text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into our overall risk management system and processes as part of our IT security incident response plan.

companyName: Viking Therapeutics, Inc.

ticker: VKTX


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

secItem: Item 1C


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: Our board of directors, in coordination with our Audit Committee, oversees our risk management program, including the management of cybersecurity threats. Our board of directors and our Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. Our board of directors and our Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with our Information Systems Representative and other members of senior management.


text: The Information Systems Representative, in coordination with senior management including our Chief Executive Officer and Chief Financial Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 25 years, including serving as the Director of Information Technology of another public company.


text: Risk management and strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Our work on developing and implementing a process to oversee and identify risks from using third-party service providers, suppliers and vendors who have access to our critical systems and information is ongoing.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as, where it deems appropriate, any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, Chief Information Officer (the "CIO"), and Vice President and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO has over 20 years' experience managing the cybersecurity function across multiple companies. The information security team's experience includes security certifications in International Information System Security Certification Consortium ("ISC2"), Information Systems Audit and Control Association ("ISACA") and The International Council of E-Commerce Consultants ("EC-Council").


text: We have a security incident response framework in place. This is part of the process we employ to inform our management and Board of Directors about and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments of our policies and standards in relation to applicable state and federal statutes and regulations.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In connection with the advisory agreement with a wholly-owned subsidiary of UHS, as discussed herein, we utilize certain of UHS' information technology ("IT") applications, consisting primarily of financial data applications. In addition, UHS and our third-party property managers rely extensively on IT systems to, as applicable, manage clinical and financial data, communicate with patients, tenants, payers, vendors and other third parties; and to summarize and analyze operating results. These various IT systems, and the networks and information systems of third parties that we, UHS and our third-party property managers rely on, are subject to damage or interruption from power outages, facility damage, computer and telecommunications failures, computer viruses, security breaches including credit card or personally identifiable information breaches, vandalism, theft, natural disasters, catastrophic events, human error and potential cyber threats, including malicious codes, worms, phishing attacks, denial of service attacks, ransomware and other sophisticated cyber-attacks, and our disaster recovery planning cannot account for all eventualities. These systems, in turn, interface with, and rely on, third-party systems that we do not control. Third parties to whom we outsource certain of our functions, or with whom our systems interface and who may, in some instances, store our sensitive and confidential data, are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: Cybersecurity Risk Management and Strategy As cyber criminals continue to become more sophisticated through evolution of their tactics, techniques and procedures, we, UHS and our third-party property managers have taken, and will continue to take, additional preventive measures to strengthen the cyber defenses of the collective networks and data. Protecting data, which includes information related to clinical and financial data, and communications with patients, tenants, payers, vendors and other third parties is a primary area of focus for us, UHS, and our third-party property managers. Given the critical nature of this information, certain cybersecurity risk management programs were implemented to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K.


text: UHS has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws. To address cybersecurity risks facing UHS, and in turn us, to the degree applicable, UHS has adopted a "continuous risk assessment" process. UHS, through a third party, conducts a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the maturity of its program and related controls. The results of that assessment are shared with management of UHS, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of technical controls, results which are reviewed by management of UHS and resolved in a timely manner. Other factors that feed into UHS' risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.


text: UHS also has a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain and eradicate the issue, and then restore systems in the event of a major disruption. Regularly, UHS conducts tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve recovery practices. As part of these processes, UHS regularly engages with assessors, consultants, auditors, and other third parties to review UHS' cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: UHS maintains a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.


text: For our the third-party property managers that manage a significant portion of our properties, we conduct periodic reviews of the policies and procedures they have established to detect, contain, eradicate, and restore systems in the event of a major disruption.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2024 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Business Operations - A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts." under "Item 1A. Risk Factors."


text: Governance of Cybersecurity The Audit Committee of our Board of Trustees is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, regarding matters of cybersecurity, including review of significant issues encountered by us, UHS or our third-party managers.


text: UHS' cybersecurity risk management and strategy processes are overseen by leaders from their Information Security, Compliance, Legal and Internal Auditing teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Innoviva, Inc.

ticker: INVA


text: We conduct risk assessments to identify cybersecurity threats at least annually, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, legal, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage internal auditors and other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: During the year ended December 31, 2024, we did not identify any risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us. However, in the future, we may face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our operations could be disrupted by failure of our information systems or cyber-attacks."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our executive team, primarily consisting of our Chief Accounting Officer, Chief Financial Officer, and Chief Executive Officer, in conjunction with our information security team and third-party consultants, is primarily responsible in assessing and managing our material risks from cybersecurity threats. The qualifications of our executive and information security teams include a combination of formal education, current trainings and certifications in systems, network, and cybersecurity and over 50 years of combined experience in information technology and cybersecurity matters.


text: They oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which the executive team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: • They provide briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. • In addition, they provide briefings of any significant cybersecurity matters to the board of directors as well as an annual update of cybersecurity risks and activities.


