy and related activities; annual reviews of our cyber risk assessment; and other information as needed to facilitate the committee's oversight of our cybersecurity risk. Two members of this committee possess cybersecurity and information systems experience, which we believe brings valuable insight and perspective to our risk management strategy. Our CIO and CFO also provide an annual review of our cyber risk assessment to our full Board of Trustees.


text: While to date, we have not experienced cybersecurity events that were individually, or in the aggregate, material, we have developed a cyber-incident response playbook that sets forth our process for responding in the event of certain defined cyber incidents. Under our response protocols, following identification of such an incident, our CIO or other members of the information technology team would notify our executive team, which then would notify the Chairman of our Board of Trustees and assemble an Incident Management Team, comprised of certain defined management team members and external consultants, who collectively would assess and monitor the situation and manage internal and external communications.


text: We also are subject to legal and regulatory requirements that affect our response to cybersecurity-risk management, including the Sarbanes-Oxley Act, state data breach notification requirements and certain requirements under our leases with tenants.


text: (a) As discussed in Item 1A, Risk Factors, we face risks associated with security breaches and other significant disruptions of our IT networks and related systems that are essential to our business operations. Due to our Defense/IT strategy and the nature of the customers and activities it serves, we may have a heightened likelihood of being targeted for cyber-attacks or -intrusions, including by governments, organizations or persons hostile to the USG.


text: Our cybersecurity risk management efforts are informed by a cyber risk assessment, a continuous evaluation of our risks and vulnerabilities and risk tolerances. Our processes for assessing, identifying and managing cybersecurity risks are led by our Vice President – Information Technology and Chief Information Officer (our "CIO"), a management-level position reporting directly to our Executive Vice President and Chief Financial Officer (our "CFO"). Our CIO, a Certified Information Systems Security Professional ("CISSP") with over 20 years of information systems and information security leadership experience, leads our information technology team ("IT team") members, many of whom have USG security clearances (including our CIO) and include one additional CISSP team member, in supporting our cybersecurity risk management efforts. This team's efforts are further informed through their participation in external cybersecurity-related panels, industry presentations and advisory boards, tabletop exercises and information-sharing collaborations and partnerships.


text: Our IT team executes a series of preventive, detective and responsive measures aimed towards managing our cybersecurity risks, including the following:


text: >administering a series of processes and automated tools to monitor and alert for potentially malicious activities and vulnerabilities on our network, systems, applications and devices, with the ability to terminate processes and isolate potential vulnerabilities; >employing tools and controls to support our efforts in identity and access management, device and user management, and authentication;


text: >ongoing cybersecurity maintenance activities, including scheduled maintenance time windows for comprehensive system updates to occur, with additional ad hoc updates, monitoring of all Company devices for timeliness of security updates and pushing time-sensitive updates to our system infrastructure and devices, as appropriate; >recurring, redundant backups of our applications, servers and data, with replication to remote storage locations;


text: >on an ongoing basis for certain aspects of our IT team's recurring monitoring and alert processes and round-the-clock support, as needed; and >periodically to perform penetration testing and vulnerability scanning of our systems, websites and properties, run or support tabletop exercises and complete cyber risk-based assessments of us.


text: >purchase and contracting controls aimed at preventing our entry into purchases or service arrangements: with entities blocked or banned by OFAC or the Federal Trade Commission; or outside of manufacturer authorized distribution channels; and >education of our employees, including cybersecurity-related training and periodic reminders regarding potential risks.


text: Our CIO routinely apprises our CFO regarding cyber risk management activities and provides updates and data, as needed, to our executive team to facilitate decisions regarding our cyber risk posture and related considerations regarding our enterprise risk management assessment. Our CIO and CFO provide to the Audit Committee of our Board of Trustees: quarterly updates on our cybersecurity risk management strategy and related activities; annual reviews of our cyber risk assessment; and other information as needed to facilitate the committee's oversight of our cybersecurity risk. Two members of this committee possess technology and cybersecurity experience, which we believe brings valuable insight and perspective to our risk management strategy. Our CIO and CFO also provide an annual review of our cyber risk assessment to our full Board of Trustees.


text: While to date, we have not experienced cybersecurity events that were individually, or in the aggregate, material, we have developed a cyber-incident response playbook that sets forth our process for responding in the event of certain defined cyber incidents. Under our response protocols, following identification of such an incident, our CIO or other members of the IT team would notify our executive team, which then would notify the Chairman of our Board of Trustees and assemble an Incident Management Team, comprised of certain defined management team members and external consultants, who collectively would assess and monitor the situation and manage internal and external communications.


