text: Operationally, we, along with CoreSite, each perform periodic penetration testing to identify weaknesses in systems and networks so that they can be addressed appropriately. At least once per year, we also engage an outside cybersecurity firm to perform independent testing. Our vulnerability management program is in place to adequately identify, classify, prioritize and remediate vulnerabilities affecting assets. Our security operations program monitors our systems and networks, and is responsible for investigating, responding to, and reporting any potential security incidents in a timely manner. Our Incident Response Plan includes steps to determine materiality of any such incident and escalate matters to the Board and our employees are regularly trained on the plan. We conduct an incident response exercise at least annually to ensure a timely, consistent and compliant response. In 2024, we performed an IT-focused tabletop exercise which simulated multiple types of cybersecurity incidents, including (a) compromised credentials, (b) brute force attack, (c) uncleaned malware and (d) ransomware. This tabletop exercise was facilitated by a third-party.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party vendors and service providers. We have in place a Third-Party Cybersecurity Risk Management program to assess the cybersecurity practices of third-party vendors and service providers with access to our and CoreSite's systems or information.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT

secItem: Item 1C


text: We have not been materially impacted by any cybersecurity threats or prior cybersecurity incidents, including with respect to our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks, threats or any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.


text: Our cybersecurity program and policies establish the responsibilities of individuals and committees tasked with oversight of security risk management and provide broad directives that support implementation for identifying, assessing and managing risks from cybersecurity threats. We conduct an annual information security risk assessment which includes a review of the organization's performance of administrative, technical and physical safeguards protecting personal and confidential information. Information security related policies are reviewed on an annual basis and approved by the owners of each functional area.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls. We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity program with industry standards. To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers, potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement. Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts.


text: Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the ISC and the Enterprise Risk Committee ("ERC"). The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer ("CIO"). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is MCSE certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management. The Board of Directors receives regular updates and reports from members of senior management regarding our cybersecurity risks and protection measures, including any notable cybersecurity incidents, and evaluates risks posed by cybersecurity threats.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident which jeopardizes the confidentiality, integrity, or availability of our information and technology infrastructure and systems, we utilize a regularly tested incident response plan. The plan defines an organized approach to dealing with cybersecurity incidents, and identifies roles, responsibilities and escalation protocols. The plan is designed to provide an orderly response to incidents, minimize impact, initiate appropriate communications internally and externally, and identify recommendations to mitigate future incidents.


text: Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the Information Security Council ("ISC"). The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.


text: Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC. In the event of a material cybersecurity incident, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.


text: Cybersecurity Risks As of December 30, 2023, we have not had any material incidences involving cybersecurity attacks. However, we face risks associated with cybersecurity threats. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a cybersecurity incident or disruption as described above, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "Risk Factors–Risks Related to Our Client Relationships–Information, technology systems or service failures, or a cybersecurity attack or other compromise of our or our client's confidential or proprietary information, could have a material adverse effect on our reputation, business and results of operations."


text: We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls. We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity program with industry standards. To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers, potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement. Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts such as questionnaires.


text: Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management, including cybersecurity. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the Information Security Council ("ISC") and the Enterprise Risk Committee ("ERC"). The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer ("CIO"). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management. The Board of Directors receives regular updates and reports from members of senior management regarding our cybersecurity risks and protection measures, including any notable cybersecurity incidents, and evaluates risks posed by cybersecurity threats.


text: Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the ISC. The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.


text: Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC. In the event of a cybersecurity incident that meets certain characteristics as defined in the incident response plan, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.


text: Cybersecurity Risks As of December 28, 2024, we have not had any material incidences involving cybersecurity attacks. However, we previously have faced, and anticipate we will continue to face risks associated with cybersecurity threats. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a cybersecurity incident or disruption as described above, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "Risk Factors–Risks Related to Our Client Relationships–Information, technology systems or service failures, or a cybersecurity incident or other compromise of our or our client's confidential or proprietary information, as well as any violation of data protection laws, could have a material adverse effect on our reputation, business and results of operations."


text: We strive to assess, identify and manage material risks associated with cybersecurity threats. Our information technology (or IT) department, led by our Chief Technology Officer, is responsible for day-to-day management of potential cybersecurity risks. As part of its management of cybersecurity risks, the IT department designs and implements technology projects and conducts regular Security Awareness Training of the Company's employees, which includes simulated cyber threats and phishing exercises. If a cybersecurity threat is identified, the IT department conducts a preliminary investigation and assessment of such risk, and brings the risk to the attention of our Chief Technology Officer. Our Chief Technology Officer then works with our IT Steering Committee, which is comprised of certain members of our executive management, and our legal personnel, to continue the assessment and make the final determination as to the materiality of such risk. Our IT department, management, and necessary or appropriate third parties collaborate with one another in designing and implementing the response and remediation plan with respect to cyber risks.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: We have developed an Information Security Program which is designed to, among other things, protect the confidentiality of our data, protect against threats or hazards to our IT systems, safeguard our data resources in a manner consistent with applicable laws and regulations, contractual obligations and industry standards, and maintain our IT systems to meet our operational needs. The Information Security Program is part of our risk management program, which is overseen by our Audit Committee (and our Board of Directors more generally), receives updates from our Chief Technology Officer on cybersecurity risks and related matters on a quarterly basis and as otherwise as may be needed.