text: The security of our information technology systems and Company data is important to our operations and reputation. Accordingly, we are committed to identifying and managing cybersecurity risks. Our cybersecurity team performs periodic risk assessments and, on a quarterly basis, provides our Enterprise Risk Management Committee ("ERM") information related to the Company's cybersecurity, including statistics on attempted cyber-attacks, status of employee information security training awareness, and information on any security investigations. The cybersecurity team advises the ERM of significant global cyber events that occurred during the quarter and whether they impacted DIRTT. The cybersecurity team regularly discusses with the ERM the Company's cybersecurity posture and whether the Company should implement additional protections and controls to assist the Company in protecting, responding to, or mitigating potential future cyber-attacks.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: DIRTT has developed and implemented a cybersecurity risk management strategy which consists of 5 phases: Identify, Protect, Detect, Respond, and Recover. Each phase has multiple processes and technologies supporting those processes. Identification processes at DIRTT include: system asset identification, threat identification, vulnerability identification and maintaining cybersecurity policies and standards.


text: Protection processes at DIRTT include: cyber awareness training, cyber awareness assessment (each employee is assigned a cybersecurity awareness grade calculated by a best in class cybersecurity vendor), implementation of identity and access controls, perimeter and endpoint security, annual vulnerability assessments and remediation, data encryption in transit, key vendor (third parties) control effectiveness assessment, and pre-implementation of software and systems cybersecurity assessments. Detection processes at DIRTT include: automated event collection, collation, analysis, alerting and end user incident reporting. Respond processes at DIRTT include: containment, communication, investigation and analysis, and long-term mitigation planning. Recovery processes at DIRTT include: impact identification and analysis, system restoration, internal and external communications as deemed necessary.


text: DIRTT engages external assessors annually for specific controls, to assess and provide assurance on the health of DIRTT's cybersecurity posture and controls.


text: DIRTT's Senior Vice President of Technology ("SVP of Technology"), who reports to the President and Chief Operating Officer, is responsible for DIRTT's cybersecurity and has over 15 years of technology experience. The SVP of Technology is supported by dedicated cybersecurity staff and Governance, Risk and Compliance ("GRC") staff. DIRTT's cybersecurity team leader has over 20 years of experience in cybersecurity, multiple industry standard cybersecurity certifications, and extensive offensive and defensive cybersecurity tactical skills. DIRTT's GRC lead has over 20 years of GRC experience and industry standard certifications. Cybersecurity incidents, response and remediation activities and statuses are reported directly to the SVP of Technology.


text: The ERM of the Board of Directors oversees risks resulting from cybersecurity threats. DIRTT's management, represented by the SVP of Technology, is responsible for identifying, assessing, and managing risks arising from cybersecurity threats. Quarterly, DIRTT's SVP of Technology reports to the ERM on the health of DIRTT's cybersecurity, incidents, and emerging threats and vulnerabilities that may impact the Company.


text: As of the date of this Annual Report, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's results of operations and/or financial condition. See "Item 1A. Risk Factors" for additional information about cybersecurity risk.


text: Risk Management & Strategy Our management is principally responsible for defining the various risks facing us, formulating risk management policies and procedures, and managing our risk exposures on a day-to-day basis. Our information is processed, transmitted, and stored in a secure environment using hardened, proven enterprise-grade technologies to protect both our data and the physical computing assets. We guard against business interruption by maintaining a disaster recovery plan, which includes storing critical business information in multiple off-site data centers, testing the disaster recovery plan at a host-site facility, and providing fault tolerant devices, communication services, and utilities. We have independent third-party cybersecurity audits conducted no less than annually, following a framework modeled after the National Institute of Standards and Technology standard. We also have third-party security reviews and testing of our network, processes and systems conducted on a regular basis. We use internally developed proprietary software, cloud-based software as a service ("SaaS") as well as purchased software, with proven, non-proprietary hardware. While we believe that our internal policies, systems and procedures for cybersecurity are thorough, the risk of a cybersecurity event cannot be eliminated. We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply or our systems are compromised, we could be subject to government enforcement actions, private litigation and adverse publicity.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. In addition to performing an annual risk assessment and developing a mitigation plan, along with a comprehensive review and update of our cybersecurity policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. We also monitor risks relating to sensitive information at our business partners, where relevant, and reevaluate the risks at these partners periodically. We make strategic investments to address these risks and compliance requirements to keep Company, guest and team member data secure, including maintaining a network privacy and security insurance policy. Although we have purchased cyber liability insurance to provide a level of financial protection should a data breach occur, such insurance may not cover us against all claims or costs associated with such a breach. Our comprehensive cybersecurity program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. We perform annual and ongoing cybersecurity awareness training for our management and Restaurant Support Center team members as well as specialized training for our users with privileged access. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards.


text: The Audit Committee receives data protection and cybersecurity reports quarterly from our Chief Information Officer, which the Audit Committee shares with the full Board of Directors. The Board of Director's responsibility is to monitor our risk management processes by understanding our material risks and evaluating whether management has reasonable controls in place to address those risks. The involvement of the Board in reviewing our business strategy is an integral aspect of the Board's assessment of management's tolerance for risk and what constitutes an appropriate level of risk. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to certain risks to the Audit Committee. As such, the Audit Committee is responsible for reviewing our risk assessment and risk management policies. Accordingly, management regularly reports to the Audit Committee on risk management, and in turn, the Audit Committee reports on the matters discussed at the Committee level to the full Board. The Audit Committee and the full Board focus on the material risks facing us, including operational, technology and cybersecurity, reputational, market, credit, liquidity and legal risks, to assess whether management has reasonable controls in place to address these risks.