text: Tyler is committed to remaining vigilant in an ever-changing security environment. Our public sector clients are attractive, data-rich targets for threat actors. We partner closely with our clients to assist them in following evolving best practices, and constantly evaluate our own policies and procedures to help ensure that we are implementing safeguards that protect their data and ours.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: The same cybersecurity threats that predominate across most industries challenge Tyler and our clients as well. These threats range from crude phishing attempts to distributed denial-of-service disruptions to sophisticated malware and ransomware, among others. We are acutely aware that these same threats exist for our acquisition targets, our suppliers, and our third-party business partners, and a cybersecurity incident or vulnerability experienced by any of these entities could also materially and/or adversely impact our business operations and/or performance, both operational and financial, and could harm our reputation and/or competitive position. Given the criticality of a strong cybersecurity posture, we continuously and conscientiously invest in our security infrastructure, tooling, and related resources.


text: Cyber Risk Management Strategy The Board of Directors is responsible for overseeing Tyler's senior management in the execution of its risk-management responsibilities and for assessing Tyler's overall approach to risk management. The Board exercises these responsibilities periodically as part of its meetings and through its committees, each of which examines various components of enterprise risk. The Audit Committee oversees management of financial risks, as well as Tyler's policies with respect to risk assessment and risk management, including but not limited to information security risk.


text: Tyler's Chief Information Security Office ("CISO") leads the information security responsibility at Tyler. He has spent his career in information security, joining Tyler in 2018 and previously working in the payments and semiconductor manufacturing industries. He is a Certified Information Systems Security Professional ("CISSP") and a Certified Data Privacy Solutions Engineer ("CDPSE").


text: The CISO reports directly to Tyler's Chief Operations Officer ("COO"), who in turn reports to the President & Chief Executive Officer. Tyler believes this organizational structure provides a holistic and collaborative approach to cybersecurity risk management, as the COO also oversees Tyler's information technology, technology, and cloud operations teams, with whom the CISO works regularly and closely. The CISO also has a dotted line to the Chair of the Audit Committee.


text: The CISO leads a full-time Security Risk & Compliance team that assesses, identifies and manages material risks from cybersecurity threats and oversees our Information Security Risk Management Program. These efforts include the identification, assessment, and treatment of potential harms to Tyler's technology, data, and intellectual property. The team continually monitors the potential for harm to help manage the level of risk.


text: To help protect client information and Tyler data, Tyler leverages both internal and external resources, including third-party assessments, to work to identify and respond to information security risks. For example:


text: Internal Resources: Our full-time information security team focuses on managing incoming security risks and developing preventative responses to potential future risks, using tools targeted at people, processes, and technology. These efforts include security training for all employees at hire and on an annual basis thereafter, unannounced security testing (particularly on topics such as phishing), and periodic security alert messages for education or urgent security communications.


text: We repeatedly test our software, during the development cycle and once out in the field, including internal assessments of our flagship solutions. We work closely with Tyler's Data Privacy Officer and her team to educate Tyler team members on complementary privacy-by-design principles. We continuously iterate on access management policies for both technological and physical resources.


text: Tyler staffs an internal incident response team designed to launch when a potential or suspected security incident is reported to or identified by Tyler. That team is composed of a multi-disciplinary group of Tyler team members, including representatives from the security, privacy, communications, and relevant business unit teams, as well as outside forensic and legal advisors that are called on as needed. The incident response team's goal is to confirm, contain, mitigate, and remediate the incident, as applicable, and conducts a "lessons learned" process when the incident response is completed.


text: To help ensure disaster recovery and business continuity, Tyler maintains a business continuity plan with comprehensive procedures designed to recover Tyler and client assets quickly and effectively following a service disruption. Tyler's policies and procedures with respect to disaster recovery, as well as its process to help recover critical technology platforms, data center infrastructure, and operations, are updated regularly, tested annually, and reviewed by third-party auditors. We also partner with our Internal Audit team to regularly assess and respond to evolving risk management findings.


text: External resources: Tyler leverages third-party assessments, audits, and reporting obligations to provide additional layers of accountability, monitoring and testing. This includes a bug reporting program that we publish that invites any third party to report a security vulnerability they have identified. We also use a Qualified Security Assessor to perform an annual Payment Card Industry Data Security Standards assessment that tests our credit card data controls, and we undergo an annual System & Organizational Control audit to generate a report of our key compliance controls and objectives, among other things. Given our technology in the courts and public safety markets, we also manage compliance with Criminal Justice Information Systems security standards that are established by the Federal Bureau of Investigation ("FBI"), and we partner with our clients and third-party Criminal Justice Information Services ("CJIS") compliance consultants to ensure that we adhere to the requirements applicable to us.


