text: Our Board has generally delegated the cybersecurity risk oversight function to the Audit Committee. The Audit Committee monitors our Manager's design and implementation of its cybersecurity risk management program.


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG

secItem: Item 1C


text: Our Manager's Director of Technology leads our Manager's overall cybersecurity function and supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including alerts and reports produced by security tools deployed in our Manager's IT environment.


text: Our Manager's Director of Technology is responsible for assessing and managing our Manager's material risks from cybersecurity threats and has primary responsibility for leading our Manager's overall cybersecurity risk management program and external IT cybersecurity service providers. Our Manager's Director of Technology has pertinent related experience in managing IT infrastructure and participates in various industry peer groups and organizations.


text: We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive and store. We have a cybersecurity risk management program in place designed to assess, identify and manage material risks from cybersecurity threats utilizing a defense-in-depth security strategy that integrates our staff, technology and operations to establish various securities barriers across multiple layers and missions of our operations. Our cybersecurity risk management program is designed to employ industry standard practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cybersecurity incidents, attacks and data breaches; cybersecurity preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key aspects of our cybersecurity risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, and a third-party continuous monitoring engagement, that monitors threat detection and response 24/7/365; • Utilization of third parties to assess our practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • Annual cybersecurity training for all employees, including social engineering (e.g., phishing, vishing, and smishing), privacy and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response and disaster recovery procedures, including quarterly tabletop incident response exercises, annual disaster recovery tests, annual unannounced penetration tests, annual phishing campaigns, and annual security control assessments; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • We engage an independent third-party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments. • We engage an independent third-party service provider to conduct an annual security program assessment of the controls, maturity and performance of our information security program and the information security risks associated with our technology and business systems. • We engage an independent third-party service provider to annually perform external and internal penetration and intrusion testing using industry standard tools and techniques. • We engage an independent third-party auditor to help ensure compliance with certain information security standards required under some of our federal contracts. • We have an established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts. These agencies conduct assessments of our controls on a periodic basis using the National Institute of Standards and Technology Cybersecurity Framework. • We engage a third-party auditor to review processes and procedures designed to control access to information systems as part of its Sarbanes-Oxley testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our cybersecurity risk management program. Further, our internal audit team conducts annual assessments of our cybersecurity risk management program and controls.


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: We have a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure you that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program is integrated into our overall risk management system. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our cybersecurity risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, on a periodic basis.


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's cybersecurity risk management program controls, including management's assessment of recent cybersecurity incidents meeting certain criteria.


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's cybersecurity risk management program controls meeting certain criteria.


text: Our Technology Cybersecurity Committee is comprised of a subset of our Technology Department, including our CIO. The Technology Cybersecurity Committee meets bi-weekly and reviews all cybersecurity risks and incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a technology management level, and reports through our CIO to the Technology Steering Committee.


text: We also maintain a management governance structure for reviewing and approving changes related to new and existing systems, software and infrastructure design. Any new items that would require a material change must be reviewed and approved by our architecture review board, or ARB. Non-material changes are governed by the change advisory board, or CAB. The ARB and CAB each meet on a weekly basis and take security impacts into consideration during the decision-making process. All changes, whether approved or rejected, are formally documented in our information technology service management system.


text: As mentioned above, our SIEM tool monitors threat detection and response 24/7/365. Identified threats are alerted and addressed by our information technology team in accordance with internal policies, industry standard practices and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed weekly and are supplemented on an ad-hoc basis for specific threats or to test patch status.


text: Our Director, Information Security Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of cybersecurity incidents. They perform an impact assessment with respect to cybersecurity incidents meeting certain criteria and elevate the review of any such cybersecurity incidents for review by our executive officers.


text: Cybersecurity incidents meeting a certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.


text: We have also adopted a cybersecurity incident response plan which provides for controls and procedures in connection with cybersecurity incidents, including these escalation procedures.


text: At a management level, our cybersecurity risk management program is led by our CIO, along with our Director, Information Security Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Director, Information Security Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These 11 technology professionals have an average cybersecurity tenure of 13 years and certifications from ISC2, ISACA, CompTIA and other industry certification leaders including CISSP, CISM, CISA, CCNA, CCNP, Network+, Security+, Project+, A+, CEH, CCSP and ITIL, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.


