text: We acknowledge the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, harm to our candidates, associates, employees and clients; operational disruptions; violation of privacy laws and regulations; breach of confidentiality and other contractual obligations; litigation and legal action; financial and reputational harm. We leverage cybersecurity technologies and established processes, procedures, and controls to identify, assess, and manage material cybersecurity risks.

companyName: TrueBlue, Inc.

ticker: TBI


text: Risk assessments Our Information Security Team, led by our Chief Information Security Officer ("CISO"), consists of a Cybersecurity function and a Governance, Risk and Compliance function, and is constantly monitoring for cybersecurity risks and assessing any such risks' potential severity. This team employs a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises to inform the company of potential risks and mitigation strategies. We also execute an annual enterprise risk management assessment, which includes cybersecurity threat risks in addition to other risk areas that could impact the company.

secItem: Item 1C


text: We use a risk-based approach that is aligned with the National Institute of Standards and Technology. We maintain policies and standards that provide the framework for assessing risk. We conduct an annual information security focused risk assessment, which leverages the process and control areas provided by the International Organization for Standardization ("ISO") 27001. In September 2021, we received our ISO 27001 Information Security Management certification. In fiscal 2022 and 2023, management performed procedures to validate our continued conformity with the ISO 27001 standard and concluded that existing controls continued to operate effectively. In addition, we assess our cybersecurity threat risks by conducting periodic internal and external risk assessments and annual external penetration testing, as well as maintaining an active vulnerability management program to assess threats at the network, systems and application levels.


text: Ongoing activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: • Perform an annual review of all of our policies related to cybersecurity; • Monitor emerging data protection laws and implement changes to our policies to remain compliant; • Run tabletop exercises with the cybersecurity incident response team, including executive team members, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Conduct regular phishing email simulations and quarterly security awareness trainings for all employees to enhance awareness and responsiveness to such possible threats; • Require all employees to review and acknowledge the company's information security policies upon hiring and annually thereafter; • Leverage the company's incident response plan framework and a full set of cybersecurity technology tools, processes and procedures including, for example, security incident and cyber event management, endpoint detection and response, extended detection and response, e-mail gateway, and vulnerability management to monitor any cyber threats and to proactively detect, respond and recover when there is an actual or potential cybersecurity incident; • Carry insurance that provides protection against the potential losses arising from a cybersecurity incident; • Conduct annual penetration testing of our external technology and systems perimeter, including remediation and retesting; • Conduct security assessments for code level vulnerabilities of all our internally developed business-critical applications; and • Engage independent third parties to perform penetration testing of select business applications.


text: Our incident response plan identifies the key employees responsible for responding to a cybersecurity incident and coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including periodic third-party reviews of our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our polices and processes address cybersecurity threat risks associated with the use of third-party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.


text: Additional information We describe how the risks related to cybersecurity could materially impact our business strategy, results of operations, or financial condition, in more detail under the heading "Risks Related to Cybersecurity, Data Privacy and Information Security," see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: In the last three fiscal years, we have not experienced any cybersecurity incidents that have materially impacted or are reasonably likely to materially impact our business strategy, results of operations, or financial condition.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Innovation and Technology ("I&T") Committee of the Board is responsible for the oversight of risks from cybersecurity threats. All of our Board members are members of the I&T Committee. At least quarterly, management provides the I&T Committee with updates regarding our cybersecurity risks, threats, and efforts focused on mitigating those risks. These updates are provided by our Chief Technology Officer ("CTO") and our CISO, and include recent developments in cybersecurity, the company's actual experience with cybersecurity incidents, and the systems and processes in place to defend against cyberattacks. Should a material or potentially material cybersecurity incident occur, the Board will immediately be notified of such event by the company's CEO. Our CTO and CISO frequently communicate with affected business and finance leaders regarding any cybersecurity related event.


text: Our cybersecurity risk management and strategy processes are led by our CTO and our CISO. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security; developing cybersecurity strategy; and implementing effective information and cybersecurity programs, including governance, risk and compliance oversight for regulatory and contractual compliance. Such individuals are required by their job description to possess several relevant degrees and certifications, including the Information Systems Audit and Control Association ("ISACA") Certified Information Security Manager and the International Information System Security Certification Consortium ("ISC2") Certified Information Systems Security Professional certifications. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We use a risk-based approach that is aligned with the National Institute of Standards and Technology. We maintain policies and standards that provide the framework for assessing risk. We conduct an annual information security focused risk assessment, which leverages the process and control areas provided by the International Organization for Standardization ("ISO") 27001. In 2024, we recertified our ISO 27001 Information Security Management certification to the new 2022 standard. In addition, we assess our cybersecurity threat risks by conducting periodic internal and external risk assessments and annual external penetration testing, as well as maintaining an active vulnerability management program to assess threats at the network, systems and application levels.


text: Ongoing activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: • Perform an annual review of all of our policies related to cybersecurity; • Collaborate with the legal department for awareness of emerging data protection laws and implement changes to our policies to remain compliant; • Run tabletop exercises with the cybersecurity incident response team, including executive team members, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Conduct monthly phishing email simulations and quarterly security awareness trainings for all employees to enhance awareness and responsiveness to such possible threats; • Require all employees to review and acknowledge the company's information security policies upon hiring and annually thereafter; • Send periodic company-wide communications to raise employee awareness of social engineering and other forms of attack and how to guard against those; • Leverage the company's incident response plan framework and a full set of cybersecurity technology tools, processes and procedures including, for example, security incident and cyber event management, endpoint detection and response, extended detection and response, e-mail gateway, and vulnerability management to monitor any cyber threats and to proactively detect, respond and recover when there is an actual or potential cybersecurity incident; • Carry insurance that provides protection against the potential losses arising from a cybersecurity incident; • Conduct annual penetration testing of our external technology and systems perimeter, including remediation and retesting; • Conduct security assessments for code level vulnerabilities of all our internally developed business-critical applications; and • Engage independent third parties to perform penetration testing of select business applications.