text: We follow industry standards for cyber security risk mitigation, including anti-virus/anti-malware protection, detection and response technologies, intelligent logging and event management, regular penetration testing and remediation. We use our own monitoring and detection, as well as emerging threat intelligence sources, in our efforts to improve protections from threats and improve internal processes based on cyber threats and risks that are impacting other companies. Our security posture is further enhanced through the use of third-party tools and services providing full time monitoring and threat response.


text: Our third party management policy is designed to assess and mitigate potential risk posed by vendors and outside service providers. An initial risk assessment is performed to evaluate multiple aspects of a relationship such as impact to cybersecurity, access to our systems and data, and criticality of the relationship to our day-to-day operations. The program defines oversight requirements based on the results of the risk assessment. Critical vendors and service providers are reviewed annually and as otherwise as may be needed.


text: To date, we have not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company or its business strategy, results of operations or financial position; however, we have faced and continue to face a number of cybersecurity risks in connection with our business. We continue to invest in the cybersecurity and resiliency of our IT systems and to work to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. "Risk Factors – Cybersecurity Risks."


text: Our Board of Directors is responsible for our cyber risk oversight, as part of our risk management framework. Our management, primarily through our Chief Technology Officer, provides updates to the Board on a quarterly basis and otherwise as may be needed regarding material matters with respect to cyber risk assessment and overall status regarding our IT systems and controls, including cybersecurity threats during the previous quarter and risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations. Our management also coordinates with our IT department to help ensure that cyber risks are integrated into our overall risk identification, management and mitigation strategies, subject to our Board's guidance. As described above, our Chief Technology Officer works with our IT Steering Committee and other members of senior management, including our staff, in assessing the materiality of a cyber risk after a preliminary assessment by our IT department. If a cyber risk is material, our Chief Technology Officer will bring such risk to our Board's attention.


text: Our Chief Technology Officer has served in various roles in IT and information security for over 20 years. In addition, members of the IT department involved in Information Security have an average of 15 years of experience in cybersecurity as well as relevant educational experience.


text: The operating systems of Federated Hermes, and its offerings, customers, shareholders, and service providers are dependent on the effectiveness of information security policies and procedures (both at Federated Hermes and at third parties, such as its service providers) which seek to ensure that such systems are protected from cybersecurity incidents. Federated Hermes has established a robust cybersecurity program aimed at assessing, identifying and managing material risks from cybersecurity threats.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Federated Hermes' board of directors has ultimate oversight responsibility for cybersecurity risks and threats. Federated Hermes' Audit Committee assists its board of directors in monitoring cybersecurity risks and threats. Federated Hermes' board of directors and Audit Committee receive reports on cybersecurity matters on a periodic (generally quarterly) basis (and more frequently when circumstances warrant) as part of risk management oversight responsibilities. For instance, in 2023, Federated Hermes' Chief Information Officer (CIO) reported to Federated Hermes' board of directors one time and its Audit Committee three times regarding cybersecurity risks and threats. The Audit Committee also receives reports from Federated Hermes' internal auditors, legal counsel and other responsible officers regarding cybersecurity topics and trends. The Federated Hermes Chief Risk Officer (CRO) also reports directly to the Compliance Committee of Federated Hermes' board of directors on a quarterly basis and Federated Hermes' full board of directors as appropriate on significant enterprise risks, including cybersecurity risks.


text: Federated Hermes' Global Technology Organization (GTO), which is headed by Federated Hermes' CIO, has a dedicated Information Security Group (ISG) responsible for day-to-day oversight of the cybersecurity program. The ISG, which is headed by Federated Hermes' Chief Information Security Officer (CISO), coordinates cybersecurity activities with Federated Hermes' business functions and third-party service providers. The ISG also oversees and coordinates cybersecurity efforts with counterparts at FHL. Federated Hermes' Information Security and Data Governance Committee (ISDG) provides executive management oversight of the ISG and Federated Hermes' cybersecurity program. Federated Hermes' Chief Compliance Officer (CCO), CRO and General Counsel, as well as Federated Hermes' CIO, CISO, Chief Financial Officer, and other senior members of Federated Hermes' management, are members of, and Federated Hermes' Chief Audit Executive attends meetings of, the ISDG.


text: The ISDG's primary functions are to: (1) serve as a governing body to support Federated Hermes' cybersecurity, information security and data governance practices and efforts; (2) address cybersecurity and information security matters and data governance matters critical to Federated Hermes, including risks; (3) oversee written policies and procedures reasonably designed to (a) comply with applicable legal requirements, and (b) maintain appropriate cybersecurity, information security and data governance practices; (4) promote evaluation of Federated Hermes' strategies for cybersecurity, information security and data governance against industry practices and applicable regulatory requirements and guidance; and (5) serve as a liaison for discussions concerning cybersecurity, information security and data governance with various Federated Hermes committees or governing bodies, management, and Federated Hermes' board of directors. The ISDG receives updates quarterly on relevant cybersecurity and data governance matters, such as recent cybersecurity matters, phishing test results, cybersecurity training, GTO and ISG staffing, FHL's cybersecurity program, regulatory developments, and enterprise data governance and strategy.


text: Federated Hermes' Enterprise-Wide Risk Management Committee (ERC), which is chaired by Federated Hermes' CRO, oversees Federated Hermes' company-wide enterprise risk management program. The ERC includes department heads from across Federated Hermes and implements the processes established to identify, report and monitor material risks facing the Company, including cybersecurity risks.