text: Tyler also utilizes technology to help harden our environment from internal and external threats. We leverage a third-party endpoint detection management solution and threat intelligence software, as well as web-filtering tools, a multi-factor authentication tool, and related tools that support our "defense-in-depth" strategy. These tools are operated by subject-matter experts that report to the CISO, and Tyler employees are educated on the tooling to the extent applicable.


text: Third Parties: Our management of third-party security risks is an area of heightened focus for us. Over the past several years, we have worked to formalize our security due diligence process for each acquisition target, such that security is a formally embedded component of our due diligence and typically involves our independent testing of the target technology prior to closing the acquisition. Where a vulnerability or risk is identified, we generally require remediation by the target or attempt to ensure a remediation path post-closing, with contractual protections and liability parameters set forth in the purchase agreement.


text: We strive to enhance our vendor risk analysis, with a goal of universalizing the use of form cybersecurity questionnaires and/or security addenda where applicable. We consider the results of a security and privacy review of material vendor contracts, as well as our material contracts with business partners. Our goal is to proactively identify and manage potential security risks and vulnerabilities, and to clearly articulate the responsibility – whether shared, divided, flow-down, or otherwise – of Tyler, our acquisition targets, our vendors, and/or our business partners. We expect third parties – including our clients – to report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: In 2022, we formalized a multi-layered security governance structure, with the goal of ensuring that responsibilities are clear, information is effectively communicated, priorities are coordinated, and proper oversight is provided. Each "layer" of the governance structure has unique meeting, reporting, and action cadences to help ensure consistent communication between our security working groups, our leadership team, and our Board of Directors.


text: On at least a quarterly basis, Tyler's CISO provides a formal report to the Audit Committee and to the Board of Directors. Our Audit Committee Chair and CISO also communicate on an as-needed basis between those quarterly reports. In 2022, Tyler's Lead Independent Director completed the requirements to receive the CERT Certificate in Cybersecurity Oversight from the Software Engineering Institute at Carnegie Mellon University. Another Tyler director possesses more than 37 years of Department of Defense experience in cyberspace operations and major computer network architectures.


text: Tyler's governance practices are supported by several segments of Tyler's senior leadership, management, and teams. This includes security working groups and a security governance committee. The security governance committee, which meets on a quarterly basis to review the threat landscape and security initiatives at Tyler, is led by the CISO and includes senior leadership from Tyler's legal and operational teams, as well as the president of each of Tyler's three operating groups and Tyler's President & CEO.


text: Operationalizing Cybersecurity Risk Management We firmly believe – and communicate regularly – that all Tyler team members have a vital role to play in cybersecurity risk management. We identify their responsibilities as falling into three key areas: • Participating in training to identify and promptly report risks; • Staying informed by reading all pertinent information and security communications; and • Actively engaging in ongoing training initiatives.


text: We observe Cybersecurity Awareness month with interactive weekly training, workshops, and additional resources on strong cybersecurity practices. In addition to Cybersecurity Awareness month, additional cybersecurity training and awareness initiatives occur throughout the calendar year, including annual security compliance training; a monthly Cybersecurity Awareness Series composed of articles and training highlighting current cybersecurity concerns; company-wide communication as necessary to alert team members of potential threats; and weekly security-related videos with opportunities to win prizes through participation. We track participation in training events and boast high participation rates, with continuous reflection on strategies for driving participation yet higher.


text: In 2022, we expanded our Security Champions Program to identify a resource on our various application teams who proactively operationalizes security best practices on their team. This program helps to ensure that security measures are built into our programs from development to deployment. We have over 100 security champions who can collaboratively advocate security tools throughout the lifecycle of our applications.


text: Measuring Cybersecurity Risks In order to evaluate whether a cybersecurity risk is material to Tyler, we take a multi-disciplinary approach to assessing qualitative and quantitative factors. The cross-functional team includes senior leadership from Tyler's information security, legal, finance, and accounting teams, as well as senior leadership from the impacted business unit(s).