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer and our Director of Cybersecurity and Infrastructure. These individuals have collectively over 40 years of professional experience in various and progressive roles across multiple, regulated industries involving developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing information security infrastructure and operations, risk assessment and mitigation, and satisfactorily managing multiple industry and regulatory compliance environments. Prior to their current roles, both individuals previously held positions at other large publicly traded organizations where they were the chief stewards of cybersecurity strategy and operations.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature or Information Systems and Data.

companyName: CERUS CORP

ticker: CERS


text: Our information security function, led by our Senior Director, IT & Facilities and our Senior Manager, IT Infrastructure and Operations, helps identify, assess and manage our cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and resources including, for example automated tools, internal and external audits, external intelligence feeds and third-party threat assessments; conducting scans of the threat environment, threat assessments for internal and external risk and vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile and threats reported to us; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threat and threat actors and coordinating with law enforcement concerning threats; and internal tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, disaster recovery/business continuity plans and cybersecurity insurance; incident detection and response, risk assessments, systems monitoring and penetration testing; encryption of data, network security controls, access controls, physical security and asset management, tracking and disposal; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management process; the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms, threat intelligence service providers, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as third-party distributors for our products in certain countries and third-party suppliers for the manufacture of our products, as well as third-party application providers and third-party hosting companies. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Item 1A—Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor captioned, "Significant disruptions of information technology systems or actual or alleged breaches of data security could adversely affect our business."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of management, including our Senior Director, IT & Facilities and our Senior Manager, IT Infrastructure and Operations. Our Senior Director, IT & Facilities has over 26 years of experience in systems engineering, network design and security and is a Certified Information Systems Security Professional, or CISSP. Our Senior Manager, IT Infrastructure and Operations has over 24 years of experience in network administration, security administration and incident response and remediation.


text: Our Senior Director, IT & Facilities and our Senior Manager, IT Infrastructure and Operations are responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Senior Director, IT & Facilities and our Senior Manager, IT Infrastructure and Operations are responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Senior Director, IT & Facilities, Chief Legal Officer, Chief Financial Officer, Chief Executive Officer and others. Those individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives periodic reports from our Senior Director, IT & Facilities and third-party experts concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We recognize the need to maintain the security and confidentiality of personal information, protected health information, and other confidential data that we collect and use in connection with our business, and the importance of assessing, identifying, and managing various cybersecurity risks that may impact our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: We design and assess our program based on various cybersecurity frameworks, most prominently the Health Information Trust Alliance ("HITRUST") Common Security Framework, and Service Organization Controls ("SOC") 2, developed by the American Institute of CPAs. In 2024, our cybersecurity systems, supporting infrastructure and EOS products received HITRUST e1 certification as they met the HITRUST CSF v11.20 certification criteria. We use this cybersecurity framework and information security controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs.


text: As part of our enterprise risk management process, we assess the various cybersecurity risks that may impact our business and implement plans and initiatives that are intended to mitigate those risks.


text: Our information security program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs. The Audit Committee oversees management's implementation of our information security program and receives periodic reports from management on our material cybersecurity risks. Additionally, management updates the Audit Committee, as necessary, regarding material cybersecurity incidents. The full Board receives quarterly updates from management on our information security program.


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. To support data security, we have established an integrated risk management framework with practices that are derived from industry standards, including ISO 27001, HITRUST Common Security Framework (CSF) 11.2 certification, the NIST Cybersecurity Framework, and data privacy regulations, including HIPAA and the General Data Protection Regulation. The data security controls from these standards and regulations are evaluated for our risk management framework based on the needs of our business and our clients, the nature of our industry, and applicable regulations.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company relies on technology infrastructure and information systems, including the Internet and cloud services, to process, transmit and store electronic and financial information, manage a variety of business processes and activities, and comply with regulatory, legal and tax requirements. The Company also depends on its information technology infrastructure to capture knowledge of its business including its vessel operation systems, which contain information about vessel positioning and scheduling; monitor its vessel maintenance and engine systems; coordinate its business across its bases of operation including cargo delivery and equipment tracking; and communicate within its organization and with customers, suppliers, partners and other third parties. The Company's ability to service customers and operate vessels is dependent on the continued operation of these systems. While the Company takes various precautions and has enhanced controls around its systems, like other technology systems, they are susceptible to damage, disruptions or shutdowns, hardware or software failures, power outages, computer viruses, telecommunication failures, user errors, catastrophic events, or cyber-attacks including malware, other malicious software, phishing email attacks, attempts to gain unauthorized access to its data, the unauthorized release, corruption or loss of its data, loss or damage to its data delivery systems, ransomware, and other electronic security breaches. Over time, these attacks have become increasingly sophisticated and, in some cases, have been conducted or sponsored by "nation state" operators. The Company expects that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: The Company has implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to the Company's internal information systems and its services. The Board of Directors has direct oversight of the Company's risk management process and the management of cybersecurity risks. Under the direction and supervision of the Company's Chief Financial Officer, the Company conducts periodic risk assessments, which include cybersecurity risks. Management provides a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.