text: Our Innovation and Technology ("I&T") Committee of the Board is responsible for the oversight of risks from cybersecurity threats. All of our Board members are members of the I&T Committee. At least quarterly, management provides the I&T Committee with updates regarding our cybersecurity risks, threats, and efforts focused on mitigating those risks. These updates are provided by our Chief Digital Officer ("CDO") and our CISO, and include recent developments in cybersecurity, the company's actual experience with cybersecurity incidents, and the systems and processes in place to defend against cyberattacks. Should a material or potentially material cybersecurity incident occur, the Board will immediately be notified of such event by the company's CEO. Our CDO and CISO frequently communicate with affected business and finance leaders regarding any cybersecurity related event.


text: Our cybersecurity risk management and strategy processes are led by our CDO and our CISO. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security; developing cybersecurity strategy; and implementing effective information and cybersecurity programs, including governance, risk and compliance oversight for regulatory and contractual compliance. Such individuals are required by their job description to possess several relevant degrees and certifications, including the Information Systems Audit and Control Association ("ISACA") Certified Information Security Manager and the International Information System Security Certification Consortium ("ISC2") Certified Information Systems Security Professional certifications. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Autodesk has established policies and processes for assessing, treating, and managing material risk from cybersecurity threats based on relevant industry standards. These policies and processes are reviewed and updated at least annually. We have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may adversely affect the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Autodesk, Inc.

ticker: ADSK


text: We conduct risk assessments, penetration tests, and other security assessments to identify cybersecurity threats regularly, and in the event of a material change in our business practices that may affect information systems potentially vulnerable to such cybersecurity threats. These assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Risks are then assigned to the appropriate owners for tracking and mitigation.


text: Following these assessments, we re-design, implement, and maintain reasonable safeguards, when appropriate, to minimize identified risks; reasonably address any identified gaps in existing safeguards; and continually monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Trust Officer, who reports to our Chief Technology Officer, to manage the risk assessment and mitigation processes.


text: As part of our overall risk management system, we monitor and test our safeguards. We train our workforce on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required trainings. Cybersecurity tabletop exercises are regularly conducted for our executives and for incident response professionals. Improvements identified at these tabletop exercises are implemented into our processes.


text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These outside advisors assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We require Autodesk's third-party service providers and suppliers to implement and maintain appropriate security measures consistent with applicable laws in connection with their work with us and to promptly report any suspected breach of their security measures that may affect our Company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Relating to Our Operations".


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. The board's Audit Committee oversees the management of cybersecurity risks relating to financial, accounting, and internal control matters. The full board receives regular updates from our senior management and outside advisors regarding cybersecurity risks Autodesk faces. Our Enterprise Risk Management function is responsible for identifying, prioritizing, and mitigating risks that could limit Autodesk's achievement of its strategic and operational priorities. Our executive officers are responsible for the day-to-day assessment and management of these risks.


text: Our Chief Trust Officer is responsible for assessing and managing material risks from cybersecurity threats. Our Chief Trust Officer has more than twenty years of cybersecurity leadership experience, including serving in similar roles leading cybersecurity programs at other public companies.


text: Our Chief Trust Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Trust Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: leading Autodesk's Trust program which implements data protection measures and processes across the organization; strategic planning of the company's cybersecurity initiatives and objectives; cybersecurity risk mitigation efforts; managing tools and processes that support security incident monitoring and alerting; overseeing security incident response planning; managing exercises that test management's response plans and procedures; and managing our response to suspected or actual security incidents.


text: Our Chief Trust Officer provides quarterly briefings to the Audit Committee regarding our cybersecurity risks and state of our Trust program, including recent cybersecurity incidents and related responses, cybersecurity systems testing, and data protection initiatives and metrics. Our Audit Committee regularly updates the board of directors on such reports. In addition, our Chief Trust Officer provides briefings on cybersecurity risks and activities to the board of directors at least annually. Our Chief Trust Officer may also brief the board of directors regarding significant cybersecurity incidents.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors under the heading "Risks Relating to Our Operations".


text: The company maintains a cybersecurity risk management program as part of its overall risk management framework and regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the company's cybersecurity standards, processes, and practices. To protect the company's information systems from cybersecurity threats, the company uses various security tools that help the company identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include but are not limited to, internal reporting, engaging third-party service providers to actively monitor information systems, performing vulnerability testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging trends and regulations related to information security, and implementing appropriate changes, as needed, to our cybersecurity risk management program.

companyName: MIDDLEBY Corp

ticker: MIDD


text: The company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These assessments include penetration testing, vulnerability assessments, tabletop exercises, and reviews of incident response protocols that are designed to ensure robust protections against evolving threats.


text: The company has processes that aim to validate security controls and engages third parties to design or assess security architecture, and certifications. This includes assessing the potential fourth-party risks related to employee, business, and customer data. During the third-party procurement and contracting process, the company incorporates contract provisions that are designed to align with applicable regulations and industry benchmarks.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "The Company may be subject to information technology system failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect the Company's operations, financial condition and operating results" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the company dedicates significant resources in an effort to secure its confidential information as well as the data and any personal information the Company receives and stores about its customers and employees. The company has systems in place designed to securely receive and store that information and to detect, contain, and respond to data security incidents.


text: The company has a robust information security training and compliance program for all new and existing employees. Training is provided at least annually, with a formal communication cadence of additional components of training being provided throughout the year. Employee cybersecurity proficiency is assessed quarterly, with supplementary training programs tailored to individual needs based on these evaluations. The company has not experienced a material cybersecurity or information security breach in the last three years.


text: The company maintains a program, run by the company's Director of Information Technology, overseen by the company's Chief Financial Officer, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by or in the care of the company. The company has implemented a cybersecurity incident response plan that provides controls and procedures to facilitate timely and accurate reporting of any material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by a designated cybersecurity team using established risk criteria. If a cybersecurity event meets certain of these criteria, it is escalated to an internal cross-functional Cyber Incident Response Team and external incident responders. The company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The plan also contains procedures for escalating cybersecurity incidents to the Board of Directors.


text: The company's Director of Global Information Technology is responsible for leading the assessment and management of cybersecurity risks. The current Director of Global Information Technology has over 10 years of experience in information security and holds CISSP and GIAC credentials. The Director of Global Information Technology reports to the Audit Committee and management on cybersecurity threats on a regular basis.