text: When an incident is reported, Tyler assembles its incident response team and initiates its incident response process as soon as possible. Working with the incident response team, the CISO aims to take an initial measurement of qualitative and quantitative metrics, typically within 24 hours of the incident report, to help determine whether Tyler's Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO") should be engaged to do a deeper analysis of quantitative factors. The CFO and CAO are expected to engage with the Company's Chief Legal Officer ("CLO") and Audit Chair to evaluate, holistically, not just the quantitative factors but the qualitative factors as well. If that team determines that the incident may represent a risk of national security, the CLO may contact the US attorney general for a disclosure delay of up to 30 days, or if applicable the team may coordinate to prepare and publish an 8-K, if management believes the materiality threshold has been reached. Whether or not the incident is deemed material, the incident response team will monitor the incident on an ongoing basis to attempt to ensure containment, mitigation, and remediation, as well as to monitor for evolving factors that subsequently push the incident to a materiality threshold that requires disclosure and reporting.


text: Quantitative metrics for evaluating a security incident include the potential or actual financial loss, the costs of impacted data records, remediation costs, and/or third-party expenses. Qualitative factors include potential or actual impacts to Tyler's reputation and/or competitiveness, disruptions to Tyler's business, and/or risk of litigation or regulatory action. In evaluating an incident, Tyler also works to assess whether the incident is related to another recent incident and whether the incident may represent a threat to national security. Tyler does not expect an incident to rise to that level unless Tyler infrastructure is deemed "critical infrastructure" by the Cybersecurity and Infrastructure Security Agency ("CISA").


text: Notwithstanding these ongoing efforts and our multi-layered approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Tyler maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Please see Item 1A, "Risk Factors," for a discussion of cybersecurity risks.


text: Tyler is committed to remaining vigilant in an ever-changing security environment. Our public sector clients are attractive, data-rich targets for threat actors. We partner closely with our clients to assist them in following evolving best practices, and constantly evaluate our own policies and procedures to help ensure that we are implementing safeguards that protect their data and ours.


text: The same cybersecurity threats that predominate across most industries challenge Tyler and our clients as well. These threats range from crude phishing attempts to distributed denial-of-service disruptions to sophisticated malware and ransomware, among others. The evolving use of artificial intelligence increases the risk of cyberattacks and data breaches, which themselves can evolve more rapidly when artificial intelligence is used to facilitate the attack. We are acutely aware that these same threats exist for our acquisition targets, our suppliers, and our third-party business partners, and a cybersecurity incident or vulnerability experienced by any of these entities could also materially and/or adversely impact our business operations and/or performance, both operational and financial, and could harm our reputation and/or competitive position. In addition, vulnerabilities in our clients' on-premises infrastructure have in the past and may in the future be exploited by bad actors, with the resulting impacts being linked to or attributed to, correctly or incorrectly, our software or services, which could also harm our business, reputation, and future financial results, even if our software or services were not the cause of the exploitation. Given the criticality of a strong cybersecurity posture, we continuously and conscientiously invest in our security infrastructure, tooling, and related resources.


text: Cyber Risk Management Strategy The Board of Directors is responsible for overseeing Tyler's senior management in the execution of its risk-management responsibilities and for assessing Tyler's overall approach to risk management. The Board exercises these responsibilities periodically as part of its meetings and through its committees, each of which examines various components of enterprise risk. The Audit Committee oversees management of financial risks, as well as Tyler's policies with respect to risk assessment and risk management, including but not limited to information security risk.


text: Tyler's Chief Information Security Office ("CISO") leads the information security responsibility at Tyler. He has spent his career in information security, joining Tyler in 2018 and previously working in the payments and semiconductor manufacturing industries. He is a Certified Information Systems Security Professional ("CISSP") and a Certified Data Privacy Solutions Engineer ("CDPSE").


text: The CISO reports directly to Tyler's Chief Operations Officer ("COO"), who in turn reports to the President & Chief Executive Officer. Tyler believes this organizational structure provides a holistic and collaborative approach to cybersecurity risk management, as the COO also oversees Tyler's information technology, technology, and cloud operations teams, with whom the CISO works regularly and closely. The CISO also has a dotted line to the Chair of the Audit Committee.


text: The CISO leads a full-time Security Risk & Compliance team that assesses, identifies and manages material risks from cybersecurity threats and oversees our Information Security Risk Management Program. These efforts include the identification, assessment, and treatment of potential harms to Tyler's technology, data, and intellectual property. The team continually monitors the potential for harm to help manage the level of risk.


text: To help protect client information and Tyler data, Tyler leverages both internal and external resources, including third-party assessments and threat intelligence services, to work to identify and respond to information security risks. For example:


text: Internal Resources: Our full-time information security team focuses on managing incoming security risks and developing preventative responses to potential future risks, using tools targeted at people, processes, and technology. These efforts include security training for all employees at hire and on an annual basis thereafter, unannounced security testing (particularly on topics such as phishing), and periodic security alert messages for education or urgent security communications.