text: In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Cybersecurity risks are integrated into the Registrants' Enterprise Risk Management process. The Enterprise Risk Management process engages internal stakeholders, helps identify key internal and external business risks, including cybersecurity risks, and then supports evaluations of those risks, providing consistent assessment. Key risks are then assessed using a methodology that includes a quantification of potential financial and operational impacts. Priority cybersecurity risks are assigned internal risk owners which report to the Vice President of Technology, Data and Security, who is responsible for the Registrants' Enterprise Security including, among other responsibilities, developing and updating risk management plans.


text: The Enterprise Security team utilizes third-party consultants to regularly conduct a review of the Registrants' cybersecurity program that includes assessing their (i) ability to detect and respond to malicious behavior, (ii) configuration of security tools and (iii) security roadmap, training and staffing plans. The Enterprise Security team also utilizes multiple sources of threat intelligence information from real time feeds that come from government, industry and private sources to help stay abreast of emerging threats that could impact the Registrants.


text: The Registrants have third-party vendor risk management processes to oversee and identify risks from cybersecurity threats associated with their use of third-party service providers. Enterprise Security works cross-functionally across the companies to review new vendors and their proposed solutions as they are engaged by the Registrants. The Enterprise Security team's monitoring and assessment of third-party cybersecurity practices is continuous and ongoing throughout the Registrants' relationship with the third party. Based on this process, the Enterprise Security team may require specific security controls on the third-party application, system, hardware or software being deployed. Enterprise Security monitors vendors for disclosed vulnerabilities and change in scores from external risk scoring agencies.


text: The Registrants and their third-party vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems, or confidential data, or to disrupt operations. None of these attempts has individually or in aggregate resulted in a security incident with a material impact on the Registrants financial condition or results of operations. Although prior incidents have not materially affected the Registrants, any future incidents related to the Registrants' information systems due to theft, ransomware, viruses, increased use of artificial intelligence technologies, denial of service, hacking, acts of war or terrorism, or inappropriate release of certain types of information, including confidential customer information or system operating information, could have a materially adverse impact on the Registrants, and affect their business strategy, results of operations or its financial condition. See "Item 1A. Risk Factors" for further discussion.


text: The Board of Directors is responsible for reviewing and overseeing the long-term strategic plans and principal issues facing the Registrants and includes the oversight of the major risk exposures and the risk management activities of the Registrants. As part of its risk oversight role, the Board delegates specific roles to its committees to help ensure risks, mitigations and opportunities are appropriately monitored and managed. The Audit Committee has overall oversight responsibility over the Registrants' major financial risks, while the Nominating, Corporate Governance and Stewardship Committee oversees the Registrants' cybersecurity risk exposure and management. These Committees and the full Board of Directors are updated regularly by the Vice President of Technology, Data and Security and the Director of Enterprise Security on cybersecurity risks and related matters, including results from audits and assessments of the Registrants' cybersecurity practices and systems, as well as the results of their incident response and business resiliency exercises.


text: The Vice President of Technology, Data, and Security leads an information security team responsible for management of cybersecurity risk. The Vice President of Technology, Data and Security has decades of experience relevant to risk management, information systems and enterprise security. The Vice President of Technology, Data and Security serves on the Corporate Risk Oversight Committee where cyber risks are regularly discussed and addressed. The Registrants' Corporate Risk Oversight Committee includes corporate officers and members of management and is responsible for the overall development, implementation and enforcement of strategies and policies for all significant risk management activities of the Registrants.


text: The Registrants' contingency plans, including its security incident response plan and event management framework, set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified and elevated, as necessary, to an executive team which includes the Vice President of Technology, Data and Security and other executives on the Registrants' Corporate Risk Oversight Committee. Once elevated, these executives are ultimately responsible for the management, mitigation and remediation of incidents.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and take a holistic approach to overseeing and managing cybersecurity, which is supported by both management and our Board of Directors. The Company's Board, the Audit Committee of the Board and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our approach to cybersecurity risk management is multi-layered and includes governance and risk, monitoring and incidence response, data security, application security, endpoint security, network security and perimeter security.

companyName: First American Financial Corp

ticker: FAF


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 13 years in various information security roles and has over 20 years of experience in the cybersecurity field.