text: The Company's Director of Technology, reporting to the Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats, and preparing updates for the Board of Directors. The Director of Technology has a combined twenty-one years of experience leading and working on cybersecurity teams at the Company and other companies in the oil and natural gas industry, has significant experience with networking, on-premises and cloud-based infrastructure, and cybersecurity controls, and has a Bachelor of Science degree.


text: In response to the increasing threats presented by cyber incidents, in April 2022 the Company established a Cybersecurity Committee, which meets regularly. This committee is comprised of the Director of Technology, members of management from the technology, quality, health, safety and environment and operations departments, as well as the Chief Financial Officer and the General Counsel, both of whom report to the Chief Executive Officer. The Cybersecurity Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Committee develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors and receives regular updates on cybersecurity-related matters.


text: The Company has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continuously evaluate and enhance its cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. The Company uses automated tools that monitor, detect, and prevent cybersecurity risks that are monitored by the technology department and a third-party vendor. As noted above, the Cybersecurity Committee is also implementing comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Committee escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, based on the materiality of the event.


text: When the Company experiences a cybersecurity incident, the Director of Technology will inform the Cybersecurity Committee, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and, in particular, whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors provides oversight of the Company's response to such incident, including considerations around disclosure of the event. The Cybersecurity Committee continuously monitors incidents as they are remedied to ensure proper remediation and, if necessary, the ability to report to the Board of Directors if previously unknown material information arises during such remediation.


text: The Company engages subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor the Company's systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Cybersecurity Committee oversees and establishes the parameters of the Company's engagement with these experts to ensure the Company obtains the supplemental assistance needed in this area, if any.


text: The Company's information technology systems are in some cases integrated, such that damage, disruption or shutdown to one system could result in a more widespread impact on the Company's systems as a whole. If the Company's information technology systems suffer severe damage, disruption or shutdown, and its business continuity plans do not effectively resolve the issues in a timely manner, the Company's business could be negatively affected. In addition, cyber-attacks could lead to potential unauthorized access and disclosure of confidential information, data loss and corruption, see "Item 1A. Risk Factors" under the heading "The Company relies on information technology, and if it is unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, its operations could be disrupted and its business could be negatively affected" of this Annual Report on Form 10-K. A cybersecurity incident could materially harm the Company's reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events.


text: Our Company places a high priority on cybersecurity, information security, and securing confidential business information and personal information that we receive and store related to our customers and employees. Our Company's Audit Committee oversees the cybersecurity risks faced by the Company. In connection therewith, a Cybersecurity Steering Committee, which consists of our Chief Financial Officer, Chief Operating Officer, General Counsel, Vice President of Software Development, and Vice President of Regulatory Affairs, was formed to identify material risks and cybersecurity threats arising in our business.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: Our Audit Committee receives updates from the Cybersecurity Steering Committee at least annually, which cover topics related to information security, privacy, and cyber risks and risk management processes, including the status of significant cybersecurity incidences and projects designed to strengthen our information security posture. Our Audit Committee is also responsible for ensuring that the Board of Directors also receives periodic reports with respect to the status and management of our cybersecurity risks.


text: The Cybersecurity Steering Committee, in collaboration with delegates from our business and functions, is responsible for implementing the Company's enterprise-wide cyber security and information security strategy, employee training and compliance, and managing policies and processes for the Company's information technology standards, product security, and privacy. As a member of the Cybersecurity Steering Committee, our Vice President of Software Development provides experience devising effective cybersecurity management practices in the areas of both software and product development, including risk evaluation, impact assessment, security threat modelling, cybersecurity mitigation strategies, residual risk acceptability and methodologies for security risk verification. He has led the integration of our medical device software into some of the largest hospital and research institutions in the world in compliance with the extensive cybersecurity requirements of these institutions. In addition to utilizing internal Company resources, the Cybersecurity Steering Committee also regularly consults with external advisors and specialists regarding opportunities and enhancements to strengthen its practices and policies. We also engage with third-party consultants to manage the infrastructure and security of our information technology landscape.


text: Our cybersecurity program includes: • Penetration testing of internal information technology systems and review of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • Phishing, social engineering, and cyber hygiene training; • Continuous security event monitoring, management, and incident response plans; • Continuous enhancements to security capabilities based on evolving threats; • Information security policies and procedures; • Privacy controls and compliance with applicable legislative and regulatory requirements; • Assessment of applicable third-party vendors' cybersecurity and information security practices; and • A cross-functional approach to addressing cybersecurity risk with participation from representatives across the business and functions.


text: As part of our cybersecurity program, we have adopted an incident response plan, under which the Chairs of our Board of Directors and Audit Committee are informed by the Cybersecurity Steering Committee of any cybersecurity incidents that have the potential to materially adversely impact the Company or its information systems. To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, or in any penalties or settlements.


text: Risk Management and Strategy The Company's cybersecurity risk management strategy is comprised of several key elements. We assess our information technology and data management/storage systems and related policies and practices to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. We leverage a variety of technologies to attempt to mitigate the risk of cybersecurity threats and incidents. The Company has a multi-layer approach to its technology solutions, including employing applications used for perimeter, network, end point and application security as well as for data recovery, in each case tailored to the Company's systems, data, risk profile and mitigation strategy. From time to time, we use third-party service providers and software to augment and test our technology solutions and further support our risk mitigation strategy. Further, the Company maintains processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers.

companyName: CTS CORP

ticker: CTS


text: CTS uses a managed security services provider (MSSP) and other technologies to collect alerts and security audit logs, monitor and assess cybersecurity threat intelligence, and take actions to help us prevent, detect, mitigate and remediate cybersecurity incidents.


