text: We monitor our environment for cybersecurity threats with real-time ability to activate measures to minimize impact, respond to incidents, and investigate issues. We routinely conduct security assessments of our applications, manage vulnerabilities, and perform penetration testing as well as exercises that mimic cybersecurity incidents to evaluate and enhance our security posture and lower cybersecurity risk. In addition to our own systems and technology, we rely on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. We have policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. We have developed, and seek to incorporate, standard contractual security requirements into our service provider agreements. We also perform cybersecurity assessments of third-party service providers where we deem appropriate given the nature of the engagement and the data and systems expected to be accessed.


text: We have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial situation. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident or will not experience a cybersecurity incident in the future. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: OSI SYSTEMS INC

ticker: OSIS

secItem: Item 1C


text: Several members of the Board comprise the Risk Management Committee (RMC), which is responsible, among other things, for oversight of cybersecurity risks based on the authority given by our Board of Directors. The RMC receives regular updates at least quarterly from management, including our Chief Information Officer (CIO) and our Information Security Officer (ISO) with evaluations of cyber risk, the threat environment, updates on incidents, and advancements on investments in cybersecurity risk reduction. Our CIO has been with the Company since January 2021 and has over 25 years of global experience. He has served in numerous senior leadership positions where he gained significant cybersecurity and risk management experience across multiple high-tech industries. Our ISO has been with the Company since July 2018 and similarly has over 25 years of extensive cybersecurity, risk and compliance experience including CISSP and CISM certifications.


text: Information Security, Corporate Audit, Finance, Legal, Compliance and Investor Relations have a strong partnership at the management level and have established a Cybersecurity Council that connects the risk management and cybersecurity incident response processes. In the event of a cybersecurity breach, the ISO will inform the Cybersecurity Council, and then the Cybersecurity Council will determine materiality and next steps. The Cybersecurity Council will meet with the RMC and/or the full Board as needed to share details of the event and facilitate reporting to regulators as required.


text: Cybersecurity Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. Our IT staff along with the third-party providers and outsourced IT services monitor and address cybersecurity related risks, including installing software for threat protection and malware. Our IT staff and such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.

companyName: TECHPRECISION CORP

ticker: TPCS


text: We continue to work with outside counsel and third - party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.


text: Our Chief Executive Officer is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff and third-party service providers. Our IT staff at both Ranor and Stadco oversee their respective cybersecurity processes on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above, and escalate matters to our Chief Executive Officer as appropriate.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Our Chief Executive Officer provides periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk Management and Strategy We maintain a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity and availability of our information systems. Dedicated security and information governance and compliance professionals administer the program with oversight by our senior management team.

companyName: AECOM

ticker: ACM


text: We utilize a combination of technology controls, service providers, and processes to actively monitor and protect our network and systems. All employees are required to participate in a number of information security training and awareness programs on an annual basis, which include training on how to identify and report cyber risks and events.


text: We engage industry cybersecurity experts to evaluate and review our cybersecurity programs. These external reviews include regular audits, threat assessments, vulnerability scans, simulated attacks and other advice regarding information security practices. We regularly conduct incident response exercises with key stakeholders.


text: To manage risks associated with third-party service providers, we typically perform a cybersecurity assessment on new vendors before they are onboarded as a supplier. We conduct periodic reviews of these vendors to evaluate continued compliance with our policies and standards. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of significant cybersecurity incidents, by virtue of the documents governing their relationship with us or applicable law.


text: Our Board of Directors ("Board") receives regular updates from management and external consultants which may address a broad range of cybersecurity and IT topics, including trends, regulatory developments, data security policies and practices, cybersecurity incidents, and ongoing efforts to further strengthen our security posture. Our Board reviews key metrics related to cybersecurity on a quarterly basis, and is notified of applicable cybersecurity incidents if and when they occur.