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our CISO regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.


text: The Company maintains an extensive and structured enterprise risk management (ERM) program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective. The ISO Committee meets quarterly and is chaired by the Company's Chief Risk Officer and is comprised of the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Privacy Officer and top leaders of each of the Company's operating units. The Company's CISO, Chief Information Officer and Chief Technology Officer are also participants on the ISO Committee and the Chief Audit Executive, who reports to the Company's Audit Committee, is an observer. The CISO provides regular reports to the ISO Committee which are shared with the Company's Board of Directors.


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls (SOC 2) testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training and compliance programs. Compliance with cybersecurity training is tracked and reported to the Company's Compliance Executive Steering Committee and the Audit Committee of the Board. In addition, the Company conducts quarterly employee phishing tests and our CISO provides those results to the Company's executives. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider (MSSP), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, as amended on December 29, 2023 and January 12, 2024. Prior to the Company's systems being taken offline in connection with this incident, we produced an internal forecast estimating our adjusted earnings per share to be $1.00. Our actual adjusted earnings per share was 69 cents, including a 5 cent tax benefit, implying a 36 cent shortfall relative to our internal estimate. Although the Company believes that most of this difference is related to the incident, the exact impact the incident had on our fourth quarter results is unknowable. Included in this 36 cent shortfall was $11 million of direct expenses related to the incident in our corporate segment including our $5 million insurance retention. We do not believe the incident will have a material impact on the Company's overall financial condition or its ongoing results of operations. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency. Our administrative and operating networks are targeted by hackers on a regular basis. Any failure, unexpected, or unauthorized use of technology systems could result in the unavailability of such systems, and could result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: We consider the management of cybersecurity risk in our overall enterprise risk management program. See "Item 7. Management's Discussion and Analysis - Enterprise Risk Management" for further discussion of the program.


text: We mitigate cyber risk through trainings and exercises at all levels of the Company. Annual cyber and physical training and testing of employees are included in our enterprise security program. Our enterprise business continuity program facilitates business impact analysis of core functions for development of emergency operating plans and coordinates annual testing and training exercises. In addition, there are independent third party audits of our critical infrastructure security program and our business risk security controls.


text: The technology department, led by the Vice President, Chief Information Officer, and Chief Security Officer, is responsible for our cybersecurity program. The Vice President, Chief Information Officer and Chief Security Officer has over 20 years of experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.


text: Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. A subset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.


text: The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.


text: Garmin has a cybersecurity risk management program, generally aligned with the tenets and methodologies of industry standards and best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, designed to protect the confidentiality, integrity, and availability of the Company's information systems through assessing, identifying, and managing material risks from cybersecurity threats. The management of our information system platforms and the related cybersecurity is tightly integrated with Garmin's product development and technology management teams. Cybersecurity risks are identified, reported, and managed by the Company's in-house cybersecurity experts as well as third-party providers of penetration test reporting, cyber-threat intelligence, and incident forensics services.

companyName: GARMIN LTD

ticker: GRMN


text: Material Risk Identification The Company identifies risks from cybersecurity threats through a variety of methods including, but not limited to, internal and external assessments, security incidents, evaluations of changes to the business environment, systems, or technology, and reporting by associates, vendors, customers, and security researchers. These processes occur during the procurement, development, integration, modification, operation, and maintenance of the Company's information systems and the integration with or introduction, purchase, acquisition, or renewal of any third-party information systems and services. Notable changes to the Company's operating environment are scrutinized to ensure the confidentiality, integrity, and availability of the Company's information systems.


text: Material Risk Assessment The Company evaluates material risks from cybersecurity threats in terms of the potential impact on technology, information, data, and business operations, taking into account applicable laws and regulations, and with a focus on protecting the confidentiality, integrity, and availability of information, data and systems. Associated risk assessments are performed by the Company's risk analysts, subject matter experts, and information technology associates to identify, analyze, and quantify the risks and relevant objectives, and to determine the appropriate management action and priorities for managing the risks and implementing mitigating controls. Additional assessments to evaluate residual risk are performed when there are changes to controls that have the potential to create a material risk. Risk assessments also include appropriate considerations for regulatory and contractual requirements, and involve the Company's legal, data privacy, finance, and risk assurance functions as applicable.