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate our systems) and test that awareness using knowledge assessments and simulations. The training is administered to employees on a rolling basis, and we use a third-party provider for the content and periodically update the training to incorporate new cybersecurity-related developments.


text: The oversight of our cybersecurity risk is integrated into our enterprise-wide risk management process. We annually review cybersecurity risk as part of our enterprise risk management process and evaluate whether to integrate those findings into our overall cybersecurity strategy. We have a Cybersecurity Strategy Committee, which is a cross-functional team of business representatives led by our Vice President of IT & Digitization, which is responsible for spearheading the ongoing development and execution of our cybersecurity strategy. The Cybersecurity Strategy Committee meets regularly and at other times as needed, and periodically updates the Company's management on its progress and activities.


text: Like many other companies, from time to time, we detect attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. We have in the past been subject to cybersecurity incidents which have not had a material impact on our business or financial condition and expect that we will be subject to additional cybersecurity incidents in the future. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there can be no assurance that our efforts to prevent or mitigate cybersecurity incidents will be successful. Please see "Risks Related to Technology and Data Privacy" in "Risk Factors" in Section 1A of this Annual Report on Form 10-K.


text: Our cybersecurity program is overseen by our Vice President of IT & Digitization, who has over 14 years of experience working in various information technology roles and has managed and evolved the cybersecurity function at CTS for the past three years. Our Vice President of IT & Digitization is supported by a team of enterprise information system and security risk professionals (collectively, the "IT Team"), who are responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The IT Team includes a cybersecurity leader with over 30 years of experience in IT infrastructure, IT operations and cybersecurity, and members who hold Certified Information Systems Security Professional (CISSP) and Certified Information System Auditor (CISA) certifications and have experience developing and implementing enterprise-wide cybersecurity strategies and initiatives, managing risks relating thereto, and evaluating industry standards and regulations.


text: While our Board has the ultimate oversight responsibility for the risk management process, the Audit Committee is responsible for oversight of our cybersecurity strategy and risks. The Vice President of IT & Digitization and other members of management provide t he Audit Committee with quarterly and as needed updates on the Company's cybersecurity strategy and risks. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.


text: In the event of a reported potential cybersecurity incident, our IT Team decides whether such an incident triggers our Cybersecurity Threat Evaluation and Response Plan (the "Response Plan"). If triggered, the Company's cybersecurity response team, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team, as appropriate and as set forth in the Response Plan, are responsible for developing, recommending and implementing measures to address the cybersecurity incident, including when appropriate, assessing, containing and mitigating its impact, notifying members of the Company's management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The IT Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of a cybersecurity incident.


text: Risk management and strategy We operate in the biopharmaceutical sector, which is a highly regulated sector subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; disruption of our clinical trials, manufacturing or supply chain; violation of privacy laws and other litigation and legal risk; and reputational risk. We rely primarily on industry-leading third parties and a cloud-based infrastructure for our information technology systems, and accordingly are dependent on these third parties' own cybersecurity risk management practices and strategy. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data ("Information Systems and Data").

companyName: GERON CORP

ticker: GERN


text: We take a risk-based approach to identify and assess the cybersecurity threats and risks that could affect our business and Information Systems and Data. Our Information Technology personnel help identify, assess and manage our cybersecurity threats and risks, and support our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods and tools to identify, assess and manage cybersecurity threats and risks, including, for example, automated tools, industry reports, third party threat assessments and penetration testing. In addition, we encrypt data at rest and maintain network security controls, such as firewalls and virtual private networks. We also conduct computerized system monitoring and access control, including asset management, tracking and disposal associated with onboarding and offboarding of personnel. We maintain cybersecurity insurance.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. For example, we have implemented and maintain an incident response plan, and we utilize automated tools designed to maintain email security. We have also implemented a computerized system security and password policy that defines security for access to computer systems managed and controlled by us, and a procedure for computerized system incident management to address any unplanned issues in regulated computerized systems that could impact subject safety, product quality, and data integrity. We periodically conduct cybersecurity incident tabletop training exercises involving our personnel and plan to conduct similar training in 2025.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our head of Information Technology evaluates material risks from cybersecurity threats and reports periodically to the Audit Committee of our Board, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers such as Crowdstrike, cybersecurity service providers such as Mimecast, penetration testing firms, auditors, and professional services firms, including legal counsel. These relationships enable us to leverage specialized knowledge and insights, enabling our cybersecurity strategies and processes to remain consistent with industry best practices.