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the company's cybersecurity and information security program and receives periodic updates from senior management on cybersecurity and information security matters. The Director of Global Information Technology or key members of the executive leadership team update the Audit Committee periodically on the cybersecurity landscape, including the status of ongoing threats and company initiatives.


text: The company maintains a program, run by the company's Vice President of Global Information Technology and Information Security, overseen by the company's Chief Financial Officer, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by or in the care of the company. The company has implemented a cybersecurity incident response plan that provides controls and procedures to facilitate timely and accurate reporting of any material cybersecurity incident. The initial impact of each cybersecurity event is evaluated by a designated cybersecurity team using established risk criteria. If a cybersecurity event meets certain of these criteria, it is escalated to an internal cross-functional Cyber Incident Response Team and external incident responders. The company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The plan also contains procedures for escalating cybersecurity incidents to the Board of Directors.


text: The company's Vice President of Global Information Technology and Information Security is responsible for leading the assessment and management of cybersecurity risks. The current Vice President of Global Information Technology and Information Security has over 10 years of experience in information security and holds CISSP and GIAC credentials. The Vice President of Global Information Technology and Information Security reports to the Audit Committee and management on cybersecurity threats on a regular basis.


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the company's cybersecurity and information security program and receives periodic updates from senior management on cybersecurity and information security matters. The Vice President of Global Information Technology and Information Security or key members of the executive leadership team update the Audit Committee periodically on the cybersecurity landscape, including the status of ongoing threats and company initiatives.


text: The Board of Directors' overall risk oversight function includes receiving reports on the Company's cybersecurity risks and our risk management processes, and assessing whether our risk management strategies are reasonably designed to address such risks. The Board has delegated this oversight responsibility to our Audit Committee, which reports periodically to the Board as appropriate.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Our Senior Vice President of Global Operations and our Director of Information Security are responsible for ongoing assessment and supervision of cybersecurity risks, supported by a dedicated Information Security team who reports up to those individuals. Our Director of Information Security has primary oversight of material risks from cybersecurity threats, has over 25 years of experience in cybersecurity-related roles and holds industry-recognized certifications. Our Senior Vice President of Global Operations and Director of Information Security review and evaluate our cybersecurity readiness through internal cybersecurity measures and metrics, as well as third-party penetration tests and control assessments against industry standards. We also employ various defensive and continuous monitoring techniques designed to escalate potential issues in a timely manner to our Director of Information Security.


text: Our Director of Information Security meets with the Audit Committee at least twice a year to discuss our cybersecurity risks, strategy, and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, we have governance and compliance structures that are designed to elevate issues relating to cybersecurity to executive o cers, and, as appropriate, to the Audit Committee and Board.


text: We have policies and processes in place that are designed to assess, identify and manage material risks from cybersecurity threats. We regularly assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We use recognized industry frameworks and standards as guides in identifying, assessing and managing cybersecurity risks relevant to our operations. For example, we primarily use NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) for this purpose.


text: Key components of our cybersecurity risk management strategy include: • We have a dedicated Information Security team principally responsible for implementing and managing our cybersecurity strategy and controls. • We use industry standard technologies and tools appropriate to our operations which are designed to prevent and detect unauthorized access to, or compromise of, our network, servers, endpoints and external applications, such as multi-factor authentication, malware protection, firewalls and monitoring controls. • We regularly train our personnel on cybersecurity awareness and conduct periodic additional awareness and training activities such as simulated phishing campaigns. • We have in place an Incident Response Plan that governs how we respond to and manage cybersecurity incidents. We conduct regular tabletop exercises to test our response to potential incidents. • We use third-party service providers where appropriate to design, implement and support aspects of our security processes as well as to monitor and test our safeguards.


text: Our cybersecurity risk management strategy forms part of our overall enterprise risk management program. We conduct regular risk assessments designed to identify cybersecurity threats and other risks to the company. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence, and any potential damage that could result from such risks. We also evaluate the sufficiency of our existing internal controls and monitor the effectiveness of such safeguards. In response, we adjust our processes and controls as necessary.


text: Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. For example, as part of our contract management process, we conduct IT security reviews, and require executive approval by the General Counsel, Chief Financial Officer and Executive Vice President of Global Operations in relation to products or services that could potentially expose our company to cybersecurity risks.


text: As of the end of fiscal year 2025, we have not identified any risks from known cybersecurity threats (including as a result of any prior cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. While our cybersecurity risk management strategy is intended to assess, identify and manage material risks from cybersecurity threats, it may not adequately do so in every instance, particularly given the evolving nature of the cybersecurity threat landscape. We expect that our policies and processes will continue to be subject to update as the risks from cybersecurity threats change. For more information about risks from cybersecurity threats, and whether they are reasonably likely to materially affect our business strategy, results of operations or financial conditions, please see the Risk factors discussion in Item 1A of this Form 10-K, including "Risks related to system security, cyber-attacks and data breaches".


text: Our Executive Vice President of Global Operations and our Director of Information Security are responsible for ongoing assessment and supervision of cybersecurity risks, supported by a dedicated Information Security team who reports up to those individuals. Our Director of Information Security has primary oversight of material risks from cybersecurity threats, has over 25 years of experience in cybersecurity-related roles and holds industry-recognized certifications. Our Executive Vice President of Global Operations and Director of Information Security review and evaluate our cybersecurity readiness through internal cybersecurity measures and metrics, as well as third-party penetration tests and control assessments against industry standards. We also employ various defensive and continuous monitoring techniques designed to escalate potential issues in a timely manner to our Director of Information Security.