text: The Chief Information Security Officer ("CISO") heads the cybersecurity program which includes personnel based in several of our global locations. Our CISO brings over 25 years of experience, which includes both consulting and practitioner roles, and maintains the following certifications: Certified Information System Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CISO reports to our Chief Information Officer, who meets with our Board at least annually to discuss cybersecurity risk and related topics.


text: Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: In the event of a cybersecurity incident, we have a plan which sets forth a framework to report such incidents to our cybersecurity incident response team. This framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. As part of this incident response plan, we have retainers in place with professional service firms to assist with cybersecurity incidents if needed.


text: Cybersecurity Risks, Threats and Material Incidents While we are not aware of any cybersecurity incidents that have materially affected us through the date of this report, there can be no guarantee that we will not be the subject of future material cybersecurity incidents. Additional information on cybersecurity risks that we may face can be found in Item 1A – Risk Factors – of this Form 10-K.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology (NIST) Cybersecurity framework and the Cybersecurity Maturity Model Certification (CMMC) program to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. In the event of an incident, we intend to follow our detailed incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST and CMMC standards and industry best practices.


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors."


text: Cybersecurity Governance Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Senior Director of IT who has over 20 years of experience as an IT professional engaged in network architecture and cybersecurity. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which includes updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies and processes are fully integrated into our Risk Management procedures and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. We plan to brief the Board of Directors on our strategy and roadmap in alignment with the NIST Cybersecurity Framework and we plan to provide our Board with regular updates regarding cybersecurity risks, threat landscape and overall program progress.

companyName: EACO CORP

ticker: EACO


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business, including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Part I, Item 1A. " Risk Factors," of this Annual Report.


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of our internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors 24/7 to monitor and respond to security threats. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.


text: Data and Consumer Privacy Our data and consumer privacy program monitors, adapts to and works diligently to comply with changes in global privacy legislation. We have implemented technical, procedural and organizational measures designed to comply with applicable data protection and consumer privacy laws. We conduct external benchmarking, as well as privacy compliance audits, to stay abreast of developing privacy laws and understand developing risks, best practices and industry trends.


text: Third-Party Risk Management We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems. The Company has processes in place to oversee and manage these risks. We have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to our use of key third-party service providers.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, our cybersecurity program is led by the Director of Information Technology ("Director of IT"), who reports to the President and COO. Our Director of IT has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint and attends training in cybersecurity and risk mitigation.


text: We plan to provide our Board of Directors with a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the President also will report to the Board of Directors on various metrics on threat management, incident response and recovery planning, along with industry benchmarks.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company in which cybersecurity is a critical component. Our Chief Information Officer and Information Security Officer are primarily responsible for the cybersecurity program. The Chief Information Officer reports directly to the CEO and the Information Security Officer reports directly to the Chief Risk Officer to maintain independence. Our Information Security Officer provides periodic reports to the Board Audit Committee, the Enterprise Risk Management Committee, Operational Risk Committee and Information Security Committee regarding the Cybersecurity/Information Security Program.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: We engage in regular monitoring and assessments of our technology infrastructure utilizing our internal staff and third-party specialist. Our independent auditors periodically review our processes, systems and controls related to our information security program to ensure they are operating effectively.


text: Measures Taken to Mitigate Cybersecurity Risks To mitigate the risk of cyber threats, we have implemented a comprehensive set of technical, organizational, and procedural safeguards that are designed utilizing the Cybersecurity Framework of the National Institute and Standards and Technology (U.S. Department of Commerce), industry standards and regulatory guidance that include the following:


text: Governance and Oversight: A dedicated Information Security Committee oversees our cybersecurity strategy, with executive leadership providing strategic direction. The Information Security Committee reports up to our Operational Risk Committee comprised of Executive Management and subsequently reports up to the Board Audit Committee.


text: Data Protection: We utilize advanced encryption and access controls to protect sensitive data both in transit and at rest. Regular audits are conducted to identify and address any vulnerabilities in our data storage and transmission practices.