text: We rely on third-party service providers to perform a variety of functions throughout our business, such as contract manufacturing organizations, contract research organizations, suppliers and consultants, and third party logistics organizations and distributors to distribute RYTELO. We conduct quality audits of regulated vendors, which typically include an assessment of such vendor's information technology systems, and we impose appropriate contractual obligations on vendors pertaining to information security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our efforts may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Report, including "Risks Related to Information Technology Systems, Data Security and Data Privacy."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our Board is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our Audit Committee, as well as our Chief Financial Officer, Chief Legal Officer, and other members of our executive management as appropriate, receives periodic reports from our head of Information Technology concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various periodic presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management Personnel Our Information Technology personnel responsible for cybersecurity risk assessment and management processes are managed by certain members of our executive management, including our Chief Financial Officer. Together with our executive management, our Information Technology personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. We seek to hire information technology personnel with skills appropriate to help us prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including executive management. When appropriate given the nature of any potential cybersecurity incident, our executive management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, and to make any legally required notifications to individuals or regulatory agencies, including making any required disclosures under the Exchange Act.


text: Cybersecurity Risk Management and Strategy The Company's information security program is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software and information assets, including client and other sensitive data. The program is comprised of policies, guidelines, and procedures. These policies, guidelines, and procedures are intended to align with regulatory guidance, the ISO Code of Practice for Information Security Controls, and common industry practices. Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: The Company expects each associate to be responsible for the security and confidentiality of client information. We communicate this responsibility to associates upon hiring and regularly throughout their employment. We require each associate to complete training to protect the confidentiality of client information at the time of hire and during each year of employment. Associates must successfully pass a test to demonstrate understanding of these requirements and provide acknowledgement of their responsibilities.


text: Additionally, we regularly provide associates with information security awareness training covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to a company's network, result in the theft of user credentials and, ultimately, place client or employee data, or other sensitive company data, and information at risk. The Company employs a number of technical controls to mitigate the risk of phishing emails. We regularly test associates to determine their susceptibility to phishing emails. We require susceptible associates to take additional training and provide regular reports to management. We additionally maintain procedures for the safe storage and handling and secure disposal of sensitive information.


text: The Company protects its network and information assets with industry-tested security products and processes. Our teams actively monitor company networks and systems to detect suspicious or malicious events. The Company evaluates potential cyber risks, as appropriate, in its regular risk assessments. The Company also conducts vulnerability scans, and contracts with third-party vendors to perform penetration tests against the Company's network. In addition, the Company's Cyber Defense Center team monitors threat intelligence sources to anticipate and research evolving threats, investigates their potential impact to financial services companies, examines the Company's controls to detect and defend against those threats, and proactively adjusts the Company's defenses against those threats. The Company also engages expert cyber consultants, as necessary and appropriate.


text: Before engaging third-party service providers who may have access to the Company's, customer, employee or other sensitive data, or to the Company's systems, we perform due diligence in order to identify and evaluate their cyber risks, which includes self-attestation questionnaires (developed using Service Organization Controls (SOC) reports). This process is led by the Vendor Management team and includes participation of dedicated information security resources. Third-party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. After contract executions, third-party service providers deemed critical by our vendor management office undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.


text: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan (Incident Response Plan), which is administered by our Chief Information Security Officer (CISO) in close collaboration with our Director of Enterprise IT Risk. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents. The Incident Response Plan is intended to proceed on parallel paths in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business, communications, and risk personnel. Our incident response team annually performs exercises to simulate responses to cybersecurity events.


text: The Incident Response Plan includes procedures for timely escalation and reporting of potentially significant cybersecurity incidents to the Company's Chief Operating Officer, Chief Financial Officer, Chief Risk Officer, our Board Risk Committee, law enforcement, government agencies and impacted parties, as needed.


text: Impacts of Cybersecurity Incidents To date, the Company has no knowledge that we have experienced a cybersecurity incident that has or is reasonably likely to have a material impact on our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee. The Board also periodically designates directors as its cybersecurity contact points. Our Chief Operating Officer facilitates the involvement of these designated directors in oversight of potentially significant cybersecurity incidents. The current directors designated as cybersecurity contacts are Chairman Jerry Levens, Board Risk Committee Chair Frank Bertucci, and Suzette Kent.


text: The Risk Committee oversees the management process associated with cybersecurity risk. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings. The Board Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. The Board Risk Committee provides reports to the full Board on the Company's information security program on an annual basis.


text: The Company's CISO directs our information security program and the Director of Enterprise IT Risk directs our information technology risk management. Led by our CISO and Director of Enterprise IT Risk, a team of dedicated security professionals examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment and provides immediate responses to threats.


text: The CISO regularly attends Board Risk Committee meetings and sits in executive session with the Committee members at least annually to update committee members on material cybersecurity and other information security developments and risks. The CISO also provides an annual information security program summary report to the Board, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.


text: The IT Risk Governance Subcommittee, a management level subcommittee of our Operations Committee, also addresses information security and is responsible for overseeing the protection of the integrity, security, safety and resiliency of corporate information systems and assets. The IT Risk Governance Committee meets quarterly to review the development of the program and provide recommendations. The subcommittee provides regular reports to the Operations Committee and, ultimately, the Board Risk Committee through the CISO. Together, our CISO and Director of Enterprise IT Risk co-lead the Company's IT Risk Governance Committee.


