Invesco DB Energy Fund 10-K Cybersecurity GRC - 2024-02-22

Page last updated on April 11, 2024

Invesco DB Energy Fund reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-22 21:10:37 EST.

Filings

10-K filed on 2024-02-22

Invesco DB Energy Fund filed an 10-K at 2024-02-22 21:10:37 EST
Accession Number: 0000950170-24-019052

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY . Cyber threats are considered one of the most significant risks facing financial institutions. Because the Fund has no directors, principal officers or employees, the Managing Owner is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ( Invesco ), the Managing Owner s parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business. Invesco s information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has over 25 years of experience, specializing in information security and risk management. Our manager s information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect our information assets. The program includes the following: Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. Conducting diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats. Important to these programs is Invesco s investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities. Invesco s Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco s risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this committee include Invesco s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco s Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight. Although risks from cyber threats have not materially affected the Fund s business strategy, results of operations or financial condition as of December 31, 2023, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see Due to the Increased Use of Technologies, Intentional and Unintentional Cyber Attacks Pose Operational and Information Security Risks in Item 1A. Risk Factors.

Company Information