text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our current IT consultants and IT MSP, who report to our interim Chief Financial Officer, to manage the risk assessment and mitigation process. Our interim Chief Financial Officer has served in various capacities in enterprise risk management and cybersecurity over five years, including serving as our Data Security Coordinator for the past two years, during which he has overseen our risk management process.


text: We evaluate each third-party service provider to verify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect the Company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX

secItem: Item 1C


text: Our interim Chief Financial Officer periodically meets with our IT consultants and IT MSP about the Company's ongoing compliance and risk management and provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, to date, we are not aware of any cybersecurity threats that have materially affected our business. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important function of our enterprise risk management program. Material cybersecurity risks from cybersecurity threats are managed across Medallion Financial Corp., the Bank, Medallion Capital, and third-party vendors and monitoring such risks and threats involves coordination between us as the parent company and our two main operating subsidiaries. We continue to integrate our cybersecurity programs into our enterprise risk management program, which is led by various senior representatives of the Company and overseen by the Audit Committee of the Company's Board of Directors.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: Medallion Financial Corp., the Bank and Medallion Capital are each responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been guided by the National Institute of Standards and Technology Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable, and seek to protect each entity against cybersecurity risks and provide a foundation to respond promptly to cybersecurity events. Each entity maintains technical and organizational safeguards, including, among other things, employee testing and training, incident response programs and tabletop exercises, evaluations and assessments by third parties, vulnerability scanning, vendor management, cybersecurity insurance, and business continuity mechanisms for the protection of Company assets. Our programs also assess and manage third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third-party service providers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, and we currently do not expect that risks from cybersecurity threats are reasonably likely to materially affect us, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is responsible for overseeing the Company's enterprise risk management program, including overseeing the adequacy of protection of the Company's technology, including physical security, patent and trademark program, proprietary information, and information security. The Audit Committee receives quarterly reports from our Information Security Director and third parties on cybersecurity matters. In addition, the Audit Committee receives quarterly reports addressing cybersecurity as part of our enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. These reports include, among other things, existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents, if any, and the status of key information security initiatives. Our Audit Committee members also engage in ad hoc conversations with management on cybersecurity-related news and events, and discuss any updates, as needed, to our cybersecurity risk management and strategy programs.


text: Medallion Financial Corp. employs a Director of Information Security, and our main operating subsidiaries have similar functions and/or roles conducted by various individuals. Such information security leadership are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in information security and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and third-party vendors about, and monitor, the prevention, detection, mitigation and remediation efforts relating to any cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated from information security leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our Information Security Director and third parties as well as part of our enterprise risk management program.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage our risk assessment and mitigation processes, including our Vice President of Operations (VPO), who serves as our acting Chief Information Security Officer (CISO), as well as external information technology consultants who help manage our information technology systems and our information security.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology consultants. Employees at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage our information technology consultants, including dedicated on-site consultants as well as other third parties, in connection with our risk assessment processes. These partners assist us to help design, implement, monitor, and test our cybersecurity policies and procedures. We also require key third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors, which is responsible for monitoring and assessing strategic risk exposure, has delegated primary oversight responsibility for cybersecurity to our audit committee.


text: Our VPO and acting CISO, who reports to our President, is responsible for the day-to-day management of our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, with the assistance of and informed by our consultants. Our VPO and acting CISO, who has many years of senior management and operational oversight at emerging technology companies, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the day-to-day management of our information technology consultants, which includes engaging with information provided by the consultants, automated monitoring and detection systems, and other tools and processes defined by our cybersecurity policies.


text: Our VPO and acting CISO provides periodic briefings to our executive officers regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our VPO and acting CISO also provides periodic briefings to the board of directors, including the audit committee, on cybersecurity risks and activities.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cybersecurity threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity program component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Risk Committee of our board of directors.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: The program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF framework provides the basis to evaluate our program for completeness and helps to ensure that the various components of the program are at a level that reduces cybersecurity risk to levels within the Company's risk appetite, taking into account the current threat and regulatory environment. Key components of the cybersecurity program include: • A risk assessment process that identifies and prioritizes cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • An incident response plan that outlines establishes a structured approach for the Company's response to a cybersecurity incident. The incident response plan is coordinated through the CISO and key members of management are embedded into the plan by its design. The plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. • A training program that educates employees about cybersecurity risks and how to identify and escalate cybersecurity events. • A third-party risk management program designed to ensure that our key vendors meet our expectations on cybersecurity. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Company engages reputable third parties to conduct various risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe, and we may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on the Company. However, as of the date of this Form 10-K, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Board of Directors Oversight The Risk Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Risk Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews quarterly reports regarding the information security program and technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.