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: SEKISUI HOUSE U.S., INC.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: a. Monitor emerging data protection laws and implement changes to our processes to comply; b. Conduct periodic customer data handling and use requirement training for our employees;


text: c. Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: d. Conduct regular phishing email simulations for all employees; and e. Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our Vice President of IT of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of IT. Our Vice President of IT has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Vice President of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan.


text: Risk Management and Strategy Identifying, assessing and managing cybersecurity risks is an important component of White Mountains's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries/affiliates.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: The Company and each of its consolidated subsidiaries/affiliates are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the ISO 27001 standards and the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of ISO 27001 and CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries/affiliates include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee testing and training; (vi) technical and business team-focused incident response tabletop exercises; (vii) disaster recovery testing and (viii) security assessments of third-party service providers. White Mountains engages both its internal auditors and third-party information security experts to assist management in assessing the effectiveness of these cybersecurity programs.


text: Risks from cybersecurity threats may cause material disruptions to our operations and reputational harm, which could materially adversely affect our results of operations and financial condition. See Item 1.A Risk Factors, "We may be unable to adequately maintain our systems and safeguard the security of our data, which could adversely impact our ability to operate our business and cause reputational harm and, consequently, could materially adversely affect our results of operations and financial condition." on page 38 for more information about these risks.


text: White Mountains's Board of Directors has assigned oversight of the Company's cybersecurity risk management to the Audit Committee. The Audit Committee receives periodic reports on White Mountains's cybersecurity risks and any material cybersecurity incidents at the direction of White Mountains's senior management. In addition, the Audit Committee receives reports addressing cybersecurity risks as part of the Company's overall enterprise risk management program.


text: White Mountains's Information Technology ("IT") Steering Committee, which includes its Chief Information Security Officer, Chief Technology Officer and various members of senior management, as well as the senior IT leadership at each of its consolidated subsidiaries/affiliates are responsible for assessing and managing White Mountains's cybersecurity risk. These individuals include IT and cybersecurity professionals with relevant education, including degrees and/or certifications, and prior work experience. These individuals also monitor the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Senior IT leadership at our consolidated subsidiaries/affiliates communicate information regarding cybersecurity risks to Company personnel through a variety of channels, including discussions between or among subsidiary/affiliate management and the Company, reports made to subsidiary/affiliate boards and direct updates to the Company's senior management and/or IT Steering Committee.


text: The Company and each of its consolidated subsidiaries/affiliates are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the ISO 27001 standards and the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of ISO 27001 and CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries/affiliates include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee testing and training; (vi) technical and business team-focused incident response tabletop exercises; (vii) disaster recovery testing and (viii) security assessments of third-party service providers. White Mountains engages both its internal auditors and third-party information security experts to assist management in assessing the effectiveness of these cybersecurity programs.


text: Risks from cybersecurity threats may cause material disruptions to our operations and reputational harm, which could materially adversely affect our results of operations and financial condition. See Item 1.A Risk Factors, "We may be unable to adequately maintain our systems and safeguard the security of our data, which could adversely impact our ability to operate our business and cause reputational harm and, consequently, could materially adversely affect our results of operations and financial condition." on page 41 for more information about these risks.


text: The Company's Board of Directors has assigned oversight of White Mountains's cybersecurity risk management to the Audit Committee. The Audit Committee receives periodic reports on White Mountains's cybersecurity risks and any material cybersecurity incidents at the direction of White Mountains's senior management. In addition, the Audit Committee receives reports addressing cybersecurity risks as part of the Company's overall enterprise risk management program.


text: Cybersecurity threats pose a risk to the Company, as crimes committed through or involving the internet, such as phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into internal systems or the systems of third-party vendors could adversely impact the Company's operations or damage its reputation. The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable and resilient technology infrastructure, fostering a culture of technology risk awareness and continuously improving its technology risk management practices. The Company's process for monitoring and mitigating cybersecurity risk is designed in conjunction with its overall Enterprise Risk Management Policy. The Company's Information Security Program follows ISO 27002, an international standard for information security controls, as well as references to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the Federal Financial Institutions Examination Council Information Examination Handbook, and other regulatory guidance and industry standards.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: The Company has several processes in place to oversee and identify these risks, such as the Information Technology Risk Governance Committee ("ITRGC"), which is responsible for oversight of information technology ("IT") and information security ("IS") risk. This committee oversees the establishment and revision of IT and IS key risk and key performance indicators and ongoing monitoring of these metrics. The Company's Director of Enterprise Information Security is responsible for cybersecurity initiatives at the Company, including identifying and managing security risks, and escalating elevated risks to the Information Security Officer, who works in tandem with the Chief Risk Officer and collectively report on emerging and existing threats and mitigation strategies to the Board, which has oversight of cybersecurity risk, on a semi-annual basis, or more frequently, if needed. The Director of Enterprise Information Security and the Information Security Officer have 30 and 22 years, respectively, of information security experience across a wide range of industries and both possess substantial knowledge and expertise in how to manage information security and cybersecurity risks. Additionally, the team of employees supporting them maintain education and certification requirements necessary to carry out their responsibilities.


text: The Company has deployed a layered security approach to identify, measure, monitor and control information technology risks. The Company also maintains a documented Incident Management Standard and Technology and Cyber Incident Response Plan. These documents addresses the prevention, detection, mitigation, and remediation of cybersecurity incidents, and include appropriate timely incident escalations to be followed during an incident, up to and including executive leadership, management committees, such as of the ITRGC, and depending on incident severity, the Board or Board committee. The volume, severity, and root case of security incidents are reported on at monthly management committees. The Company will regularly engage independent third parties to assist in its cybersecurity preparedness, including but not limited to vulnerability scan assessments, secure code scan reviews, and cybersecurity incident response simulations. The Company's internal audit department also performs annual cybersecurity penetration testing over the Company's internal and external networks. Additionally, for third party related technologies, the Company's Third Party Risk Management Program ("TPRM") is involved with onboarding and ongoing monitoring of these vendor relationships. TPRM documents the Company's view of applicable third party vendors assessing the vendor's technological capability to provide products and/or services in a viable and risk adverse manner.