text: We repeatedly test our software during the development cycle, including internal assessments of our flagship solutions. We work closely with Tyler's Data Privacy Officer and her team to educate Tyler team members on complementary privacy-by-design principles. We continuously iterate on access management policies for both technological and physical resources.


text: Tyler staffs an internal incident response team designed to launch when a potential or suspected security incident is reported to or identified by Tyler. That team is composed of a multi-disciplinary group of Tyler team members, including representatives from the security, privacy, communications, and relevant business unit teams, as well as outside threat intelligence, forensic and legal advisors that are called on as needed. The incident response team's goal is to confirm, contain, mitigate, and remediate the incident, as applicable, and to conduct a "lessons learned" process when the incident response is completed.


text: To help ensure disaster recovery and business continuity, Tyler maintains a business continuity plan with comprehensive procedures designed to recover Tyler and client assets quickly and effectively following a service disruption. Tyler's policies and procedures with respect to disaster recovery, as well as its process to help recover critical technology platforms, data center infrastructure, and operations, are updated regularly, tested annually, and reviewed by third-party auditors. We also partner with our Internal Audit team to regularly assess and respond to evolving risk management findings.


text: External resources: Tyler leverages third-party assessments, intelligence services, audits, and reporting obligations to provide additional layers of accountability, monitoring and testing. This includes a bug reporting program that we publish that invites any third party to report a security vulnerability they have identified. We also use a Qualified Security Assessor to perform an annual Payment Card Industry Data Security Standards assessment that tests our credit card data controls, and we undergo an annual System & Organizational Control audit to generate a report of our key compliance controls and objectives, among other things. Given our technology in the courts and public safety markets, we also manage compliance with Criminal Justice Information Systems security standards that are established by the Federal Bureau of Investigation ("FBI"), and we partner with our clients and third-party Criminal Justice Information Services ("CJIS") compliance consultants to ensure that we adhere to the requirements applicable to us.


text: Tyler also utilizes technology to help harden our environment from internal and external threats. We leverage a third-party endpoint detection management solution and threat intelligence software, as well as web-filtering tools, a multi-factor authentication tool, and related tools that support our "defense-in-depth" strategy. These tools are operated by subject-matter experts that report to the CISO, and Tyler employees are educated on the tooling to the extent applicable.


text: Third Parties: Our management of third-party security risks is an area of heightened focus for us. Over the past several years, we have worked to formalize our security due diligence process for each acquisition target, such that security is a formally embedded component of our due diligence and typically involves our independent testing of the target technology prior to closing the acquisition. Where a vulnerability or risk is identified, we generally require remediation by the target or attempt to ensure a remediation path post-closing, with contractual protections and liability parameters set forth in the purchase agreement.


text: We strive to enhance our vendor risk analysis, with a goal of universalizing the use of form cybersecurity questionnaires and/or security addenda where applicable. We consider the results of a security and privacy review of material vendor contracts, as well as our material contracts with business partners. Our goal is to proactively identify and manage potential security risks and vulnerabilities, and to clearly articulate the responsibility – whether shared, divided, flow-down, or otherwise – of Tyler, our acquisition targets, our vendors, and/or our business partners. We expect third parties – including our clients – to report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: In 2022, we formalized a multi-layered security governance structure, with the goal of ensuring that responsibilities are clear, information is effectively communicated, priorities are coordinated, and proper oversight is provided. Each "layer" of the governance structure has unique meeting, reporting, and action cadences to help ensure consistent communication between our security working groups, our leadership team, and our Board of Directors.


text: On at least a quarterly basis, Tyler's CISO provides a formal report to the Audit Committee and to the Board of Directors. Our Audit Committee Chair and CISO also communicate on an as-needed basis between those quarterly reports. In 2022, Tyler's Lead Independent Director completed the requirements to receive the CERT Certificate in Cybersecurity Oversight from the Software Engineering Institute at Carnegie Mellon University. Another Tyler director possesses more than 38 years of Department of Defense experience in cyberspace operations and major computer network architectures.


text: Tyler's governance practices are supported by several segments of Tyler's senior leadership, management, and teams. This includes security working groups and a security governance committee. The security governance committee, which meets on a quarterly basis to review the threat landscape and security initiatives at Tyler, is led by the CISO and includes senior leadership from Tyler's legal and operational teams, as well as the president of each of Tyler's three operating groups and Tyler's President & CEO.