text: Employee Training and Awareness: We conduct regular cybersecurity training and awareness programs for employees at all levels to ensure they understand and follow best practices in identifying and reporting potential cyber threats, including phishing attacks and social engineering tactics.


text: Third-Party Risk Management: We assess the cybersecurity practices of third-party vendors and partners, particularly those with access to sensitive information or critical systems and require them to adhere to security standards that align with our own policies.


text: Incident Response: We have a detailed Incident Response Plan that outlines how we would respond to an actual or potential cybersecurity incident. The plan includes the appropriate notification and escalation requirements including timely reporting to our CEO and Board of Directors and engagement of appropriate third parties such as insurance providers and incident response professionals.


text: Resilience and Recovery: We have developed and regularly test our business continuity and disaster recovery plans to ensure a swift recovery in the event of a cybersecurity incident. This includes regular backups, redundant systems, and an established communication protocol.


text: Ongoing Efforts and Improvements We continue to enhance our cybersecurity posture by investing in the latest technologies and partnering with leading cybersecurity experts. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats. Our Information Security Officer has extensive bank operations experience, has attained Certified Information Security Manager certification with the Information Systems Audit and Control Association, and attends relevant cybersecurity training sessions on a regular basis. Our CIO brings over 25 years of extensive experience in the banking industry, encompassing a diverse range of expertise, including software development, managed services and support, independent consulting, penetration testing, and bank management. This multifaceted background equips them with a unique perspective and deep understanding of both the technical and operational aspects of the financial sector. We remain committed to continually improving our cybersecurity infrastructure and to monitoring for new and evolving threats.


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that generally aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage these material risks, safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners, and employees.

companyName: Energy Services of America CORP

ticker: ESOA


text: Risk Management and Strategy The Board of Directors is actively involved in oversight of the Company's risk management framework. The Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity awareness. This integration ensures cybersecurity considerations are an integral part of decision-making processes across the organization.


text: The Company's risk management team collaborates closely with its internal IT team to evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures to ensure the prompt escalation of cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive timely and appropriate information.


text: Given the complexity and evolving nature of cybersecurity threats, the Company engages external experts, such as cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. These engagements include audits, threat assessments, and consultations on security enhancements. Such collaboration ensures the Company leverages specialized knowledge to maintain cybersecurity practices aligned with industry standards. Utilizes advanced technology solutions, such as proactive detection tools, to safeguard its assets and identify threats within its environment.


text: Conducts cyber education and awareness training sessions to equip employees with the necessary knowledge and foster a strong security culture. Analyzes internal and external cybersecurity incidents and threat intelligence to assess relevance to its environment and industry. Performs recovery testing to ensure the resilience of critical systems and support business continuity.


text: Implements stringent oversight of third-party service providers, including conducting security reviews before engagement and ongoing monitoring to ensure compliance with the Company's cybersecurity standards.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. As discussed below, members of management advise the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Chief Information Officer ("CIO"), Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity. The Board conducts an annual review of the Company's cybersecurity posture and risk management strategies to identify areas for improvement and maintain alignment with the Company's overall risk management framework.


text: The Company's CIO has over 20 years of experience in the field of technology and security and is instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies. The internal IT team is responsible for the day-to-day implementation of the Company's cybersecurity risk management programs, testing compliance with standards, remediating known risks, and leading employee training programs. The team monitors the latest developments in cybersecurity, including potential threats and innovative risk management techniques, to help prevent, detect, and mitigate cybersecurity incidents.


text: In the event of a cybersecurity incident, the IT team implements the Company's incident response plan to mitigate immediate impacts, implement remediation strategies, and prevent future incidents. The team also ensures that senior management is regularly informed about material cybersecurity risks and incidents to maintain alignment with organizational priorities.


text: As of the date hereof, the Company has not encountered cybersecurity incidents that the Company believes to have materially affected or are reasonably likely to materially affect the Company taken as a whole, including its business strategy, results of operations or financial condition.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Aldel Financial II Inc.