text: Management Oversight Our CISO is accountable for managing our enterprise information security department and overseeing our information security program. The CISO reports directly to the Chief Risk Officer. The CISO's responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The CISO has over 20 years of experience in cybersecurity across the U.S Government, Department of Defense contracting, and financial services industry. Prior to joining the Company, the CISO served as the Deputy CISO for a major domestic financial services institution. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to senior leadership and the Risk Committee and/or the Board in a timely manner.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials ("Information Systems and Data").

companyName: MERRIMACK PHARMACEUTICALS INC


text: Our officers and our IT vendors help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team and IT consultants work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers and hosting companies. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Significant disruptions of information technology systems or security breaches could adversely affect our business." Our board of directors addresses our cybersecurity risk management as part of its general oversight function.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team and IT consultants, which includes individuals who have a diverse combination of relevant expertise, experience, education and training. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our team have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.


text: Certain members of our management team are responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.


text: Commencing in 2024, our Nominating and Corporate Governance Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.


text: Risk Management and Strategy We regularly assess risks from information security threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information security policies, processes, and practices. To protect our information systems from threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information, and have adopted policies, management oversight, accountability structures and technology processes designed to safeguard this information. All our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the Silvercrest data and systems to which they have access. These trainings also remind employees how to report any potential privacy or data security issues.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of Silvercrest assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive Silvercrest data. We have implemented and maintain a written proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures to follow in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, and client data in the event of an emergency or natural disaster.


text: We work with third-party service providers that proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.


text: As of the date of this Annual Report on Form 10-K, information security threats have not materially affected and we believe are not reasonably likely to materially affect Silvercrest, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Operational risks, including the threat of cyber-attacks, may disrupt our business, breach our clients' security, result in losses or limit our growth" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on Silvercrest.


text: We have implemented and maintain a formal information security program, designed to develop, and maintain privacy and data security practices to protect Silvercrest assets and sensitive third-party information, including personal information. This program is governed by employees comprised of members of senior management, including our Chief Information Security Officer ("CISO"), who meet regularly and provide reports to the Board of Directors at least annually. The CISO oversees communications with the Board of Directors regarding material cybersecurity incidents and provides the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to Silvercrest's information security practices and procedures.


text: We take a risk-based approach to information security and have implemented policies throughout our operations that are designed to address threats and our response to actual or suspected incidents. In particular, the CISO is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If an information security incident occurs, Silvercrest will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate and assess the materiality of the nature, scope and timing of a given incident and whether public disclosure is required.


text: The CISO is responsible for leading the assessment and management of cybersecurity risks. The CISO provides reports to the Board of Directors as part of the updates discussed above and regularly communicates with other members of senior management regarding information security risks.


text: Risk Management and Strategy We have established a cybersecurity committee to oversee the implementation of policies and processes that are designed to protect against and respond to cybersecurity threats. Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained. These policies and procedures and the resulting safeguards are designed and evaluated in light of yearly risk assessments, which are based on guidance obtained from a recognized national standards organization. We have implemented access controls, firewalls and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes safeguard our information systems. We maintain an incident response plan and business continuity and disaster recovery plans designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when they are hired and periodically thereafter.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: We use third-party security firms in different capacities to provide or operate some of our safeguards and technology systems. For example, we use third party consultants to conduct assessments, such as vulnerability scans and penetration testing.


text: Our cybersecurity policies and processes also include risk-based measures and evaluations of risk related to third parties and, where appropriate, we require third parties to implement and maintain appropriate security measures, consistent with all applicable laws, and to promptly report any suspected breach of its security measures that may affect our company.


text: Our cybersecurity risk management and strategy processes are led by a team of senior level management, including our Chief Financial Officer, Vice President of Finance, Senior Vice President of Legal and General Counsel and Vice President of Quality. These individuals collectively have significant prior work experience in various roles involving managing information security and implementing effective information and cybersecurity programs. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As of the date of this Annual Report on Form 10-K, risks from cybersecurity threats, including from any previous incidents, have not materially affected our business, including our business strategy, results of operations, or financial condition. See Item 1A - "Risk Factors" for additional information regarding cyber threats and related risks to our business.