text: Federated Hermes maintains a written cybersecurity program protocol, along with ancillary policies and procedures, which set forth the key features of the cybersecurity program. These policies and procedures strive to reflect what Federated Hermes believes are best practices for assessing, identifying and managing cybersecurity risks and are reviewed and updated on a regular basis.


text: Under Federated Hermes' cybersecurity program, Federated Hermes conducts regular threat identification and assessment exercises. Some of these exercises involve the use of third-party cybersecurity experts, who assist with, among other things, system penetration testing and system design. Information gained from such exercises is used to develop and refine protective and detective strategies and tactics. Federated Hermes' information systems and assets are also monitored to identify cybersecurity incidents and verify the effectiveness of existing protective measures. New protective measures are deployed from time to time as threats evolve. Some of the measures employed by Federated Hermes to mitigate cybersecurity risk include, among others, use of firewalls, system segmentation, system monitoring, virus scanning, and periodic penetration and phishing testing. Federated Hermes' cybersecurity program also includes a detailed incident response plan for responding to cybersecurity threats. Federated Hermes' cybersecurity program also requires periodic training of employees on cybersecurity threats, including phishing, and cybersecurity awareness campaigns.


text: Federated Hermes' third-party service providers are a potential source of cybersecurity threats. Among other service provider management efforts, Federated Hermes conducts due diligence on key service providers relating to cybersecurity. Due diligence consists of reviewing several key data points regarding service providers. These include, but are not limited to, the business processes the service provider will provide, the sensitivity of the data they will store, process, transmit or access, and network connectivity with the service provider. Using this criteria, Federated Hermes will categorize the service provider into a tiered structure. The tiering defines the requirements for conducting the initial and ongoing due diligence.


text: Federated Hermes' CIO has nearly 30 years of technology experience. Prior to assuming his current role in 2016, Federated Hermes' CIO served in senior technology roles with a large U.S. financial institution for over a decade where he, among other things, served as chief information officer for the asset management and investments businesses and gained deep experience managing cybersecurity risks and threats. He holds a Bachelor of Science (BS) in Electrical Engineering from the University of Pittsburgh, a Master of Science (MS) in Engineering from Youngstown State University, and a Master of Business Administration (MBA) from Carnegie Mellon University.


text: Federated Hermes' CISO has nearly 20 years of technology experience, including deep experience in cybersecurity risk management. Prior to assuming his current role in 2020, Federated Hermes' CISO served as information security officer and director of technology for a large publicly traded travel center company and, prior to that, as information security officer for a leading retail chain. He holds a BS in Accounting and Finance and an MBA from Robert Morris University.


text: As of December 31, 2023, cybersecurity incidents and threats have not had a material adverse effect on Federated Hermes' Financial Condition. See Item 1A - Risk Factors - General Risk Factors - Operations-Related Risks - Systems, Technology and Cybersecurity Risks for additional information regarding the cybersecurity risks to Federated Hermes' business, offerings, customers, shareholders, and service providers.


text: The operating systems of Federated Hermes, and its offerings, customers, shareholders and service providers are dependent on the effectiveness of information security policies and procedures (both at Federated Hermes and at third parties, such as its service providers) which seek to ensure that such systems are protected from cybersecurity incidents. Federated Hermes has established a robust cybersecurity program aimed at assessing, identifying and managing material risks from cybersecurity threats.


text: Federated Hermes' board of directors has ultimate oversight responsibility for cybersecurity risks and threats. Federated Hermes' Audit Committee assists its board of directors in monitoring cybersecurity risks and threats. Federated Hermes' board of directors and Audit Committee receive reports on cybersecurity matters on a periodic (generally quarterly) basis (and more frequently when circumstances warrant) as part of risk management oversight responsibilities. For instance, in 2024, Federated Hermes' Chief Information Officer (CIO) reported to Federated Hermes' board of directors one time and its Audit Committee three times regarding cybersecurity risks and threats. The Audit Committee also receives reports from Federated Hermes' internal auditors, legal counsel and other responsible officers regarding cybersecurity topics and trends. The Federated Hermes Chief Risk Officer (CRO) also reports directly to the Compliance Committee of Federated Hermes' board of directors on a quarterly basis and Federated Hermes' full board of directors as appropriate on significant enterprise risks, including cybersecurity risks.


text: Federated Hermes' Global Technology Organization (GTO), which is headed by Federated Hermes' CIO, has a dedicated Information Security Group (ISG) responsible for day-to-day oversight of the cybersecurity program. The ISG, which is headed by Federated Hermes' Chief Information Security Officer (CISO), coordinates cybersecurity activities with Federated Hermes' business functions (including FHL) and third-party service providers. Federated Hermes' Information Security and Data Governance Committee (ISDG) provides executive management oversight of the ISG and Federated Hermes' cybersecurity program. Federated Hermes' Chief Compliance Officer (CCO), CRO and General Counsel, as well as Federated Hermes' CIO, CISO, Chief Financial Officer, and other senior members of Federated Hermes' management, and the Global Head of Investment Technology at FHL are members of, and Federated Hermes' Chief Audit Executive attends meetings of, the ISDG.