text: Material Risk Management The Company continually analyzes and responds to material risks from cybersecurity threats in order to manage them to acceptable levels. The results of related risk assessments are used to prioritize the risks based on their potential impact to the Company and to inform the necessary actions and the appropriate functions to be involved in responding to those risks. Garmin's cybersecurity risk management processes are integrated into the Company's overall risk management processes. Material risks from cybersecurity threats are communicated to the Company's management and Board of Directors and are evaluated and considered alongside operational, legal, and other risks faced by the Company in determining mitigating actions and the allocation of resources.


text: Risks Related to Third-party Service Providers Garmin operates a third-party risk management program, which is aligned to NIST principles, to oversee and identify material risks from cybersecurity threats, undertake appropriate remediation, and establish and maintain compensating controls when appropriate. We conduct cybersecurity assessments of third-party service providers that will process personal, confidential, or proprietary information. Before proceeding with any such third-party service provider, we require them to remediate or mitigate any material findings from our cybersecurity assessment and to agree contractually to maintain acceptable cybersecurity practices throughout the duration of their service to Garmin and after for so long as they retain any personal, confidential, or proprietary information, and to promptly notify Garmin of any cybersecurity incidents that impact Garmin.


text: Risks from Cybersecurity Threats While the Company has technology and processes in place designed to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. Management does not believe our business strategy, results of operations, or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information about risks from cybersecurity threats, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Garmin's entire Board of Directors performs the risk oversight role, including with respect to risks from cybersecurity threats. Garmin's Chief Executive Officer is a member of the Board, and Garmin's Chief Financial Officer and its General Counsel regularly attend Board meetings, which helps facilitate discussions regarding risk between the Board and Garmin's senior management. In addition, on an annual basis Garmin's head of cybersecurity provides a comprehensive update of the Company's cybersecurity practices, risks and risk mitigation strategies to the Board of Directors. Each member of the Board of Directors actively participates in those discussions and has an opportunity to ask questions or provide direction. Garmin's Chief Executive Officer and head of cybersecurity also have discussions with members of the Board of Directors on an ad hoc basis as appropriate if and when a specific cybersecurity risk arises.


text: Management's Role Managing Risk and Monitoring Incidents Garmin's head of cybersecurity, who has over 30 years of relevant cybersecurity experience, oversees the Company's cybersecurity risk management program and is responsible for assessing and managing the Company's material risks from cybersecurity threats. Garmin's head of cybersecurity regularly meets with the Company's senior management, including the Chief Executive Officer, to discuss the Company's cybersecurity practices, risks, risk mitigation strategies, and whether further investments in internal or external cybersecurity resources are warranted.


text: If the cybersecurity team detects a potentially significant cybersecurity incident it is escalated promptly to the Company's head of cybersecurity, who then activates the Company's incident response plan and convenes the incident response team, which includes leaders of the Company's Legal, Finance, Operations, Communications, Risk Assurance, and other departments and executive leadership as appropriate. The Chief Executive Officer will inform the Company's Board of Directors of any material cybersecurity incidents.


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We also process anonymized information about participants in clinical trials involving certain of our product candidates. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, periodically conducts an internal assessment of different systems to assess our risk management processes, including cybersecurity risk management. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter. As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging third-party vendors and key suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity related risks, see "Risk Factors—Risks Related to Information Security and Privacy—Our Internal Information Technology Systems, Or Those Of Our Collaborators Or Other Contractors Or Consultants, May Fail Or Suffer Security Breaches, Which Could Result In A Material Disruption Of Our Product Development Programs."


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our General Counsel who serves as our Chief Compliance Officer), with oversight from our Audit Committee of the Board of Directors, or Audit Committee, our Head of Information Technology, or Head of IT, has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Compliance Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity. The individual currently operating as our vCISO has over 15 years of experience in providing services as an enterprise vCISO across various industries, including life sciences and national defense and has advised various agencies of the U.S. federal government.


text: As part of our Board of Directors', or Board's, enterprise risk management program, our Board has responsibility for oversight of cybersecurity risk management. Our Board has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT and vCISO provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full Board of Directors.


text: Protecting the security of our information systems is of significant importance to Flowers. We follow certain policies, protocols, and practices that address cybersecurity.

companyName: FLOWERS FOODS INC

ticker: FLO


text: We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes have been integrated into our enterprise risk management system. These processes also cover third-party service provider incidents that may impact the company.


