third-party assessments of cybersecurity maturity, including a simulated hacker attack against an internal system, a company-wide ransomware crisis exercise, and updates to the security awareness program.