text: Under Federated Hermes' cybersecurity program, Federated Hermes conducts regular threat identification and assessment exercises. Some of these exercises involve the use of third-party cybersecurity experts, who assist with, among other things, system penetration testing and system design. Information gained from such exercises is used to develop and refine protective and detective strategies and tactics. Federated Hermes' information systems and assets are also monitored to identify cybersecurity incidents and verify the effectiveness of existing protective measures. New protective measures are deployed from time to time as threats evolve. Some of the measures employed by Federated Hermes to mitigate cybersecurity risk include, among others, use of firewalls, system segmentation, system monitoring, virus scanning, and periodic penetration and phishing testing. Federated Hermes' cybersecurity program also includes a detailed incident response plan for responding to cybersecurity threats. Federated Hermes' cybersecurity program also requires periodic training of employees on cybersecurity threats, including phishing and cybersecurity awareness campaigns.


text: Federated Hermes' CIO has more than 30 years of technology experience. Prior to assuming his current role in 2016, Federated Hermes' CIO served in senior technology roles with a large U.S. financial institution for over a decade where he, among other things, served as chief information officer for the asset management and investments businesses and gained deep experience managing cybersecurity risks and threats. He holds a Bachelor of Science (BS) in Electrical Engineering from the University of Pittsburgh, a Master of Science (MS) in Engineering from Youngstown State University, and a Master of Business Administration (MBA) from Carnegie Mellon University.


text: Federated Hermes' CISO has 20 years of technology experience, including deep experience in cybersecurity risk management. Prior to assuming his current role in 2020, Federated Hermes' CISO served as information security officer and director of technology for a large publicly traded travel center company and, prior to that, as information security officer for a leading retail chain. He holds a BS in Accounting and Finance and an MBA from Robert Morris University.


text: As of December 31, 2024, cybersecurity incidents and threats have not had a material adverse effect on Federated Hermes' Financial Condition. See Item 1A – Risk Factors – General Risk Factors – Operations-Related Risks – Systems, Technology and Cybersecurity Risks for additional information regarding the cybersecurity risks to Federated Hermes' business, offerings, customers, shareholders and service providers.


text: Our cybersecurity program is integrated into our overall risk management systems, including our annual enterprise risk management program, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. We have implemented and maintain comprehensive processes designed to manage and mitigate material cybersecurity threats to ensure that the company operates in a protected, compliant environment.

companyName: MANNATECH INC

ticker: MTEX


text: Management Oversight Our cybersecurity governance program is led by the Senior Director of IT Operations. The Senior Director of IT Operations and members of our internal IT team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Specifically, management analyzes the following: a.effectiveness of (i) the Company's overall cybersecurity risk management, (ii) management's procedures for identifying, measuring, and reporting on cybersecurity risk, and (iii) the incorporation of cybersecurity risk considerations into corporate strategy; b.the Company's cybersecurity risk profile and risk tolerance;


text: c.significant policies, programs and plan documents related to the management of cybersecurity risk and proposed changes to any of such documents; d.the Company's controls to prevent, detect and respond to cyberattacks or information or data breaches;


text: e.reports from senior management and/or appropriate external subject matter experts related to the monitoring and analysis of the Company's current threat environment, vulnerability assessments related to cybersecurity risk management, and existing and expected future trends related to cybersecurity relevant to the organization; f.the Company's cyber-resiliency, including cybersecurity crisis preparedness, incident response plans, communication plans, and disaster recovery capabilities;


text: g.the capabilities and qualifications of the Company's cyber and data privacy personnel; and h.the Company's cybersecurity strategy, related priorities and objectives, and the appropriateness of the resources allocated thereto, including, but not limited to, investments in cybersecurity infrastructure.


text: Our Senior Director of IT Operations oversees a team of analysts and operations support personnel and has extensive experience with the company's applications and infrastructure. Our senior director reports to our President and Chief Operating Officer, who then communicates directly with the Nominating/Governance and Compliance Committee and the Board.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include (i) maintenance and monitoring of information security policies aligned with global regulatory controls; (ii) user and employee awareness of cyber policies and practices; (iii) information systems configuration management; (iv) third-party risk management systems; (v) identity and information asset protection; (vi) infrastructure security systems; and (vii) cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also engage a range of third-party experts in connection with various development, implementation, and maintenance activities related to our cybersecurity program. We have integrated cybersecurity risk into our disclosure controls and procedures.


text: As of the date of this report, management is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See "Item 1A. Risk Factors – Risks Affecting Our Business and Industry – If our information technology system fails or if the implementation of new information technology systems is not executed efficiently and effectively, our business, financial position, and operating results could be adversely affected" of this Annual Report on Form 10-K.


text: Our Board of Directors engages in the assessment, oversight, and management of materials risks that could affect the company. The board has delegated to the Nominating/Governance and Compliance Committee the oversight responsibility for our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. This oversight includes compliance with disclosure obligations and requirements, cooperation with law enforcement, and related effects on financial risks and is responsible for reporting its findings and recommendations to the full board for its consideration. Our IT operations team and other members of management discuss cyber risks and trends, and if they arise, any material incidents with senior executives and the Nominating/Governance and Compliance Committee.


text: Our Senior Director of IT Operations oversees a team of analysts and operations support personnel and has extensive experience with the company's applications and infrastructure. Our senior director reports to the Senior Vice President of Global Operations, who communicates to the President and CEO who then communicates directly with the Nominating/Governance and Compliance Committee and the Board.