text: In an effort to mitigate risks related to cybersecurity threats, the Company has also designed and implemented required training for all employees, including training on the Company's security and privacy policies, which are mandatory as part of the onboarding process, with refresher trainings required annually thereafter. Additionally, the Company carries out regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.


text: While the Company has seen attempts to gain access against its systems, and expects such attacks to continue, or possibly intensify in the future, the Company has not experienced any material losses relating to cyber-attacks or other information security breaches as of December 31, 2023. As a protective measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, or by one or more of the Company's third party providers, however such insurance coverage may not be sufficient to cover all losses incurred. As of the date of this Report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion surrounding risks from cybersecurity threats, refer to the section captioned "Risks Related to Information Security and Technology" within Item 1A this Report.


text: Cybersecurity threats pose a risk to the Company, as crimes committed through or involving the internet, such as phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into the Company's internal systems or the systems of the Company's third-party vendors could adversely impact the Company's operations or damage its reputation. The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable, and resilient technology infrastructure, fostering a culture of technology risk awareness, and continuously improving its technology risk management practices. The Company's process for monitoring and mitigating cybersecurity risk is designed in conjunction with its overall Enterprise Risk Management Policy. The Company's Information Security Program follows ISO 27002, an international standard for information security controls, as well as references to the Federal Financial Institutions Examination Council Information Examination Handbook, and other regulatory guidance and industry standards.


text: The Company has several processes in place to oversee and identify these risks, such as the Information Technology Risk Governance Committee ("ITRGC"), which is responsible for oversight of information technology ("IT") and information security ("IS") risk. This committee oversees the establishment and revision of IT and IS key risk and key performance indicators and ongoing monitoring of these metrics. The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity initiatives at the Company, including identifying and managing security risks, and escalating elevated risks with the Chief Risk Officer ("CRO") where applicable. Together, the CISO and the CRO report on emerging and existing threats and mitigation strategies to the Board, which has oversight of cybersecurity risk, on a semi-annual basis, or more frequently, if needed. The CISO has over 30 years of information security experience, with experienced team members that come from a wide range of industries and possess substantial knowledge and expertise in how to manage information security and cybersecurity risks. Additionally, the team of employees supporting the CISO maintain education and certification requirements necessary to fulfill their responsibilities.


text: The Company has deployed a layered security approach to identify, measure, monitor and control information technology risks. The Company also maintains a documented Incident Management Standard and Technology and Cyber Incident Response Plan. These documents address the detection, mitigation, and remediation of cybersecurity incidents, and include appropriate timely incident escalations to be followed during an incident, up to and including executive leadership, management committees and depending on incident severity, the Board, or a Board committee. The volume, severity, and root case of security incidents are reported on at monthly management committees. The Company will regularly engage independent third parties to assist in its cybersecurity preparedness, including but not limited to vulnerability scan assessments, secure code scan reviews, and cybersecurity incident response simulations. The Company's internal audit department also performs annual cybersecurity penetration testing over the Company's internal and external networks. Additionally, for third party related technologies, the Company's Third-Party Risk Management Program ("TPRM") is involved with onboarding all vendors, including ongoing monitoring of higher risk vendor relationships. TPRM documents the Company's view of applicable third-party vendors assessing the vendor's technological capability to provide products and/or services in a viable and risk adverse manner.


text: In an effort to mitigate risks related to cybersecurity threats, the Company has also designed and implemented required training for all employees, including training on the Company's security and privacy policies, which are mandatory as part of the onboarding process, with refresher trainings required annually thereafter. Additionally, the Company conducts regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.


text: While the Company has seen attempts to gain access to its systems, and expects such attacks to continue, or possibly intensify in the future, the Company has not experienced any material losses relating to cyber-attacks or other information security breaches as of December 31, 2024. As a protective measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, or by one or more of the Company's third-party providers, however such insurance coverage may not be sufficient to cover all losses incurred. As of the date of this Report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion surrounding risks from cybersecurity threats, refer to the section captioned "Risks Related to Information Security and Technology" within Part I. Item 1A of this Report.


text: Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of such risks.

companyName: PRUCO LIFE INSURANCE CO


text: Cybersecurity risk management is integrated within our risk management framework. See Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management" for additional information on our risk management. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: In order to respond to the threat of security breaches and cyber-attacks, Prudential Financial has developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for our technological resources and includes training for employees, contractors and third-parties. Employees with access to our Company's systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader security community and monitor cyber threat information.


text: To address risks associated with third-parties, Prudential Financial has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.


text: We also maintain an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with our corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of risks related to cybersecurity.


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"). We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the CIO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.


text: Prudential Financial's Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board of Directors also receives periodic briefings on cyber threats in order to enhance our directors' literacy on cyber issues.


text: Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of such risks.


text: Cybersecurity risk management is integrated within our risk management framework. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader cybersecurity community and monitor cyber threat information.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of risks related to cybersecurity.