text: Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is a member of the Company's Corporate Operations group and reports to our Chief Information Officer, who reports to our Head of Operations, Technology and Products, who in turn reports to our Chief Operating Officer. Our CISO has cybersecurity experience spanning more than two decades. Prior experience includes senior security roles in large government agencies and Fortune 200 companies. He has spoken at area colleges and various industry events about information security. He holds a degree in electrical engineering, is a graduate of banking school, and maintains several industry certifications.


text: Our Director of Enterprise IT Risk is responsible for the Company's information technology governance, risk, and compliance program. In this role, the Director of Enterprise IT Risk provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high level risks receive appropriate attention. The Director of Enterprise IT Risk is a member of the Company's Corporate Risk Management Group and reports to our Chief Risk Officer, who in turn reports to our CEO. Our Director of Enterprise IT Risk has over two decades of business continuity, crisis management and risk experience in the financial services industry and maintains related industry certifications.


text: We recognize the importance of assessing, identifying, managing and mitigating material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to Topper Group employees or customers and violation of data privacy or security laws.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Substantially all our locations are branded fuel locations for which sensitive data related to debit and credit card transactions for fuel or merchandise products or services does not pass through our networks; rather, such information passes through the branded fuel supplier's (or its service providers') networks. However, in the ordinary course of our business, we collect and store sensitive data of certain of our dealer and tenant customers, suppliers and other business partners.


text: We have an enterprise-wide information security platform, which is part of our enterprise risk assessment process and designed to protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework. To protect our information systems from cybersecurity threats, we seek to use best-in-class security tools that help prevent, identify, escalate, investigate, resolve and recover from identified security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. We also maintain a third party security operations service to identify, prioritize, assess, mitigate and remediate risks. We rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and third party consultants, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We conduct "tabletop" exercises during which we simulate cybersecurity incidents to help us prepare to respond to a cybersecurity incident and to identify areas for potential improvement. We also provide employee training to support identification of and how to respond to cyber attacks. The results of these assessments are reported to the Board.


text: We also have implemented an incident response plan that is designed to facilitate our response to cybersecurity incidents and escalation of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us, to our executive officers, other members of our senior management team and other internal stakeholders. This plan is designed to provide our executive officers and other members of our senior management team with the information needed to assess the materiality of a cybersecurity incident and the need for public disclosure.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties and Topper Group employees) and other data, confidential information or intellectual property. To date, these incidents have no t had a material impact on our service, systems or business and we do not believe cybersecurity risks from these prior incidents are reasonably likely to materially affect our operations. For further information on cybersecurity risks and potential related impacts on us, see "Risk Factors – Our business and our reputation could be adversely affected by the failure to protect sensitive customer, Topper Group employee or the Partnership's vendor data, whether as a result of cyber security attacks or otherwise, or to comply with applicable regulations relating to data security and privacy."


text: The Director of Technology Services is responsible for overseeing the information security program as well as members of the Information Technology department that execute our program with oversight by members of our senior leadership team. These members of our Information Technology department have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance and systems. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board on any appropriate items.


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Board receives regular reports from our Director of Technology Services on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Assessing, Identifying and Managing Cybersecurity Risks — We strive to align our cybersecurity operating model with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to enhance our ability to protect, detect, respond, and recover from potential cybersecurity threats. Our cybersecurity team actively works to assess, identify and manage risks in our information systems in order to protect the confidentiality, integrity and availability of our digital infrastructure. The cybersecurity team meets regularly to evaluate potential threats, discuss best practices and identify new solutions to help mitigate cyber risks.

companyName: TALOS ENERGY INC.

ticker: TALO


text: We engage third-party service providers to conduct evaluations of our cybersecurity controls through penetration testing, independent audits and consulting on best practices to address existing and new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls. Going forward, we are committed to conducting these evaluations at least annually. To further enhance the capabilities of our internal systems, we utilize third-party vendors to provide extended coverage of our information technology and operational technology environments. We also share and receive threat intelligence with companies in the energy sector, government agencies, information sharing and analysis centers and cybersecurity associations in order to monitor and address developments in the cybersecurity environment.


text: To serve as an additional protection from outside threats, we also seek to prepare our employees and contractors about cybersecurity risks through cybersecurity training, simulated phishing exercises and awareness campaigns. We conduct employee training bi-annually, and point-in-time training for any phishing failures. We have implemented software and processes and currently use a managed service to help identify and evaluate risks from cybersecurity threats associated with third-party service vendors. In the event of a cybersecurity incident deemed to have a moderate or higher business impact, we have an incident response plan to notify senior leadership and to address how to contain the incident, mitigate the impact, and restore normal operations efficiently.


