the nature, sensitivity and location of information that the firm collects, processes or stores, and the technology systems it uses;

internal and external cybersecurity threats to, and vulnerabilities of, the firm's information and technology systems;

security controls and processes currently in place;

the impact should the information or technology systems become compromised; and

the effectiveness of the governance structure for the management of cybersecurity risk.

controlling access to various systems and data via management of user credentials, authentication and authorization methods, firewalls or perimeter defenses, tiered access to sensitive information and network resources, network segregation and system hardening;

data encryption;

protecting against the loss or exfiltration of sensitive data by restricting the use of removable storage media and deploying software that monitors technology systems for unauthorized intrusions, the loss or exfiltration of sensitive data, or other unusual events;

monitoring for ongoing and new cyber threats by gathering information from outside resources, such as vendors, third-party contractors specializing in cybersecurity and technical standards, and topic-specific publications and conferences, as well as participating in the Financial Services - Information Sharing and Analysis Center (FS-ISAC);

data backup and retrieval; and

developing an incident response plan.

provide guidance to officers and employees on applicable threats;

provide measures to prevent, detect and respond to the threats; and

monitor compliance with cybersecurity policies and procedures.

cybersecurity risk as it relates to identity theft and data protection, fraud, and business continuity; and

other disruptions in service that could affect, for instance, the ability to process shareholder transactions.