text: Our board of directors addresses the Company's risk management and strategy, including the management of cybersecurity threats, as part of its general oversight function, and our management is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.


text: At least quarterly, the Audit Committee receives a presentation from management members of our cybersecurity committee concerning our cybersecurity threat risk management and strategy processes, which is designed to cover such topics as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks and/or incidents, as well as the steps management has taken to respond to such risks and/or incidents.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Oncternal Therapeutics, Inc.


text: Our cybersecurity risk management program includes: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer cyberattacks or other security breaches, which could have a material adverse effect on our business, results of operation, and financial condition, and result in a material disruption of our product development programs."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of IT or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer, General Counsel, and Head of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel. Our management team's experience includes a Head of IT with over 30 years' experience leading the IT and cybersecurity functions for companies similar to ours.


text: Our management team supervises efforts to identify, protect, detect, respond and recover cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have certain processes and policies in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program, and are integrated into our overall risk management program.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: We have an Information Technology Policy that sets parameters for the use, privacy, security, retention, and disposal of our information and other assets. We also have an Incident Response Policy which sets forth the steps for assessment, containment, and disclosure of cybersecurity threats. These policies were prepared using relevant guidance and technology standards and are reviewed periodically.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity risk program and have assessed it against the National Institute of Standards and Technology ("NIST") cybersecurity framework. In addition, we consider the internal risk oversight programs of third-party service providers with whom we engage in order to help protect us from any related cybersecurity vulnerabilities.


text: Under our cybersecurity risk program, we provide all of our employees with periodic cybersecurity training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.


text: Although we are subject to cybersecurity risks, to date, none have materially affected our company, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity risk program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our company. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Our board of directors oversees our risk management process directly and through its committees. The audit committee of our board of directors has the power and responsibility to coordinate our board's oversight over our risk management procedures and to discuss with our management our policies with respect to risk assessment and risk management. Our board of directors has delegated to its audit committee oversight authority of our information security (including cybersecurity) risk management.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Poseida Therapeutics, Inc.


text: Our Enterprise Risk Management Committee, together with the company's security and legal teams as well as third party service providers, help identify, assess and manage the Company's cybersecurity threats and risks. Additionally, the Enterprise Risk Management Committee, the security team, the legal teams and the Company's third party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting assessments of controls, conducting threat and vulnerability assessments, and engaging in simulated penetration testing and tabletop incident response exercises organized by third-party specialists.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining incident response plans and policies, conducting periodic risk assessments, implementing security standards and certifications, encrypting data, maintaining network security controls, segregating data, maintaining physical security controls, system and data monitoring tools, periodic employee security training and simulation testing, penetration testing, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Our cybersecurity risk management framework is based on the National Institute of Standards and Technology's Guide for Conducting Risk Assessments. For example, cybersecurity risks are assessed upon pre-defined matrices of probability and potential impact. Such risks are then recorded within an enterprise risk register along with risk treatment plans for approval from the Enterprise Risk Management Committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, including legal counsel, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under General Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; a material disruption of our product candidates' development programs; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Vice President of IT, Director of IT Operations, and General Counsel.


text: Our Vice President of IT and Director of IT Operations are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes and policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our Security team and General Counsel work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes and policy include reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from the Enterprise Risk Management Committee and the Vice President of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: GlobalX's Audit Committee, comprising board members and senior management from various departments including IT, operations, legal, risk management, and others, diligently engage in regular cybersecurity risk assessments. These comprehensive assessments are designed to proactively identify potential threats, vulnerabilities, and risks that could impact the integrity and security of the company's airline systems, data infrastructure, and operational continuity. Evaluations span critical areas such as safeguarding flight systems, protecting passenger data, and mitigating operational disruptions.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Moreover, the GlobalX Audit Committee remains committed to providing timely updates and detailed reports, offering insights into the airline's cybersecurity posture, ongoing initiatives, prevalent incident trends, and active remediation efforts. These reports are meticulously crafted, incorporating key metrics, performance indicators, and actionable recommendations aimed at continual enhancement.


text: The committee vested with cybersecurity oversight consistently conducts periodic reviews of GlobalX's cybersecurity policies, procedures, and controls. These reviews are pivotal in ensuring the ongoing effectiveness of the company's cybersecurity framework and its alignment with emerging threats and evolving industry best practices. Regular updates are meticulously implemented to fortify the company's cybersecurity resilience in response to emerging risks and evolving regulatory requirements.