text: Operationalizing Cybersecurity Risk Management We firmly believe – and communicate regularly – that all Tyler team members have a vital role to play in cybersecurity risk management. We identify their responsibilities as falling into three key areas: • Participating in training to identify and promptly report risks; • Staying informed by reading all pertinent information and security communications; and • Actively engaging in ongoing training initiatives.


text: We observe Cybersecurity Awareness month with interactive weekly training, workshops, and additional resources on strong cybersecurity practices. In addition to Cybersecurity Awareness month, additional cybersecurity training and awareness initiatives occur throughout the calendar year, including annual security compliance training; a monthly Cybersecurity Awareness Series composed of articles and training highlighting current cybersecurity concerns; company-wide communication as necessary to alert team members of potential threats; and weekly security-related videos with opportunities to win prizes through participation. We track participation in training events and boast high participation rates, with continuous reflection on strategies for driving participation yet higher.


text: In 2022, we expanded our Security Champions Program to identify a resource on our various application teams who proactively operationalizes security best practices on their team. This program helps to ensure that security measures are built into our programs from development to deployment. We have over 100 security champions who can collaboratively advocate security tools throughout the lifecycle of our applications.


text: Measuring Cybersecurity Risks In order to evaluate whether a cybersecurity risk is material to Tyler, we take a multi-disciplinary approach to assessing qualitative and quantitative factors. The cross-functional team includes senior leadership from Tyler's information security, legal, finance, and accounting teams, as well as senior leadership from the impacted business unit(s).


text: When an incident is reported, Tyler assembles its incident response team and initiates its incident response process as soon as possible. Working with the incident response team, the CISO aims to take an initial measurement of qualitative and quantitative metrics, typically within 24 hours of the incident report, to help determine whether Tyler's Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO") should be engaged to do a deeper analysis of quantitative factors. The CFO and CAO are expected to engage with the Company's Chief Legal Officer ("CLO"), Chief Administrative Officer ("CAdO"), and Audit Committee Chair to evaluate, holistically, not just the quantitative factors but the qualitative factors as well. If that team determines that the incident may represent a risk of national security, the CLO may contact the US attorney general for a disclosure delay of up to 30 days, or if applicable the team may coordinate to prepare and publish a Form 8-K, if management believes the materiality threshold has been reached. Whether or not the incident is deemed material, the incident response team will monitor the incident on an ongoing basis to attempt to ensure containment, mitigation, and remediation, as well as to monitor for evolving factors that subsequently push the incident to a materiality threshold that requires disclosure and reporting.


text: Quantitative metrics for evaluating a security incident include the potential or actual financial loss, the costs of impacted data records, remediation costs, and/or third-party expenses. Qualitative factors include potential or actual impacts to Tyler's reputation and/or competitiveness, disruptions to Tyler's business, and/or risk of litigation or regulatory action. In evaluating an incident, Tyler also works to assess whether the incident is related to another recent incident and whether the incident may represent a threat to national security. Tyler does not expect an incident to rise to that level unless Tyler infrastructure is deemed "critical infrastructure" by the Cybersecurity and Infrastructure Security Agency ("CISA").


text: Notwithstanding these ongoing efforts and our multi-layered approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Tyler maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Please see Item 1A, "Risk Factors," for a discussion of cybersecurity risks.


text: The Company has developed an information security program to assess, identify, and monitor cybersecurity risks. Each year, the Company assesses cybersecurity risks arising from the operating environment. In developing the assessment process, the Company reviews guidance from national standards organizations such as the NIST and the Center for Internet Security. In evaluating the risks identified as a part of this assessment, the Company's information security team considers the likelihood and severity of the risk and the possible impact of the risk on the Company, its customers, and its employees. These risks are then monitored by the Company's information security team.

companyName: KEMPER Corp

ticker: KMPR


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems. Tests are conducted by both internal security teams and third-party consultants. In developing the testing procedures, the Company considers its individual risks and industry standards. Testing procedures are supplemented by executive cyber threat exercises and employee training. Executive exercises such as "tabletops" are used to develop and refine the Company's incident response plans. Employees undergo security awareness training annually and upon hire.


text: As a part of its information security program, the Company addresses cyber risks posed by its relationships with third-party service and application providers. The Company assesses third parties as a part of the procurement process, including through pre-acquisition diligence. Contractual provisions based on regulatory requirements and industry standards are used in the contracting process, and the Company conducts on-going performance monitoring of key vendors. Security audits are also performed on certain vendors to review compliance with contractual requirements and industry standards.