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Head of Global Technology and Operations ("HGTO"). The CISO and Information Security Office are responsible for monitoring for, and informing management of, cybersecurity incidents impacting Prudential's systems. We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the HGTO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.


text: Cyber Risk Management and Strategy In our increasingly interconnected environment, information is inherently exposed to a growing number of risks, threats, and vulnerabilities. As a provider of products and services to financial institutions, Jack Henry integrates industry-standard frameworks, policies, and procedures to securely process and store sensitive information, prioritizing the protection of our associates, clients, and their private data from the ever-evolving cyber threat environment.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Jack Henry's information and cybersecurity program is a key component of our overall enterprise risk management and is maintained by a team of diverse, highly skilled cybersecurity professionals, as well as a portfolio of investments in modern technology, including artificial intelligence and machine learning. The program safeguards Jack Henry and client confidentiality and privacy by systematically identifying, assessing, and managing material risks and cybersecurity threats through use of comprehensive cyber defense, threat and vulnerability management, and cyber intelligence. Our cybersecurity program includes continuous enterprise monitoring with well-defined and rehearsed business resilience and incident response procedures. Further, we use third-party vendors and consultants to assist in identifying and assessing cybersecurity risks.


text: Jack Henry systems and services undergo regular reviews performed by the same regulatory agencies that review financial institutions: Federal Reserve Bank ("FRB"), FDIC, Office of the Comptroller of the Currency ("OCC"), NCUA, and the CFPB, among others. Reviews such as those by the Federal Banking Agencies (comprised of the FDIC, FRB, and the OCC) assess and identify security gaps or flaws in controls. Critical services provided to our clients are subject to annual System and Organization Controls ("SOC") reviews by independent auditors.


text: Our associates and contractors play a vital role in the safeguarding of systems and data. Associates and contractors complete mandatory annual security awareness training to ensure they stay abreast of the latest best practices and related cyber threats. Additionally, we conduct routine phishing exercises to help associates and contractors identify and responsibly respond to suspicious emails. Throughout the year, we target supplemental training and education to higher-risk individuals and teams.


text: Jack Henry relies on third-party service providers to deliver services and products to our clients, and we evaluate and attempt to mitigate the cybersecurity risks associated with the use of these third-party service providers. We conduct evaluations and risk assessments of third-party service providers prior to engagement and on an ongoing periodic basis to ensure our standards for security are maintained. Our strategic risk management committees review and address any identified risks.


text: In fiscal year 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition.


text: As a large financial technology provider, we continually face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us and our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot ensure that we will not experience material cybersecurity incidents in the future or that we have not experienced an undetected incident. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.


text: Cyber Security Governance and Oversight Our Board of Directors maintains ultimate oversight over risk functions but has delegated certain oversight responsibilities for enterprise and operational risks, including cybersecurity risk, to the Board's Risk and Compliance Committee. The Risk and Compliance Committee's obligations include overseeing Jack Henry's risk assessment and management programs and reviewing risk preparedness. Our Audit Committee oversees financial risks and would also be informed of a material cybersecurity incident that could potentially have a material impact on our financial statements. The Chief Information Security Officer ("CISO") reports to the Risk and Compliance Committee and to the full Board of Directors on a quarterly basis on information security matters. Additionally, the CISO meets with the Risk and Compliance Committee at least annually to evaluate our overall security environment and organization.


text: While the Board of Directors, through the Risk and Compliance Committee, maintains oversight for cybersecurity risks, management is primarily responsible for identifying, assessing, and managing material cybersecurity risks within our broader risk management program. Management has established the Enterprise Risk Management Committee, headed by Company executives, to monitor the governance, risk, and compliance environment for Jack Henry, which includes review of cybersecurity risk. Management has also adopted specific policies and processes to monitor cybersecurity threats and to mitigate such threats as they arise. These policies and procedures include, among other things, an incident response program, which includes professionals with diverse backgrounds and skillsets, led by our CISO. Our incident response team is designed to monitor and assess cyber and information security related incidents. Any cybersecurity incidents that meet or exceed preestablished thresholds are escalated to management to establish the scope of the threat, apply mitigation and remediation efforts, and assess the need for disclosure to clients, third-party service providers, and regulators.


text: Our CISO, who reports directly to the Chief Risk Officer, has primary responsibility over Jack Henry's overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response. Our CISO has more than 20 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions. The information security team, under the direction of the CISO, regularly monitors general cybersecurity trends and institutes preventative efforts and defensive measures to protect against cybersecurity threats.


text: Cyber Risk Management and Strategy In today's interconnected environment, information is inherently exposed to a wide range of risks, threats, and vulnerabilities. As a provider of products and services to financial institutions, Jack Henry integrates industry-standard frameworks, policies, and procedures to securely process and store sensitive information, prioritizing the protection of our associates, clients, and their private data in an ever-evolving cyber threat landscape.


text: Jack Henry's information and cybersecurity program is a core component of our overall enterprise risk management framework. It is maintained by a team of highly skilled cybersecurity professionals and supported by investments in modern technology, including artificial intelligence and machine learning. The program is designed to safeguard Jack Henry and client confidentiality and privacy by systematically identifying, assessing, and managing material risks and cybersecurity threats through comprehensive cyber defense, threat and vulnerability management, and cyber intelligence. It includes continuous enterprise monitoring and well-defined and regularly tested business resilience and incident response procedures. We also engage third-party vendors and consultants to assist in identifying, assessing, and mitigating cybersecurity risks.


text: Jack Henry systems and services are subject to regular reviews by the same regulatory agencies that oversee financial institutions, including the Federal Reserve Bank ("FRB"), FDIC, Office of the Comptroller of the Currency ("OCC"), NCUA, and the CFPB, among others. These reviews, including those conducted by the Federal Banking Agencies (comprised of the FDIC, FRB, and the OCC) help identify potential security gaps or control deficiencies. In addition, critical services provided to our clients undergo annual System and Organization Controls ("SOC") reviews by independent auditors.


text: Our associates and contractors play a vital role in the safeguarding of systems and data. All are required to complete annual security awareness training to ensure they stay current on best practices and emerging cyber threats. We also conduct routine phishing exercises to help associates and contractors recognize and appropriately respond to suspicious emails. Supplemental training is provided throughout the year to individuals and teams with elevated-risk profiles.


text: Jack Henry relies on third-party service providers to deliver certain services and products to our clients. We evaluate and seek to mitigate the cybersecurity risks associated with these providers through pre-engagement and periodic risk assessments to ensure our standards for security are maintained. Our strategic risk management committees review and address any identified risks.