text: As of December 31, 2022, and 2023, GlobalX remains proud to report that it has not encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include various security controls, enforcement of company policies, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and other industry-recognized standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.

companyName: Daseke, Inc.


text: We maintain a Cybersecurity Incident Management Policy (Cybersecurity Policy), which provides guidance and processes for identifying, reporting, assessing, resolving and ensuring timely public disclosure, when appropriate, of cybersecurity threats, including both cybersecurity threats directed at our company and those associated with our use of third-party service providers. We have retained a leading cybersecurity incident response vendor to assist us in responding to cybersecurity incidents and we maintain relationships with integration vendors to help us recover or rebuild technology systems in the event of a large-scale cybersecurity incident.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment; • a security team, led by our Senior Vice President that oversees IT (our SVP IT), principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - The Company is dependent on computer and communications systems, and a systems failure, cyber-attack or data breach could cause a significant disruption to its business and cause financial losses."


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee, which reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our SVP IT provides periodic presentations to the Audit Committee on cybersecurity risks. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. Three of the members of our Audit Committee have significant expertise in various aspects of cybersecurity programs.


text: Our SVP IT, in coordination with the Company's executive team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the SVP IT oversees the monitoring, prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the Board when appropriate. Our SVP IT has twenty years of experience in the IT field, including managing risks arising from cybersecurity threats. The SVP IT is supported by a staff of IT professionals. Also supporting our SVP IT in assessing and managing the Company's material risks from cybersecurity threats are the Company's COO, CFO, and General Counsel, each of whom have over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Company's Board of Directors (the "Board") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of its systems and the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect Company systems and sensitive data. This defense model is composed of a variety of different components including administrative, technical controls and safeguards. These various components are centrally managed and monitored creating a multi-layered, interlocking, cybersecurity defense system. We believe this defense system is dynamic and designed to adjust to protect against the latest cyber threats and attack vectors.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Risk Management Committee of the Board (the "Risk Management Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), the Company's Chief Information Officer ("CIO"), other members of management. • Incident Response and Recovery Planning: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that establish a structured approach for the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Outside Experts. The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reviewed by the Cybersecurity team and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Board Oversight of Risks from Cybersecurity Threats The Board, in coordination with the Risk Management Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Risk Management Committee discuss the Company's approach to cybersecurity risk management with the Company's CISO and CIO.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A - Risk Factors - We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our or our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers."


text: Management's Role in Assessing and Managing Risks from Cybersecurity Threats The CISO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CIO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Management Committee when appropriate.


text: The CISO has served in various roles in information technology and information security for over 15 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in Information Networking and Telecommunications, a graduate degree in Cybersecurity, and has attained the professional certification of Certified Information Systems Security Professional. The CIO holds an undergraduate degree in Business Finance and has served in various roles in information technology for over 30 years, including serving as either the Chief Information Security Officer or Chief Information Officer of two public companies.


text: Risk Management and Strategy We have implemented and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of our critical systems and information, as well as to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our systems and processes are assessed by independent third parties for compliance with: the International Standard Organization ("ISO") 27001; System and Organization Controls ("SOC") 2, Type 2; and Payment Card Industry Data Security Standards ("PCI DSS") Level 1.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management—We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.


text: We regularly review our information security program and associated policies, making periodic updates as we deem necessary and appropriate in accordance with recognized best practices and standards.


text: Our information security program and cyber risk management program is managed by our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years.


text: Management holds monthly Information Security Management System (ISMS) meetings which include members of the executive management team as well as the CIO and other key individuals reporting to the CIO. Cybersecurity risks, threats, and vulnerabilities, as well as existing mitigating controls, are discussed in ISMS meetings. Our CIO also provides quarterly reports of our information security program, as well as any material cybersecurity risks, to the board of directors.


text: The Company did not experience a material cybersecurity incident during the year ended December 31, 2023. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on the Company's business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.


text: We recognize the critical importance of maintaining the trust and confidence of customers, suppliers, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. Our customers' requirements for their suppliers to have certain cybersecurity policies, standards and processes in place also drives and guides some of our policies and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks. The program includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director of Information Security.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, International Organization for Standardization and the Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees, Board members and certain contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats and incident response preparedness, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for current employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we periodically engage with consultants, auditors and other third parties, including having independent third-party consultants review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers who have access to customer, supplier and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we endeavor to require those third parties that could introduce significant cybersecurity risk to us to agree to manage their cybersecurity risks in specified ways.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business and Strategy" which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats.