text: Cybersecurity Risk Assessment — We have integrated cybersecurity risk management into our broader Enterprise Risk Management ("ERM") framework to promote a company-wide culture of cybersecurity risk management. Our ERM framework is designed to identify and prioritize company-wide risks, including cybersecurity threats, and integrate mitigation measures into our business, operational and capital structure planning activities. The purpose of the ERM framework is to enable the Board and executive leadership to (1) align risk management with strategic objectives, (2) identify risks, including cybersecurity risks, throughout the organization, (3) assess and prioritize risks that could impact the Company's operational and strategic objectives, (4) develop and monitor risk mitigation initiatives, and (5) report and assess material risks, mitigation strategies and progress to the Board and/or its applicable committees. Cybersecurity risk is reviewed by a cross-functional, management-level ERM Steering Committee as part of the Company's overall enterprise risk management program.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats — The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Audit Committee has been delegated responsibility by the Board for overseeing the Company's overall enterprise risk management program, including cybersecurity risk. The Audit Committee receives reports at least quarterly from the Director of Information Technology regarding cybersecurity matters, which may include, among other things, the results of cybersecurity audits, cybersecurity maturity assessments, other information technology matters, risk mitigation strategies, data protection and progress on initiatives. The Audit Committee Chair is responsible for reporting key cybersecurity issues regarding current and potential material cybersecurity threats and our risk mitigation response strategies to the Board. To further inform our Board and management on emerging cybersecurity issues, we periodically engage third-party cybersecurity experts to report to the Audit Committee, other directors, and management, as applicable, on topics that may include, among other things, the latest cybersecurity trends, new technologies, evolving threats in the marketplace, proposed initiatives, legislation, and reporting standards.


text: Management's Role in Assessing and Managing Cybersecurity Threats — Our information technology team is responsible for assessing, identifying and managing cybersecurity risks. Top cybersecurity risks are also integrated into our overall ERM framework and overseen at the management level by the ERM Steering Committee. Our Director of Information Technology, who reports directly to the CFO and Executive Vice President ("EVP") and is a member of the ERM Steering Committee, is responsible for our efforts to comply with applicable cybersecurity standards, establish cybersecurity protocols and protect the integrity, confidentiality and availability of our information technology infrastructure. Technology and cybersecurity policy decisions are made by our Director of Information Technology in consultation with our CFO and EVP. In addition, our Director of Information Technology has a direct line of communication with the Office of the Interim Chief Executive Officer and General Counsel as needed. Our Director of Information Technology has over 20 years of experience in cybersecurity, holds a Master of Science in Cybersecurity from the University of Houston and is a Certified Information Systems Security Professional and a Boardroom Certified Qualified Technology Expert.


text: Impact of Risks from Cybersecurity Threats — The energy sector's growing reliance on information and operational technology to manage critical business functions has significantly increased the exposure to cybersecurity threats. The rising frequency and sophistication of cyber incidents, whether resulting from deliberate attacks or accidental breaches, pose substantial risks to the energy industry. As these threats continue to evolve, effectively preventing, detecting, mitigating, and responding to cyber incidents has become an ongoing and increasingly complex challenge. Regulatory compliance adds another layer of complexity, particularly as cybersecurity reporting and disclosure requirements continue to evolve. These regulations require prompt and detailed disclosures of material cyber incidents, demanding significant resources and well-structured internal processes to maintain compliance. Failure to meet these obligations could lead to legal penalties, heightened regulatory oversight, and reputational harm. Additionally, the constantly shifting regulatory landscape may introduce overlapping or conflicting requirements, further complicating compliance efforts. To minimize potential risks, it is essential to closely monitor these developments and incorporate them into our cybersecurity and regulatory compliance strategies.


text: As of the date of this Annual Report, we are not aware of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, although the Company regularly experiences cybersecurity incidents that are not deemed material to our operations. Examples of cybersecurity threats we face include incidents common to most companies in the energy industry, such as phishing, business email compromise, ransomware and denial-of-service, as well as attacks from more advanced sources, including nation state actors, that target companies in the energy industry. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely disrupt our operations, including our drilling operations, and affect our performance and results of operations. Although we believe we have implemented comprehensive cybersecurity measures, no security program is infallible. For additional information about cybersecurity risks, please see Part I, Item 1A. Risk Factors — Risks Related to our Business and the Oil and Natural Gas Industry — Our business could be negatively affected by security threats, including cybersecurity threats, terrorist attacks and other disruptions.


text: Cybersecurity Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: As part of our enterprise risk management program, our Board and the Audit Committee of our Board (the "Audit Committee") oversee cybersecurity risk management and meet with our senior management team, which includes our Chief Executive Officer, President, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Vice President - Technology assigned as the executive risk owner. Our Senior Vice President - Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President - Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board and Audit Committee, when appropriate.


text: Our Senior Vice President - Technology has served in various roles in information technology and information security for over 25 years. He holds undergraduate and graduate degrees in computer science and business.


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. Our cybersecurity risk management program is a key component of our overall risk management process, and includes similar characteristics, reporting channels and governance processes to those that apply across other legal, compliance, strategic, operational and financial risk areas within the Company.

companyName: Nuvalent, Inc.

ticker: NUVL


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to its audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.


text: The audit committee receives reports from management on our cybersecurity risks at least annually. In addition, management updates the audit committee regarding all material cybersecurity incidents, as well as any incidents with lesser impact potential that management, in its discretion, determines may be relevant for audit committee review. The audit committee reports to the board of directors regarding its activities, including those related to cybersecurity.