text: The Company maintains an incident response plan that includes procedures for evaluating and addressing a cybersecurity event. The initial impact of each cybersecurity event is evaluated by a designated team using pre-established risk criteria. If an event meets certain parameters, it is escalated to a cross-functional core team of executives, including the Company's Chief Information Security Officer ("CISO") and designated internal legal counsel. The Company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The incident response plan identifies certain third-party advisors, consultants and legal counsel who have been designated to assist if necessary. The plan contains procedures for escalating cybersecurity incidents to the Board of Directors.


text: The Company's CISO is primarily responsible for management of the Company's information security program. The Company's current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence and risk sharing organizations, such as FS-ISAC and the Domestic Security Alliance Council.


text: Kemper's information security program is an element of the Company's broader Enterprise Risk Management (ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company's Enterprise Risk Committee ("ERC"), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company's ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.


text: Through its role in providing oversight for the Company's ERM framework, the Risk Committee of the Kemper Board of Directors (the "Risk Committee") provides oversight of the Company's information security program. On a quarterly basis, management discusses Kemper's information security program, cybersecurity risks, and related developments with the Risk Committee. The Risk Committee periodically reviews and evaluates information security and cybersecurity risks and provides oversight of events that have been escalated as a part of the incident response plan.


text: The Company's CISO is primarily responsible for management of the Company's information security program. The Company's current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence, risk sharing organizations and law enforcement organizations.


text: Kemper's information security program is an element of the Company's broader Enterprise Risk Management ( ERM) framework. This framework employs a management committee structure to review technology, compliance, and operational risks. The Company's Enterprise Risk Committee ("ERC"), composed of the Chief Executive Officer, the Chief Risk Officer, all executive vice presidents and the head of internal audit, meets at least quarterly to oversee the Company's ERM framework. This committee monitors the implementation of the ERM framework and makes modifications to the program from time to time as it believes appropriate. The ERC has several subcommittees that oversee particular risks, including cyber and information security.


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities and has delegated responsibility for oversight of this risk to the Audit/Compliance Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our Risk Committee of the Board of Directors oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, the Risk Committee, our Chief Information Officer ("CIO"), other members of management and management's Cybersecurity Committee.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.


text: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Audit Committee receives regular presentations and reports from management on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Risk Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the ERM process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: The CIO, who acts as our chief information security officer, leads our Cybersecurity Committee. The Cybersecurity Committee is a multidisciplinary team of corporate and operational leaders who work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. The Cybersecurity Committee reports to our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Operating Officer ("COO"), Senior Vice President, Human Resources ("SVP HR") and Senior Vice President and General Counsel. The CIO, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Our CIO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Cybersecurity for public and private companies. Our CIO holds an undergraduate degree in computer science and has attained a professional certification in Cybersecurity Governance. The Cybersecurity team (including the CIO) have a combined 80+ years of cybersecurity experience and hold multiple certifications across the cybersecurity landscape. Our CEO, CFO, COO, SVP HR and Senior Vice President and General Counsel each hold undergraduate degrees, graduate degrees or professional certifications in their respective fields, and each have significant experience managing risk.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: Our CIO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Cybersecurity for public and private companies. Our CIO holds an undergraduate degree in computer science and has attained a professional certification in Cybersecurity Governance. The Cybersecurity team (including the CIO) has extensive cybersecurity experience and hold multiple certifications across the cybersecurity landscape. Our CEO, CFO, COO, SVP HR and Senior Vice President and General Counsel each hold undergraduate degrees, graduate degrees or professional certifications in their respective fields, and each have significant experience managing risk.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, due to evolving cybersecurity threats, it may not be possible to anticipate, prevent or stop future cybersecurity incidents, including attacks on our information systems and data or those of our relevant business partners. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: The Company recognizes the importance of cybersecurity and has implemented a comprehensive program to protect its information assets. Key components of our cybersecurity program include appointment of an Information Security Officer, who is the also the Chief Operating officer with extensive knowledge of cybersecurity issues, information security policies and procedures, engagement of third-party security experts, regular penetration testing, managed backup and data protection, managed threat response, hardware and software protections, physical security measures, employee training, internal cybersecurity audits, and ongoing product cybersecurity assessments. The Company maintains cybersecurity insurance covering its internal operations and customer-facing products.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Despite these measures, the Company cannot guarantee that it will be immune from cybersecurity threats. A successful attack could result in unauthorized access to our systems, data breaches, disruptions to our operations, and financial losses. We are committed to continually evaluating and enhancing our cybersecurity program to mitigate these risks.


text: The Company's Board of Directors receives regular reports from the Information Security Officer regarding the Company's cybersecurity program. The Board ensures that the Company has the necessary resources and authority to implement and maintain a sufficient cybersecurity program. The Information Security Officer reports directly to the Chief Executive Officer and is responsible for working with internal and third-party resources to develop and implement the Company's cybersecurity strategy, manage cybersecurity risks, and oversee the Company's cybersecurity operations.