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Security and Chief Information Officer. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our Audit Committee and Board of Directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Members of our Audit Committee and Board of Directors continue to receive updates around the cybersecurity threat landscape and ongoing best practices as a means of continuing education in the area. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, Director of Information Security, Chief Financial Officer and Chief Legal Officer. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, Certified Professional Hacker. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: The Audit Committee of the Board has primary responsibility for overseeing our cyber security risk management process. Our cybersecurity risk management processes are integrated within our established Enterprise Risk Management System. On a regular basis, the Audit Committee and the Board receive updates on cybersecurity matters from the Chief Information Officer ("CIO"). These updates include, but are not limited to, cybersecurity program updates, results of third-party assessments, results of tabletop 'drill' exercises, end user awareness training, and recoverability and resilience. The Audit Committee also receives quarterly reports from our internal audit department.

companyName: SUPERIOR ENERGY SERVICES INC


text: Our cybersecurity practices are led by the CIO, who has overall responsibility for assessing and managing cybersecurity risks, and uses a risk-based methodology to support the security, confidentiality, integrity and availability of information and IT systems. Our CIO has over 30 years of experience in IT delivery, operations, and management, as well as over 15 years' experience leading cyber security requirements for global and publicly traded companies.


text: The Company regularly engages third parties to perform assessments on our cybersecurity measures, including penetration testing, vulnerability scanning and proactive threat hunting, and operating effectiveness of controls. The results of such assessments, audits, and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits and reviews. The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems. In addition, our internal audit department routinely performs internal audits on various aspects of cybersecurity and reports the results in its quarterly report to the Audit Committee.


text: The underlying controls of our cybersecurity capabilities are designed to prevent, detect, mitigate and remediate cybersecurity risks and are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organizational Standardization ("ISO") 27001 Information Security Management System Requirements.


text: Significant incidents are escalated and communicated by senior IT management to the CIO to determine severity, cause and remediation. We also maintain a disaster recovery plan in which critical business systems, networks and data may be successfully recreated to minimize the financial impact of a cyber incident on our business. To strengthen resiliency against malware attacks, such as ransomware, we create immutable copies of all critical system data that is isolated from the rest of the network in case data recovery is required.


text: Our third-party cyber partners are a key component of our cybersecurity capabilities, and we partner with leading cybersecurity companies, leveraging third party technology and expertise. Through these partnerships, we provide continuous monitoring of our global cybersecurity environment and coordinate the investigation and remediation of alerts. Additionally, annual incident response drills are in place to prepare support teams in the event of a significant incident.


text: We have continued to expand investments in IT security. For example we are in the process of implementing a Cyber & Data Protection Council that will use a risk-based methodology to support the security, confidentiality, integrity, and availability of our information and IT systems. The Cyber & Data Protection Council will be chaired by the CFO and members include IT, legal, and HR leadership. Significant incidents will be escalated and communicated by senior IT management to the CIO and the Cyber & Data Protection Council to determine severity, cause and remediation.


text: We did not experience a material cybersecurity incident in 2023, and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors – Our operations may be subject to cyber-attacks that could have an adverse effect on our business operations."


text: Cybersecurity Risk Management and Strategy We recognize the importance of maintaining the safety and security of our critical systems, information, products, services and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Cybersecurity risks are addressed as a component of our enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business. Features of our program include: • periodic risk assessments designed to help identify material cybersecurity risks to our Information Systems and Data; • a security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • a cyber and data security incident response plan that establishes policies and procedures for identifying, managing and recovering from cybersecurity incidents, including escalating tiers of notification depending on an incident's nature and severity; • periodic tabletop exercises with management and other employees to discuss and prepare potential cybersecurity incident responses; • the use of third-party service providers, where appropriate, to assess, test and assist with aspects of our security controls; • a third-party risk management process for our service providers, suppliers and partners; • cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • policies and procedures that relate to cybersecurity matters, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices; and • required privacy and cybersecurity training (including spear phishing and other awareness training) for employees.


text: The techniques used to obtain unauthorized access, to disable or degrade service or to sabotage systems change frequently. As a result, we have invested and continue to invest in the security and resiliency of our networks to help protect our Information Systems and Data. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity and Intellectual Property" section of this Report.


text: Cybersecurity Governance Our Board is responsible for overseeing our enterprise risk management activities in general, and each of its committees assists in this role of risk oversight. Our Board has delegated the monitoring and oversight of risks related to cybersecurity and information technology to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Technology Officer, internal information security team and third-party experts.