text: Our cybersecurity program includes employee training and a computer security incident response plan (the "CSIRP") that provides controls and procedures designed to timely and accurately report material cybersecurity incidents. Employees receive regular security training, and we conduct periodic phishing testing to assess whether our employees require additional training. Additionally, we provide our employees with easy-to-use tools to report potential phishing emails. The CSIRP establishes an organizational framework and guidelines to assist the Company in identifying, responding to, and recovering from computer security incidents both at the company and its third-party service providers in connection with incidents that may impact the company, including the security incident management team (the "SIM Team"), a legal team (the "Legal Team") and the computer security incident response team (the "CSIRT"). Each of the SIM Team, the Legal Team, and the CSIRT, often in consultation with the VP of Information Security, has a discrete set of responsibilities and obligations under the CSIRP. The CSIRT is a broad, cross-functional team of management stakeholders assigned with coordinating, developing, and managing the Company's response to computer security incidents when activated.


text: Once the CSIRT has been activated, incidents are reported to a subcommittee of the Company's disclosure committee, which consists of certain senior executives and leaders throughout the company and is charged with making disclosure determinations.


text: The CSIRP provides that, when activated, the CSIRT will lead all aspects of incident response, including the engagement of outside counsel and other third-party resources, such as an external incident response team, forensic resources, a crisis management or public relations firm, or notification service providers. For incidents where the CSIRP is not activated, either the SIM Team or the Legal Team, depending on the circumstances, is expected to lead and manage the incident response.


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. The company engages consultants, auditors, and other third parties to identify and manage risk from third parties.


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, be subject to litigation or incur remediation costs or penalties because of the unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.


text: The company's board of directors oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.


text: At the management-level, the company's IT systems are overseen by our chief information officer, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who has responsibility for information security strategy and operation. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.


text: Management tracks cybersecurity incidents through the process described above. Management regularly reports to the audit committee regarding policies and processes for assessing and managing risk associated with information technology and cybersecurity, as well as material cybersecurity incidents.


text: We maintain a comprehensive cybersecurity program, including policies and procedures designed to protect our systems, operations, and data. We perform risk assessments on a quarterly basis to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our Information Technology ("IT") team engages in threat modeling, vulnerability scanning and penetration testing. For each identified risk, our IT team will estimate the likelihood of occurrence and potential impact, which will guide the Company in assessing and prioritizing risks. We have also implemented a process to evaluate and review potential cybersecurity risks arising from our use of third-party vendors. As part of our vendor engagement protocols, we will consider, among other things, each potential vendor's data backup procedures, incident reporting protocols and data privacy and encryption practices. Once a new vendor is onboarded, we monitor their cybersecurity posture utilizing a third-party cybersecurity ratings provider. In addition to our internal exercises to test aspects of our cybersecurity program, we engage independent third parties semi-annually to assess the risks associated with our IT resources and information assets. Among other matters, these third parties analyze information on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes. Annually, we examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), as guidelines. As a mortgage company, we are also associated with the Federal Financial Institutions Examination Council.

companyName: Taylor Morrison Home Corp

ticker: TMHC


text: For material cybersecurity risks, we've developed mitigation plans to reduce the risk's likelihood of occurrence and/or its expected impact. Such mitigation plans have involved, among other things, implementing additional technology controls or policies, increased training for company personnel or obtaining additional insurance for the identified risk. Our IT team monitors material risks over time and updates the Company's mitigation plans as appropriate. IT also regularly reports to the leadership team on the status of material risks, mitigation plans and incidents related to such risks.


text: We also maintain a data breach response plan, which is intended to be aligned with the NIST framework, and which is reviewed annually and conveyed to our team members through our mandatory cybersecurity training. We also retain experienced cybersecurity consultants that can assist us in the event of a serious breach, and maintain a cyber insurance policy.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.


text: Management is responsible for ongoing assessment and oversight of cybersecurity risks that could significantly impact our operations, finances or reputation. This includes identifying information assets and data systems that are TAYLOR MORRISON HOME CORPORATION 10-K


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: The Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic training and testing for personnel regarding cybersecurity threats, which reinforce the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident; such plans are tested and evaluated periodically. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Company's executive leadership team and cybersecurity Steering Committee, which regularly interacts with the Company's Vice President of Information Technology and other members of the cyber team and management.


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cyber security update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. The cyber security Steering Committee meets multiple times throughout the year to discuss the Company's cyber security programs and practices, risk management related to cyber security and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cyber security professionals with decades of relevant experience. Most notably, the Company's Enterprise Manager of Cybersecurity and Network holds a Certified Information Systems Security Professional (CISSP) certification and has over 15 years of experience with managing risks arising from cybersecurity threats.