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We have implemented security measures and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks. All employees receive cybersecurity training and other education regarding their use of computers, information technology, and sensitive data. We utilize third parties to support our information technology, or IT, resources, including disaster recovery intended to safeguard our ability to access and use our IT resources during a disaster or cyber incident. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.


text: Our cybersecurity management process consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We have installed and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. We receive cybersecurity related alerts from our membership in a number of industry groups. These alerts are evaluated and in the event an alert requires action within our environment, such actions are taken promptly. Our process and cybersecurity posture is refined based on the results of periodic third party cybersecurity assessments. We engage with the Cybersecurity and Infrastructure Security Agency through their cyber hygiene service offerings. Cybersecurity is addressed in IT's reports to the Corporate Automation Steering Committee, which consists of all Officers and the Director of Customer Service, as well as in IT's reports to the Board of Directors.


text: Should a cyber event occur, depending on the severity of an event, our cyber incident reporting process includes informing, as early as practicable, our senior corporate management.


text: The Audit Committee of the Board of Directors, as overseen by the full Board of Directors, is responsible for oversight of cybersecurity risk. Our IT executives report on our cybersecurity practices and risks at each meeting of the Audit Committee of our Board of Directors. In addition, our IT executives provide periodic updates on cybersecurity risks to our management at regularly held executive committee meetings. Should any cybersecurity threat or incident be detected, our IT executives would timely report such threat or incident to the management executive committee and provide regular communications and updates to the executive committee throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. Any incident identified by the management executive committee as having a material impact would be promptly escalated to all members of the Board of Directors. Should there be an incident which does not rise to the level of being material, such incident would, at minimum, be included in the subsequent IT reports to both the management executive committee and the Board of Directors.


text: We believe we are appropriately staffed to support a healthy cybersecurity posture. All IT personnel have a combination of professional experience, education, and/or certifications for their area of responsibility. For IT leadership, our Chief Information Officer earned a Masters of Business Administration and also a Master of Science degree in Information Systems & Technology Management.


text: Our Vice President of Information Technology earned a Bachelor of Science in Computer Science and Business and a Bachelor of Science in Business and Economics. The Vice President of Information Technology is also a Certified Public Accountant, a Certified Information Systems Auditor, and a Chartered Global Management Accountant. Our Director of Cybersecurity earned an Associates Degree in Computer Network Engineering and is a Certified Information Systems Security Professional.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause water or wastewater system operational problems, disrupt service to our customers, compromise important data or systems or result in an unintended release of customer or other confidential information. See "Item 1A. Risk Factors—Risks Related to Cybersecurity and Technology" for additional discussion of cybersecurity risks impacting our Company.


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization. In addition, there have been reports of other water utility companies being subjected to such attacks, resulting in widespread operational outages.


text: We have implemented security measures and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks. All employees receive cybersecurity training and other education regarding their use of computers, information technology, and sensitive data.


text: We utilize third parties to support our information technology, or IT, resources, including disaster recovery intended to safeguard our ability to access and use our IT resources during a disaster or cyber incident. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers. Our cybersecurity management process consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We have installed and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. We receive cybersecurity related alerts from our membership in a number of industry groups. These alerts are evaluated and in the event an alert requires action within our environment, such actions are taken promptly. Our process and cybersecurity posture are refined based on the results of periodic third party cybersecurity assessments. We engage with the Cybersecurity and Infrastructure Security Agency through their cyber hygiene service offerings. Cybersecurity is addressed in IT's reports to the Corporate Automation Steering Committee, which consists of all Officers and the Director of Customer Service, as well as in IT's reports to the Board of Directors. Should a cyber event occur, depending on the severity of an event, our cyber incident reporting process includes informing, as early as practicable, our senior corporate management.


text: The Audit Committee of the Board of Directors, as overseen by the full Board of Directors, is responsible for oversight of cybersecurity risk.


text: Our IT executives report on our cybersecurity practices and risks at each meeting of the Audit Committee of our Board of Directors. In addition, our IT executives provide periodic updates on cybersecurity risks to our management at regularly held executive committee meetings.


text: Should any cybersecurity threat or incident be detected, our IT executives would timely report such threat or incident to the management executive committee and provide regular communications and updates to the executive committee throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.