text: In fiscal year 2025, we did not identify any cybersecurity threats, including those arising from prior incidents, that materially affected our business strategy, results of operations, or financial condition.


text: As a large financial technology provider, we continually face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot guarantee that we will not experience a material cybersecurity incident in the future or that an undetected incident has not already occurred. For further discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.


text: Our Board of Directors has ultimate oversight of risk management and has delegated responsibility for enterprise and operational risks, including cybersecurity, to the Board's Risk and Compliance Committee. This Committee oversees Jack Henry's risk assessment and management programs and reviews risk preparedness. The Audit Committee oversees financial risks and would be informed of any material cybersecurity incident that could potentially have a material impact on our financial statements. The Chief Information Security Officer ("CISO") reports quarterly to the Risk and Compliance Committee and to the full Board of Directors on information security matters. The CISO also meets with the Risk and Compliance Committee at least annually to evaluate our overall security environment and organization.


text: While the Board of Directors, through the Risk and Compliance Committee, maintains oversight of cybersecurity risks, management is primarily responsible for identifying, assessing, and managing these risks within our broader risk management program. The Enterprise Risk Management Committee, composed of senior executives, monitors governance, risk, and compliance enterprise-wide, including cybersecurity. Management has adopted specific policies and procedures to monitor and mitigate cybersecurity threats including an incident response program, led by the CISO and staffed by professionals with diverse expertise. Incidents meeting pre-established thresholds are escalated to management for threat assessment, mitigation, remediation, and, if necessary, disclosure to clients, third-parties, and regulators.


text: Our CISO, who reports to the Chief Operations Officer, has primary responsibility for Jack Henry's information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response. Our CISO brings more than 20 years experience in technology and cybersecurity, including senior leadership roles at major financial institutions. Under the CISO's direction, the information security team continuously monitors cybersecurity trends and implements proactive and defensive measures to protect against cybersecurity threats.


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Management, with the assistance of third party service providers, routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We conduct risk assessments at least annually to identify cybersecurity threats based on the NIST CSF. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: While cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations and could materially adversely affect our business, results of operations and financial condition.


text: Our senior management, including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Co-Chief Operating Officers, are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to provide reasonable assurance that such potential cybersecurity risk exposures are monitored, instituting appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity program is led by our CFO who has experience in cybersecurity risk management from both a practical and management standpoint and utilizes third-party consulting firms on a regular basis to assist with risk mitigation, incident response and overall maintenance of our cybersecurity program.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives updates from the CFO regarding the Company's cybersecurity risk management program at least annually. These include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: The Board of Directors of the Company (the "Board") considers cybersecurity risk as part of its overall risk oversight function. The Board receives updates from the CFO regarding the Company's cybersecurity risk management program at least annually. These include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks Vista's system of internal controls includes consideration of cybersecurity risks. The Company uses technology and control procedures designed to mitigate cybersecurity risks, with our management team working to monitor, identify, assess, and respond to potential cybersecurity incidents that may threaten the Company. The system of controls also focuses on security awareness and training for employees and contractors with access to Company facilities or systems. Company management periodically reviews system and organization control reports (SOC 1, Type 2) for key outsourced information systems to ensure that third-party data processing is subject to appropriate controls and security measures. Cybersecurity risks for Vista include the potential for financial loss, loss of data, and business interruption. Vista maintains technology and non-technology-based system controls, a data backup program, and disaster recovery testing to mitigate these risks.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Our cybersecurity controls also follow defense in depth principles, which aim to implement various layered access control, detection, prevention, and response measures. We periodically engage with third parties to assess our vulnerabilities and help us mitigate cybersecurity-related risks.


text: The Company's chief executive officer ("CEO") and chief financial officer ("CFO") have primary responsible for cybersecurity risk management and the implementation of processes for identifying, assessing, and managing material risks from cybersecurity threats. Officers of the Company and its Australian subsidiary review, at least quarterly, developments relevant to the Company's cybersecurity control environment. This group of officers has experience managing public companies and overseeing internal controls associated with cybersecurity. Additional support for IT general controls and specific cybersecurity matters is provided to the Company through third-party IT specialists. Per the Company's policies, including its Disclosure Policy and Code of Business Conduct and Ethics, cybersecurity incidents are to be immediately reported to the Vista management team for resolution. Information technology general controls, including controls to mitigate cybersecurity risks, are considered by management during their assessment of the Company's design and effectiveness of internal controls over financial reporting. Findings from these control procedures are considered by management and, as deemed appropriate to reduce cybersecurity risks to an appropriately low level, are implemented. This may include modification of internal control procedures, adoption of technology solutions, and testing of specific elements of the system of controls.


text: Board of Director's Oversight of Risks from Cybersecurity Management, under supervision of the Company's CEO and CFO, has developed a system of internal controls that identifies risks to the Company, designed controls intended to reduce risks to an appropriately low level, implemented control procedures, and subsequently tested such control procedures. Management presents an enterprise risk management assessment to the Audit Committee on a quarterly basis and provides the Audit Committee with frequent updates of specific financial statement risks. Risks associated with cybersecurity are included in these risk assessments, subjected to testing of key controls, and reflected in management's reports to the Audit Committee. The full Board of Directors receives periodic briefings on selected risk matters, and is invited to participate in each Audit Committee meeting and, as such, provided with the same information presented to the Audit Committee.