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives regular updates from our Chief Technology Officer and other members of management on the cybersecurity risks that they view as most relevant to our business, our cybersecurity strategy and current cybersecurity trends, as well as other updates, as necessary, regarding certain cybersecurity incidents.


text: A cross-functional management team, which includes members of our information security, technical infrastructure, engineering and legal departments, is responsible for identifying, assessing and managing the risks from cybersecurity threats that are relevant to our business (and, depending on a threat's potential nature and severity, reporting such information to our Audit Committee). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers and communicates our cybersecurity risk management processes to senior management, as well as to our Board and Audit Committee. This team reports to our Chief Technology Officer, who has more than 25 years of experience in the technology sector, and possesses more than 75 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, also hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager (CISM) and Certified Information Systems Auditor (CISA)) and ISC2 (Certified Information Systems Security Professional (CSSP)). This team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. (“Invesco”), the Sponsor’s parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Invesco’s information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco’s information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is Invesco’s investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Invesco’s Board of Directors oversees cybersecurity risk and receives updates at a minimum, of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco’s risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.’s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco’s Enterprise Risk Management Committee which provides updates to the Invesco Board to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Trust’s business strategy, results of operations or financial condition, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors.


text: We utilize a third-party managed security service provider to support our information technology services, which include ongoing support for the management of cyber risks and protection of our information technology infrastructure. Our critical business applications are provided and managed by third party cloud software providers.

companyName: MYOMO, INC.

ticker: MYO


text: Our cybersecurity risk management strategy is informed by a recent cyber risk assessment conducted in consultation with our third party managed security service provider. The assessment was informed by industry standards and included an evaluation of our cybersecurity controls. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our efforts to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications. Our efforts to address cybersecurity risks and also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.


text: We have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through review of applicable certifications and security reports, where available, and contractual requirements, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors. We maintain an incident response and a disaster recovery plan, which includes plans around managing cybersecurity incidents, and is intended to serve as a guide for management of such events and to set forth communication procedures regarding potential impacts to our board, investors, and other stakeholders, as appropriate.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluation, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.


text: The Chief Financial Officer periodically provides reports to the audit committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The audit committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The audit committee periodically reports on cybersecurity risk management to the full board of directors.


text: We recognize the importance to our business and reputation of the continuous availability of our internal and client-facing information technology systems, as well as our ability to protect both the confidential information of our clients and our own intellectual property and business information. We are committed to protecting our client and business data and information technology assets and have implemented a cybersecurity program with policies, standards, processes and practices governing the protection and control of information during its lifecycle of creation, usage, transmission, storage and disposal.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Cyber Risk Management and Strategy We have implemented and maintain a risk management program that includes processes for the identification, assessment, management and mitigation of cybersecurity risks. This program utilizes numerous technological and human security controls, processes, and procedures to address risks including, but not limited to, those identified by threat intelligence providers, internal stakeholders, and security management programs. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Our risk management program is documented in our written Information Security Policy. We periodically update our Information Security Policy, along with other policies and procedures, to adapt to evolving business conditions and threats.


text: Included in our Information Security Policy is a documented incident response plan to identify, assess, manage and mitigate cybersecurity incidents. As part of our risk management program, we maintain a technology management security team, led by our Information Security Officer (ISO). Among their responsibilities, our technology management security team is responsible for conducting due diligence on software, hardware or services vendors where access to systems or data of Forrester or our clients is contemplated. The security team assesses whether these vendors have appropriate privacy and security controls and whether there are adequate contractual protections in place. We also engage external security assessment vendors from time to time to conduct penetration testing and vulnerability assessments and to report findings to management.


text: All new Forrester employees and contractors receive a copy of the Information Security Policy and are required to undergo information security and privacy training both as part of their onboarding and on an annual basis. We currently also maintain cybersecurity insurance covering the company and its subsidiaries.


text: While to date we are not aware of having experienced any material cybersecurity threats or incidents, and we do not believe that risks from such threats or incidents are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a successful material threat or incident. Additional information on cybersecurity risks we face can be found in "Item 1A, Risk Factors" under the heading "We face risks from network disruptions or security breaches that could damage our reputation and harm our business and operating results."


text: Governance Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Information Officer (CIO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.