text: Our Board of Directors engages in the assessment, oversight, and management of material risks that could affect the company. The board has delegated to the Nominating/Governance and Compliance Committee the oversight responsibility for our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. This oversight includes compliance with disclosure obligations and requirements, cooperation with law enforcement, and related effects on financial risks and is responsible for reporting its findings and recommendations to the full board for its consideration. Our IT operations team and other members of management discuss cyber risks and trends, and if they arise, any material incidents with senior executives and the Nominating/Governance and Compliance Committee.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, we engage a third-party vendor regularly to benchmark our information security program's maturity against the NIST CSF.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: a. Internal and external asset identification, assessment, monitoring and classification procedures to evaluate cybersecurity risks and inform mitigation efforts.


text: b. A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our cyber processes, and (3) our cyber threat and incident response;


text: c. The use of external service providers, where appropriate, to assess defenses, analyze threat intelligence, or otherwise assist with aspects of our security controls; d. Cybersecurity awareness training of our employees, software development teams, incident response personnel, and senior management;


text: e. A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and regular tabletop exercises to assess our response readiness; and f. A third-party risk management process for key service providers, suppliers, and vendors who access critical systems and data based on risk profile.


text: We have not identified material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition." and "Technical problems or disruptions that affect either our customers' ability to access our services, or the software, internal applications, database and network systems underlying our services, could damage our reputation and lead to reduced demand for our information, analytics and online marketplace services, lower revenues and increased costs."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team is informed and monitors the prevention, detection, mitigation and remediation of cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-recognized certifications, such as CISSP, CISM, and CISA, decades of experience as part of our IT team, and previous cybersecurity leadership positions at various Fortune 500 companies and U.S. Defense contractors.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: a. Internal and external asset identification, assessment, monitoring, and classification procedures to evaluate cybersecurity risks and inform mitigation efforts;


text: We have not identified material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "Cyberattacks and security vulnerabilities could result in material harm to our reputation, business, and financial condition." and "Technical problems or disruptions that affect either our customers' ability to access our services, or the software, internal applications, database, and network systems underlying our services, could damage our reputation and lead to reduced demand for our online marketplace services, information, and analytics, lower revenues and increase costs."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Technology Officer (CTO) is responsible for oversight of our cybersecurity risk management program. Our Vice President of Cyber Security (VPCS), who reports up to the CTO, is responsible for day-to-day assessment and management of cybersecurity risk.


text: Our Audit Committee receives reports from the CTO on our cybersecurity risks. In addition, the CTO updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team is informed and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CTO has over 25 years of information technology experience, including leadership experience managing global product development, information security, IT infrastructure and engineering. He holds a M.S. in information systems from George Washington University and a B.A. in computer science from State University of New York. The VPCS has over 20 years of information security and technology experience, including 10 years in senior leadership roles in service provider, enterprise, and military environments. He holds an MBA from Georgetown University, a M.S. in information systems from Virginia Tech University, and a B.S. in computer information technology from Purdue University. Additionally, our management team's experience includes industry-recognized certifications, such as CISSP, CISM, and CISA, decades of experience as part of our IT team, and previous cybersecurity leadership positions at various Fortune 500 companies and U.S. Defense contractors.


text: The CTO and VPCS are informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Corporation recognizes the significance of cybersecurity in the financial industry and the potential risks associated, such as the the loss of confidentiality, information systems. ("ERM") ("CISP"). Officer. Chief Information Security Officer ("CISO"). Cybersecurity Framework. implementation of security safeguards across the its subsidiaries.

companyName: FIRST BANCORP /PR/

ticker: FBP


text: Assessing, identifying, managing, and mitigating risks from cybersecurity threats that may affect Idaho Power's systems and service are essential to its business. IDACORP's and Idaho Power's board of directors oversees risks from cybersecurity threats through the audit committee and the executive committee. The audit committee assists the board in the oversight of Idaho Power's major cybersecurity risk exposures, including oversight of management's information security activities. Those activities include briefing the audit committee and the board on information security matters several times a year in their regular meetings and on an ad hoc basis, conducting an annual security training program, and arranging for external security assessments. Together with the audit committee, the board's executive committee assists the board in monitoring management's risk management framework for cybersecurity on a regular basis.

companyName: IDACORP INC

ticker: IDA


text: IDACORP and Idaho Power include risks from cybersecurity threats, including from use of third-party service providers, as part of the companies' enterprise risk assessment process. The companies have utilized and continue to utilize recognized third-party cybersecurity standards such as those published by the Center for Internet Security and the U.S. National Institute of Standards and Technology in developing their risk management framework for cybersecurity, their cybersecurity processes, controls, and procedures, and risk identification. The companies engage with consultants and other third parties as necessary to design, enhance, and implement appropriate cybersecurity measures in seeking to mitigate risks from cybersecurity threats. As part of the companies' strategy to manage risks from cybersecurity threats with third-party service providers, the companies seek to include appropriate security clauses in their contracts with those providers, including incident reporting requirements.


text: A dedicated cybersecurity team lead by a cybersecurity manager oversees the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power. The cybersecurity manager reports to Idaho Power's corporate security senior manager. The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.


text: The cybersecurity team monitors and reviews threat intelligence feeds from various sources, including security vendors and U.S. federal and state agencies, to determine potential risks to the companies' information and control systems. Additionally, the team utilizes a defense-in-depth approach to cybersecurity that provides layers of defenses and monitoring/alerting to which the team responds. The team also monitors the companies' third-party service providers for risks related to the confidentiality, availability, and integrity of the companies' data and services hosted through those third parties.