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plans (IRP). Through the ongoing communications from these teams, the Steering committee monitors the effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any credible threats or security concerns to the Board when appropriate.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: In the ordinary course of our business, we collect and store sensitive data, including intellectual property, proprietary business information of ours and that of our suppliers and partners, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our partners and third-party providers also possess certain of our sensitive data. The secure maintenance of all such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our Information Security Management System ("ISMS") is a key element of our information security program, and it is designed to identify, assess, help mitigate, and monitor information technology risks across the organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party risk management, audit management, incident response and security awareness, including employee security awareness trainings and other initiatives. Our ISMS also includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks identified and managed thereby, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS specifically and our information security program generally.


text: As part of our information security program, we also have a program in place for management of cybersecurity risks associated with third-party handling of our confidential information, including their provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and our application of established mechanisms for ongoing monitoring of such third parties, including tools such as security ratings services and periodic reassessment questionnaires.


text: As of the date of this Annual Report, we have not experienced any information security incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, and we have not identified any current cybersecurity threats that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: We have a multi-layered information security governance framework in place to provide oversight of our information security program and strategy, our ISMS, and related risks and opportunities. This governance framework includes procedures for escalation of identified information security risks, threats or incidents through various management levels, including up to our Information Security Governing Body, which is comprised of our Chief Executive Officer, Chief Information Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer and other members of management, and as appropriate, up to our board of directors.


text: Our information security team, led by our Chief Information Officer, is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. The information security team is managed on a day-to-day basis by our Director and Executive Director of Information Security and works cross-functionally throughout the organization to assess and prepare the Company for identification and mitigation of, and if necessary response to, information security risks. Our information security team members collectively have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to information technology and cybersecurity and mitigations put in place, or to be put in place, in response to such risks. The audit and risk committee periodically reports to the full board of directors regarding the audit and risk committee's oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our Chief Information Officer and our Executive Director of Information Security on the ISMS and other information security initiatives, and on our information security governance framework.


text: The Company maintains a comprehensive cybersecurity management and governance program. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR INC

ticker: PCAR


text: The Company's Security Risk Council, including the Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the Company's Security Risk Council evaluates its significance and briefs the Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to the Company.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: The CCO and Crescent also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems which have the potential to subject the Company to information technology vulnerabilities and receive reports from the Company's service providers regarding any cybersecurity threats and incidents. As part of the oversight of the Company's key service providers, Crescent engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis on such service providers on an annual basis. The CCO and the Head of Information Technology provide regular reports to the Board of Directors regarding significant risks to the Company, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Directors regarding material cybersecurity matters as they arise. The Company has also adopted policies and procedures designed to ensure the timely disclosure of any material cybersecurity incidents.


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessment and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.


text: Crescent's Head of Information Technology has over 30 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.


text: Since our commencement of operations, we have not experienced a material cybersecurity incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition.


text: See "Item 1A. Risk Factors— Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of its confidential information and/or damage to its business relationships"


text: Information security is the responsibility of our Information Security and Compliance department, overseen by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). We leverage a combination of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST Security and Privacy Controls for Information Systems and Organizations, International Organization for Standardization ("ISO 27001"), the American Institute of Certified Public Accountants ("AICPA) SOC 2 set of security controls, and Center for Internet Security best practice standards to measure our security posture and manage risk. We implement both preventative and detective mechanisms, as well as processes, controls, and tools in layers. These layers include applications, systems, network, third-parties, personnel and physical security. We implement this system via governance, risk management, policy, education, security engineering, security compliance, security operations, and application security.

companyName: INSTRUCTURE HOLDINGS, INC.


text: Our Incident Response Plan ("IRP") establishes the incident response ("IR") policies and procedures to position our organization to timely and effectively address cybersecurity incidents that could, or may have, compromised sensitive and/or personally identifiable information ("PII"), or have a serious impact on our ability to accomplish our mission. The IRP also specifies the organizational methods for the preparation, detection, analysis, eradication, and containment of an incident. The IRP describes the roles, responsibilities, and actions of the Incident Response Team ("IRT") to analyze, classify, and manage security events and incidents, including but not limited to, unauthorized access, alteration or compromise, denial of service, malicious code, or misuse.