text: No Previous Material Cybersecurity Threats We are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences to the Company. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: The Company's chief executive officer ("CEO") and chief financial officer ("CFO") have primary responsibility for cybersecurity risk management and the implementation of processes for identifying, assessing, and managing material risks from cybersecurity threats. Officers of the Company and its Australian subsidiary review, at least quarterly, developments relevant to the Company's cybersecurity control environment. This group of officers has experience managing public companies and overseeing internal controls associated with cybersecurity. Additional support for information technology ("IT") general controls and specific cybersecurity matters is provided to the Company through third-party IT specialists. In accordance with the Company's policies, including its Disclosure Policy and Code of Business Conduct and Ethics, cybersecurity incidents are to be immediately reported to the Vista management team for resolution. Information technology general controls, including controls to mitigate cybersecurity risks, are considered by management during their assessment of the Company's design and effectiveness of internal controls over financial reporting. Findings from these control procedures are considered by management and, as deemed appropriate to reduce cybersecurity risks to an appropriately low level, are implemented. This may include modification of internal control procedures, adoption of technology solutions, and testing of specific elements of the system of controls.


text: Board of Directors' Oversight of Risks from Cybersecurity Management, under supervision of the CEO and CFO, has developed a system of internal controls that identifies risks to the Company, designed controls intended to reduce risks to an appropriately low level, implemented control procedures, and subsequently tested such control procedures. Management presents an enterprise risk management assessment to the Audit Committee on a quarterly basis and provides the Audit Committee with frequent updates of specific financial statement risks. Risks associated with cybersecurity are included in these risk assessments, subjected to testing of key controls, and reflected in management's reports to the Audit Committee. The Board of Directors receives periodic briefings on selected risk matters, and is invited to participate in each Audit Committee meeting and, as such, is provided with the same information presented to the Audit Committee.


text: No Previous Material Cybersecurity Threats We are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences to the Company. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have established cybersecurity measures, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: ARTIVION, INC.

ticker: AORT


text: Our enterprise risk management framework assesses cybersecurity threats alongside other company risks as part of our overall risk assessment process. This approach involves collaboration between enterprise risk professionals and subject matter experts to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We leverage various tools and services, including network monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to enhance our risk identification and assessment capabilities.


text: Our cybersecurity-specific risk assessment process, benchmarks our practices against standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and includes expert-led penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: To safeguard critical data and systems, ensure regulatory compliance, manage our material risks from cybersecurity threats, and address potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we: • Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate; • Provide periodic, but no less than, annual training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems; • Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources; • Implement regular phishing simulations and processes for reporting phishing to enhance staff awareness and responsiveness; • Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts; • Contract with independent cybersecurity providers to assist with tabletop exercises periodically to refine our response strategies to cybersecurity incidents; • Employ the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and • Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.


text: Our incident response plan outlines our approach to preparing for, detecting, responding to, and recovering from cybersecurity incidents, including severity assessment, containment, investigation, and remediation processes.


text: Our cybersecurity efforts involve regular engagement with external assessors, consultants, and auditors, including periodic reviews by an independent qualified security assessor to identify areas for improvement and ensure compliance, as well as assessments and audits by our insurer and our external auditing firm.


text: We address cybersecurity risks related to third-party service providers by incorporating these risks into our enterprise risk management and cybersecurity-specific risk assessment programs. We conduct thorough due diligence on third parties with access to our systems or data and require them to adhere to specified cybersecurity standards and audits.


text: The potential impact of cybersecurity threats on our business strategy, operations, and financial condition is discussed under specific headings in our risk factor disclosures at Item 1A and in the Management's Discussion and Analysis of Financial Condition and Results of Operations at Item 7 of this Annual Report on Form 10-K.


text: We are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.


text: Cybersecurity is integral to our overall risk management strategy, and an area of increasing focus for our Board and management. The Audit Committee, and where applicable, the entire Board, are involved in overseeing cybersecurity risks. They receive quarterly and bi-annual updates, respectively, from management on our cybersecurity threat risk management and strategy processes. These updates cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and material cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.


text: Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer. Our information technology and cybersecurity team has over 33 years of collective experience in information security and cybersecurity strategy, with various roles in significant organizations. Team members hold numerous degrees and certifications, including certifications as a Certified Information Security Manager, Certified Information Systems Security Professional, Certified Ethical Hacker, Certified Penetration Tester, among others.


text: The global head of Information Technology is part of our operating team and ensures that management is well-informed about preventing, mitigating, detecting, and remediating cybersecurity incidents. This role involves managing our comprehensive cybersecurity risk management and strategy processes and overseeing the operation of our incident response plan.


text: In conclusion, our global head of Information Technology regularly updates the Audit Committee and the Board of Directors on cybersecurity threat risks and related matters, ensuring a proactive and informed approach to managing cybersecurity within our organization.


text: Our cybersecurity-specific risk assessment process benchmarks our practices against standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and includes penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: To safeguard critical data and systems, support regulatory compliance, manage our material risks from cybersecurity threats, and identify, assess and respond to potential cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we: • Monitor emerging data protection laws and adjust our processes and procedures as required or appropriate; • Utilize Endpoint Detection and Response (EDR) tools to help us prevent, detect, and respond to endpoint threats with real-time visibility across our infrastructure and devices, enterprise-wide; • Provide periodic, but no less than annual, training on cybersecurity, data privacy, and data handling to all employees and contractors with access to our systems; • Conduct periodic, but no less than, annual cybersecurity management and incident response training for relevant personnel, utilizing Knowbe4 resources; • Implement regular phishing simulations and processes for reporting phishing events and concerns to enhance staff awareness, vigilance, and responsiveness; • Mandate that both employees and service providers treat sensitive data with utmost care, enforced through policies, practices, and contracts; • Employ elements of the NIST incident handling framework for identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents; and • Maintain cybersecurity risk insurance to mitigate potential financial losses from incidents.


text: Our cybersecurity efforts involve regular engagement with external assessors, consultants, and auditors, including periodic reviews by an independent qualified security assessor to identify areas for improvement and support compliance, as well as assessments and audits by our insurer and our external auditing firm.


text: We address cybersecurity risks related to third-party service providers by incorporating these risks into our enterprise risk management and cybersecurity-specific risk assessment programs. We conduct due diligence on third parties with access to our systems or data and require them to adhere to specified cybersecurity standards and audits.