text: The companies have an established cybersecurity incident response plan to provide structure and guidance when responding to cybersecurity incidents. In appropriate cases, an incident response team is activated to lead the companies' response. The team is composed of individuals from the cybersecurity team and other departments within the companies with relevant expertise, as well as third-party contractors and vendors.


text: As of the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition. However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect the companies, including their business strategy, results of operations, or financial condition. For more information regarding the risks the companies face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: A dedicated cybersecurity team lead by a cybersecurity manager and director of security oversee the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power. The cybersecurity manager reports to Idaho Power's director of security. The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.


text: Utilities are the operators of critical infrastructure and maintain sensitive information, and as such the industry has been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems and confidential information to disrupt operations or for monetary gain. Idaho Power, like other entities in the utility industry, is experiencing an increase in the frequency and sophistication of these attempts. For the year ended December 31, 2024, and the subsequent period to the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition. However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that any such threat or incident will not materially affect the companies, including their business strategy, results of operations, or financial condition. For more information regarding the risks the companies face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Information Security Officer ("CISO") and our Chief Customer and Technology Officer ("CCTO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We also are a member of an industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: We assess Chipotle's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to periodically perform internal and external penetration testing of Chipotle's information security environment and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform Chipotle during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), Chipotle has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Chipotle (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report.


text: Our cybersecurity risk management and strategy processes are led by our CISO and our CCTO. These individuals have collectively over 50 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors (the "Board") and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit and Risk Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee regularly reviews with and discusses cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape with our CISO and CCTO. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives an annual report and quarterly written updates regarding our cybersecurity program.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework that has been established by the enterprise risk management team.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents and informs designated members of executive leadership and of the Board of Directors of material cybersecurity threats and incidents.


text: Cognizant's cyber risk management program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.


text: We require our vendors to comply with privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We include data protection and security content as part of annual training required of employees.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In 2020, we experienced a previously-disclosed cybersecurity incident that resulted in unauthorized access to certain data and caused significant disruptions to our business operations. In response, we engaged leading outside forensics and cybersecurity experts, launched a comprehensive containment and remediation effort and forensic investigation, restored the security of our internal systems and networks and adopted various enhancements to the security of our systems and networks.


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee previously utilized an IT Cybersecurity Subcommittee, comprised of members of the Audit Committee, to assist in carrying out a portion of these responsibilities. In December 2023, the Audit Committee transitioned away from use of the subcommittee structure. At all times, the full Audit Committee has maintained and continues to maintain oversight responsibility for cybersecurity risk management.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.


text: Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, General Counsel, Chief Corporate Affairs Officer and Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement, and govern security policies, standards, and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework established by the enterprise risk management team.


text: Cognizant's cybersecurity risk management program is guided by industry-recognized security frameworks, including ISO/IEC 27001, TISAX and NIST. The program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For further discussion of the cybersecurity risks and threats we face, please see Item 1A. "Risk Factors".


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, Chief Legal Officer, Chief Administrative Officer and Corporate Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement and govern security policies, standards and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.


text: The Company has an integrated, cross-organizational risk management approach. As part of our overall risk management processes, we assess, identify and manage material risks from cybersecurity threats through our cybersecurity risk management program which leverages the National Institute of Standards and Technology (NIST) framework, organizing cybersecurity risks into five categories: identify, protect, detect, respond and recover. However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we leveraged the NIST framework as a guide in the creation of our cybersecurity risk management program. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our Chief Technology Officer and security team, led by the SVP of Information Technology and Security, (collectively, the "Cumulus Security Team") monitor cybersecurity incidents using a variety of security information and event management tools. Alerts from those tools are monitored 24/7 and addressed accordingly. The type of incident identified and severity level determine how issues are escalated and who is engaged for resolution. If a cybersecurity incident or aggregated series of incidents is deemed material, the incident is communicated to various members of the Company's leadership team and the Board of Directors. Disaster recovery plans are documented for key systems and would be followed in the event a security incident occurs.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: The Company's cybersecurity risk management program includes ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes various incident event management tools to monitor unauthorized account access, data exfilitration and server and network security. Multi-factor authentication and complex password requirements are enabled on all key systems and privileged account holders have separate administrative accounts. The Company engages consultants from time to time with expertise in network vulnerabilities to perform periodic network penetration testing.


text: The Company's cyber risk management program also includes regular security awareness training to educate employees and new hires on the Company's cybersecurity policies, standards and practices. This training is supplemented by Company-wide testing initiatives, including periodic phishing tests. The Company provides specialized security training for certain employee roles such as application developers and privileged account holders. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The Company utilizes an external risk management tool to assist with oversight and monitoring of third-party cybersecurity risk. Each third-party service provider is vetted, evaluated and scored based on its cybersecurity methodology. For many vendors of third-party hosted applications, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports to support our assessment of our vendors' security practices. If a third-party vendor was not able to provide the requested reports, we would take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We have experienced targeted cybersecurity threats and incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. To date, no cybersecurity incident, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A "Risk Factors".