text: To implement our policy, we maintain a comprehensive IR process containing detailed information on points of contact, response procedures, and training. We perform an annual security incident response exercise to test the effectiveness of the incident response process we have established. The annual test consists of scenario-based tabletop exercises that involve members of the IRT and cover specific types of incidents. These exercises also provide a mechanism to train personnel with security incident response duties to understand the roles, responsibilities, and procedures they have within the plan. In addition, we conduct regular security awareness trainings for all of our employees, and carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Additionally, our security team conducts regular vulnerability scans of both our non-public assets and our production environments, using a number of internal and external tools, custom scripts, and monitoring agents to watch for open-source libraries and dependency vulnerabilities. In addition to regular scanning and periodic internal security audits conducted throughout the year, we conduct open, third-party security reviews, including year-round bug bounty penetration testing.


text: We utilize several third-party organizations to host our products for customers. We monitor the secure provision of these services, our security team performs thorough vetting prior to, and periodically throughout the relationship with third-party vendors. To help provide reasonable security assurance of the security practices and mechanisms at these third parties, we request and review copies of the third-party assurance reports provided by these organizations on an ongoing basis to confirm their controls are operating effectively. Legal contracts with these third parties also include security provisions to help ensure the implementation and operation of effective security controls at the third-party organizations. Furthermore, we host all customer-facing web applications and supporting infrastructure on AWS. We rely on AWS' ability to design and operate the critical mechanisms and controls to protect physical access to data and availability of our services. AWS has represented to us that their data centers utilize state-of-the-art electronic surveillance and multi-factor access control systems, among other security measures, including permanent trained security guards and limited access.


text: In the last three years, neither we nor our third party provider have experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. For additional information about the Company's cybersecurity risks, please refer to "Risks Related to our Technology and our Intellectual Property Rights" in Item 1A, "Risk Factors."


text: While our full board of directors has overall responsibility for risk oversight, it has delegated to the Audit Committee oversight of our risk management process. Our Audit Committee is committed to regularly reviewing, advising and overseeing the effectiveness of our cybersecurity and data protection programs and practices, including controls, policies and guidelines, security strategy and technology planning, compliance, and preparedness and incident response planning. The Audit Committee reports to the full board of directors when a cybersecurity matter rises to the level of a material or enterprise level risk.


text: The CIO presents updates to the Audit Committee as needed and, also as necessary, to the board of directors. These reports include detailed updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The CIO also promptly informs and updates the board of directors about any information security incidents that may pose significant risk to Instructure.


text: Our CIO has over 20 years of experience building, developing, and leading high-performance cloud, IT, and security teams globally—while strategically aligning IT and security services for organizational success. Prior to joining Instructure in 2021, he was SVP of Cloud Customer Operations and the Chief Information Security Officer at a business intelligence and analytics firm. Before that, he led global IT and information security for the largest dedicated global software security firm. He has a Master's Degree in Information Systems from George Mason University and a Bachelor's Degree in Computer Science from SUNY Buffalo.


text: Our CISO has 15 years of experience in Information Technology. During the last decade, he has focused on leading information security programs, with the aim of creating alignment and synergy between security programs and other business units. Prior to joining Instructure in 2022, he led the inauguration of an information security program and implemented strong and adaptable information security processes and controls at a retail technology company. Before that, he was Director of Information Security for a leading modern media company. He has both a Master's Degree and Bachelor's Degree in Information Security from Marymount University.


text: PACCAR maintains a comprehensive cybersecurity management and governance program, which includes the Company. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR FINANCIAL CORP


text: PACCAR's Security Risk Council, which includes the Company's Management and PACCAR's Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the PACCAR Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the PACCAR Board of PACCAR Financial Corp. (Millions of Dollars)


text: Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the PACCAR's Security Risk Council evaluates its significance and briefs the PACCAR Board on the event.