text: Our Board of Directors (our "Board") is responsible for risk oversight, and may delegate specific areas of oversight to committees of the Board, which report to the full Board. The Audit Committee of the Board in turn is specifically charged with reviewing cybersecurity risk management and the steps management takes to monitor, control and mitigate such risks. In connection with such review, the Audit Committee receives quarterly reports from the Chief Technology Officer on, among other things, the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In addition to the quarterly reports, the Audit Committee performs an annual review of the Company's cybersecurity program. The annual review consists of a summary of all systems, processes and staffing in place to mitigate a cybersecurity incident using the NIST framework as a guideline.


text: Our Chief Technology Officer manages and monitors the Company's cybersecurity risk and has over 40 years of experience in the technology field. The Cumulus Security Team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes.


text: The Company has an integrated, cross-organizational risk management approach. As part of our overall risk management processes, we assess, identify and manage material risks from cybersecurity threats through our cybersecurity risk management program which leverages the National Institute of Standards and Technology ("NIST") framework, organizing cybersecurity risks into six categories: govern, identify, protect, detect, respond and recover. However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we leveraged the NIST framework as a guide in the creation of our cybersecurity risk management program. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our Chief Technology Officer, together with our SVP of Information Technology and Security, are responsible for leading, managing, and monitoring the Company's cybersecurity risk with the assistance of our security team (collectively, the "Cumulus Security Team") who monitors cybersecurity incidents using a variety of security information and event management tools. Alerts from those tools are monitored 24/7 and addressed accordingly. The type of incident identified and severity level determine how issues are escalated and who is engaged for resolution pursuant to the Company's internal incident response plan. If a cybersecurity incident or aggregated series of incidents is deemed material, the incident is communicated to various members of the Company's leadership team and the Board of Directors. Disaster recovery and incident response plans are documented for key systems and would be followed in the event a cybersecurity incident occurs.


text: The Company's cyber risk management program also includes regular security awareness training to educate employees and new hires on the Company's cybersecurity policies, standards and practices. This training is supplemented by Company-wide testing initiatives, including periodic phishing tests. The Company provides specialized security training for certain employee roles such as application developers and privileged account holders. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers, who may be system vendors or data processors. The Company utilizes an external risk management tool to assist with oversight and monitoring of third-party cybersecurity risk. Each third-party service provider is vetted, evaluated and scored based on its cybersecurity methodology. For many vendors of third-party hosted applications, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports to support our assessment of our vendors' security practices. If a third-party vendor was not able to provide the requested reports, we would take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: We have experienced targeted cybersecurity threats and incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. To date, no cybersecurity incident, or any risk from cybersecurity threats has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions, failures or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A "Risk Factors".


text: Our Board is responsible for risk oversight, and may delegate specific areas of oversight to committees of the Board, which report to the full Board. The Audit Committee of the Board in turn is specifically charged with reviewing cybersecurity risk management and the steps management takes to monitor, control and mitigate such risks. In connection with such review, the Audit Committee receives quarterly reports from the Chief Technology Officer on, among other things, the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In addition to the quarterly reports, the Audit Committee performs an annual review of the Company's cybersecurity program. The annual review consists of a summary of all systems, processes and staffing in place to mitigate a cybersecurity incident using the NIST framework as a guideline.


text: Our Chief Technology Officer, together with our SVP of Information Technology and Security, leads, manages and monitors the Company's cybersecurity risk and has over 40 years of experience in the technology field. The SVP of Information Technology and Security has over 30 years of experience in the IT and information security field and directs our Cumulus Security Team, which is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes.


text: The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company's information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2023, the Company's internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.

companyName: MOODYS CORP /DE/

ticker: MCO


text: The Cyber Committee, chaired by the CISO, and whose members include the CTSO and CAO, as well as other members of senior management and the legal team, is responsible for identifying cybersecurity risks and threats, recommending mitigating actions to strengthen cybersecurity resilience, and meeting risk tolerance thresholds established by senior management. The Cyber


text: MOODY'S 2023 10-K 35 Committee also validates that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the executive leadership team and the Board of Directors. The Cyber Committee meets regularly to allow members of the internal cybersecurity team to present concerns and recommendations for decisions on preventing, identifying, mitigating, and remediating risks and threats. To the extent warranted, the Cyber Committee may additionally be convened on an ad hoc basis. The Cyber Committee makes decisions regarding the reporting of cybersecurity concerns to the executive leadership team, who escalate issues to the Board and/or the Audit Committee as necessary. In the case of incidents that arise, the Cyber Committee, under the direction of the Board and/or executive leadership team when appropriate, works to involve all appropriate personnel with the aim of resolving the incident, performing any required remediation/reporting, and taking appropriate steps to comply with applicable laws and regulations. The process that the Cyber Committee follows upon emergence of incidents is documented in the Company's Incident Response Plan. Additionally, cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board.


text: The CISO has extensive cybersecurity knowledge and skills, gained from over 20 years' experience working in regulated industries. The CISO holds a number of cybersecurity related certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager. In addition to the CISO, the CTSO has been a close partner and advocate for cybersecurity at the Company, and is consulted or informed on all decisions or risks that affect the Company's technology systems and/or implicate cybersecurity. The CAO is responsible for overseeing the cybersecurity team at the executive leadership level.


text: The Board provides oversight of management's efforts to assess and manage cybersecurity risks and respond to cybersecurity incidents and threats. In addition, the Audit Committee of the Board of Directors regularly receives reports from management regarding the Company's financial and compliance risks, including, but not limited to, risks relating to internal controls and cybersecurity risks.


text: The Board receives regular updates from the CISO, CTSO, and CAO regarding matters related to technology and cybersecurity. The Company has protocols, as discussed below, by which certain cybersecurity concerns, incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board.


text: The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with the head of the Company's ERM program sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company's ERM group integrated into the Company's Incident Response Plan.


text: As part of the cybersecurity program, the Company's cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company's Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company's network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee and the Audit Committee.


text: The Company's cybersecurity environment is also subject to routine vulnerability assessment processes. Internal and external teams, including the Cyber Committee, conduct activities such as penetration testing, red teaming, tabletop exercises and phishing drills. Results are measured and assessed for possible improvements. In addition to these ongoing efforts, the Company has a set of third-party risk management tools through which it monitors for cybersecurity risks and threats associated with its third-party service providers. The Incident Response Plan includes processes that define how the Company manages and responds to such risks or threats associated with its third-party service providers.


text: The Company contracts with reputable third parties to conduct annual external assessments of its cybersecurity program and its components. Government agencies and their contracted agents also conduct periodic reviews in certain jurisdictions where the Company operates. Insurance agents, customers and other market participants routinely assess the Company's security posture relative to their own standards.


text: The Company has an Information Security Policy and Information Security Standards, which, taken together, describe the standards and minimum requirements that are expected of all business and information security personnel to protect the Company's information and technology assets. The policy provides a framework guided by security principles designed to address the confidentiality, integrity and availability of the Company's information assets in the context of internal, external, deliberate and accidental threats, while supporting the Company's information creation and sharing needs.


text: The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The


text: 36 MOODY'S 2023 10-K Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody's Analytics obtains third-party audits in connection with ISO 27001 and SOC 2 certification and attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.


text: The Company's cybersecurity program also includes an information security training and awareness program called InfoSafe for all employees. The program includes annual certification to having read and understood the Company's IT Use Policy, continuing education on phishing awareness, regular communications about cybersecurity best practices, and participation in annual events like Cybersecurity Awareness Month. Employees are expected to complete annual cybersecurity training, and compliance is monitored. The Company uses general and targeted phishing simulations to help employees better recognize and respond to potential threats. The training program is further enhanced by cybersecurity experts speaking at educational events. The Company also offers specialized training modules on emerging cybersecurity threats for its software development teams. The Company's IT Use Policy outlines a detailed escalation process under which employees are to immediately report any suspected cybersecurity incident.


text: The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of talent recruitment and retention, as well as procuring and deploying the correct tools to address threats. Additional information on cybersecurity risks is discussed in Item 1A of Part I, "Risk Factors," under the heading "Technology Risks," which should be read in conjunction with the foregoing information.


text: The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company's information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2024, the Company's internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.


text: The Cyber Committee, chaired by the CISO, and whose members include the CTSO, CAO and Chief Risk & Resiliency Officer, as well as other members of senior management and the legal team, is responsible for identifying cybersecurity risks and threats, recommending mitigating actions to strengthen cybersecurity resilience, and meeting risk tolerance thresholds established by senior management. The Cyber Committee also validates that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the executive leadership team and the Board of Directors. The Cyber Committee meets regularly to allow members of the internal cybersecurity team to present concerns and recommendations for decisions on preventing, identifying, mitigating, and remediating risks and threats. To the extent warranted, the Cyber Committee may additionally be convened on an ad hoc basis. The Cyber Committee makes decisions regarding the reporting of cybersecurity concerns to the executive leadership team, who escalate issues to the Board and/or the Audit Committee as necessary. In the case of incidents that arise, the Cyber Committee, under the direction of the Board and/or executive leadership team when appropriate, works to involve all appropriate personnel with the aim of resolving the incident, performing any required remediation/reporting, and taking appropriate steps to comply with applicable laws and regulations. The process that the Cyber Committee follows upon emergence of incidents is documented in the Company's Incident Response Plan. Additionally, cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by the Board.


text: The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with the head of the Company's ERM program (the Chief Risk & Resiliency Officer) sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company's ERM group integrated into the Company's Incident Response Plan.


text: As part of the cybersecurity program, the Company's cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company's Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company's network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee.


text: The Company is subject to various privacy laws in the jurisdictions where it operates including CCPA and GDPR, as well as U.S. Federal regulation by the FTC, for certain privacy-related aspects of its business, and the Sarbanes-Oxley Act of 2002. The Company is audited in connection with requirements set forth in the Sarbanes-Oxley Act of 2002, and Moody's Analytics obtains third-party audits in connection with the ISO 27001 certification and SOC 1 and SOC 2 attestation reports, respectively, for certain products. As previously mentioned, the Company also aligns with NIST standards in connection with information security, which it uses to evaluate its cybersecurity readiness and resilience, and is required to make various filings and comply with requirements in certain jurisdictions in which it operates.


text: Republic's technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Cybersecurity organization, led by our Chief Information Security Officer (CISO), is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CISO has over 20 years of information technology, information technology audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our Cybersecurity organization proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: a. A formal enterprise-wide cybersecurity policy and related standards; b. Cybersecurity training and employee phishing simulations; c. Scheduled and ad hoc internal and external penetration tests; d. Cyber incident response, IT disaster recovery, and business continuity plans; e. Cybersecurity assessments and remediation planning as part of our M&A due diligence process; f. Identity and access management controls;


text: g. Third-party risk assessment and management for vendors and third-party service providers; and h. Cyber incident tabletop exercises for our Board of Directors and management.