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain PACCAR dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to PACCAR or the Company.


text: The Company recognizes the critical importance of assessing, identifying and managing material risks associated with cybersecurity threats, as well as developing, implementing and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We focus significant resources on protecting our technology infrastructure and the personal information therein regarding applicants, our students, their families, our alumni and our employees. Our principal cybersecurity risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: The Board of Directors, as a whole, oversees the Company's risk management through both the Company's enterprise risk management program and the internal audit function. To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.


text: The Board has delegated oversight of the Company's management of cybersecurity risk to the Compliance and Risk Committee (the "Committee"). Directors with experience in cybersecurity are appointed to this Committee to assist in developing strategies and processes for protecting against, responding to, and remediating information security breaches. Those directors are Dennis Chookaszian, Patrick Gross and Leslie Thornton. The Committee reviews information security matters quarterly. In addition, the full Board regularly receives updates on cybersecurity matters from our Chief Information Officer, David C. Czeszewski, at each board meeting. The Chief Information Officer reports on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, an assessment of the information security program, and the emerging threat landscape. Mr. Czeszewski has a Bachelor of Arts degree in business and computer studies and a Master in Business Administration. He has worked in the technology field since 1986, joined the Company in 2001, and has been its Chief Information Officer since 2013.


text: The Company also has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.


text: We engage third-party experts to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. These third-party experts perform periodic cyber assessments, including security assessments using the CIS Controls cybersecurity framework. Our processes address cybersecurity threat risks associated with our use of these third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risks to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss which could adversely affect our reputation, operations and ability to attract and retain students," and "Our remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating, overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: Ascent Solar Technologies, Inc.

ticker: ASTI


text: The Chief Operations Officer ("COO"), who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The COO uses both internal and external resources to execute this process including security tools that help prevent, identify, escalate, investigate and resolve security incidents in a timely manner and tools that help prevent unauthorized access. The Company, with the oversight of the COO, also requires all employees to complete an annual cybersecurity training course.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.


text: The Company has established polices, processes, controls and systems designed to identify, assess, measure, manage, monitor and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to expend significant resources to modify or enhance its measures to detect and prevent cybersecurity attacks or to investigate and remediate any information security vulnerabilities that become known. The risks faced by the Company from cybersecurity threats that could materially affect the Company, including its business strategy, results of operations or financial condition, are discussed in Part I, Item 1A, "Risk Factors" as part of this Annual Report on Form 10-K.

companyName: M&T BANK CORP

ticker: MTB


text: Cybersecurity is integrated into the Company's Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company's overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It provides a common foundation for all employees and officers as well as directors to understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of risks, and providing a consistent governance methodology across the Company. All such committees, including the Operational Risk Committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.


text: The Risk Committee of the Board of Directors receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company's cyber and information security program. The Risk Committee of the Board and the Board of Directors receive the results of the Company's annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework, the Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks.


text: In accordance with the Gramm-Leach-Bliley Act, the Company undertakes periodic assessments to identify and assess risks to customer information and evaluate the effectiveness of security controls. The Company engages third parties in connection with such cybersecurity preparedness efforts. Ongoing audits, including vulnerability and penetration testing of the Company's computing infrastructure, are performed by independent third parties and by our internal cybersecurity personnel.


text: The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Security Program. The Company has an established third-party due diligence program to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company's Third-Party Risk Management Program.


text: The Company's Cybersecurity Leadership Team includes the CISO, Mr. Timothy Byrd. Mr. Byrd is responsible for overseeing and reporting on the development and implementation of the Company's information security program. Mr. Byrd has over twenty years of experience in information security for large financial institutions. He also served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. Mr. Byrd currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company's Chief Information Officer, Mr. Michael A. Wisler, who has two decades of experience in the financial and technology industries. Prior to joining the Company in 2018, Mr. Wisler served as Chief Technology Officer of North American Credit Cards and Chief Information Officer of Europe at Capital One Financial Corporation. He holds a Masters of Science in Management of Information Technology from the University of Virginia. In addition, the Cybersecurity Leadership Team includes management with expertise in vulnerability management, digital forensics, threat intelligence, software development, cybersecurity operations, and project management. Many individuals on the Cybersecurity Leadership Team hold cybersecurity-relevant certifications.


text: The Company's Information Security Awareness Program, a component of the Security Program, is designed to ensure that all employees are aware of relevant cyber-related policies, principles, standards and practices, as well as new and current regulatory requirements related to safeguarding customer and corporate information assets. Cybersecurity awareness initiatives and resources are regularly provided to employees, including through mandatory annual cybersecurity awareness training, ongoing simulated phishing email exercises and communications from the Company's Cybersecurity Division on the Company's internal communication channels.


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risk's, and to timely detect the occurrence, and mitigate the effects of, cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