ticker: ALDF


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our IPO.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program, which we have continued to invest in developing. Our corporate cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party vendors and service providers, and facilitating coordination across different business units of the Company. Our corporate cybersecurity risk management program is based on and audited against industry standards, including ISO 27001 for Information Security Management Systems (ISMS) and the automotive industry's Trusted Information Security Assessment Exchange standard (TISAX).

companyName: Mobileye Global Inc.

ticker: MBLY


text: Our corporate cybersecurity team is responsible for operating our cybersecurity risk management program. The cybersecurity team determines with management an annual workplan for risk assessments, reviews, audits and tests. The cybersecurity team also conducts vulnerability assessments, security reviews and penetration tests on a regular basis in accordance with such workplan. Following risk assessments that require any remediation, the cybersecurity team then conducts a risk treatment and response process, including mitigation, remediation and risk reduction efforts. Our policies also require that Internet-accessible enterprise systems and applications must undergo a penetration test at least annually, and we engage specialized, independent, third parties to conduct penetration tests and specific in-depth reviews of certain enterprise systems and applications.


text: With respect to overseeing and identifying cybersecurity risks associated with third parties, we seek to impose certain cybersecurity requirements on critical third parties with whom we do business. The cybersecurity team performs risk assessments, due diligence checks and validation of key security controls in accordance with our cybersecurity policies and standards for third-party vendors and service providers with whom we exchange information or integrate our information systems and networks. We include cybersecurity and privacy addenda and clauses in our agreements with such third parties where applicable and seek to pass through any necessary regulatory and contractual requirements to such third parties. When we do become aware that a third-party vendor or service provider has experienced a compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate or by exercising any applicable contractual remedies we may have, such as a right to indemnification.


text: On a semi-annual basis the cybersecurity team conducts a program performance evaluation with management to assess the continuing suitability, adequacy and effectiveness of the Company's cybersecurity risk management program, including with respect to the fulfillment of cybersecurity objectives and compliance with industry standards, and to recommend changes to the Company's threat modeling, priorities for future risk assessments, policy adjustments in response to newly identified risks or non-compliance, and overall risk acceptance.


text: To foster a culture of cybersecurity awareness within the Company and provide employees with further knowledge of cybersecurity-conscious behavior, all employees of the Company are required to attend cybersecurity training sessions during the onboarding process and at least once per year.


text: Our organizational cybersecurity program is under the direction of our Chief Information Security Officer ("CISO") who receives reports from our cybersecurity team and oversees the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Our CISO reports to our Chief Operating Officer ("COO"), who may discuss cybersecurity risks and other operational risks with other senior management as appropriate. Our CISO and dedicated cybersecurity team personnel are certified and experienced information systems security professionals and cybersecurity managers with many years of experience. Our CISO has served in that position since 2019 and has over 25 years of managerial and professional cybersecurity expertise. He has held the role of CISO and other senior management positions with NDS, Cisco and Deloitte and has also served as cybersecurity consultant for companies in multiple global industries. Our COO has extensive experience in project management and cybersecurity, including from past roles with Verint - Systems and Cisco Systems as well as the establishment and management of the Company's cybersecurity team prior to our CISO joining the Company.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity team regularly meets with the COO to report its findings. The COO in turn periodically reports on such matters to the Chief Executive Officer and other members of management.


text: The COO and CISO provide updates to the audit committee of our board of directors (the "Audit Committee") on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies. In addition to such regular updates, and as part of our incident response processes, our COO is also responsible for informing the Audit Committee of material cybersecurity threats and incidents, based on management's assessment of risk.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents. Both management and the Audit Committee also report material cybersecurity risks to our full board of directors, based on management's assessment of risk.


text: In 2024, we did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Privacy, Data, and Cybersecurity" in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have developed a cybersecurity risk management program to regularly assess risks from cybersecurity threats and monitor our systems to manage those risks. Our cybersecurity risk management program is an important component of, and integrated with, our overall enterprise risk management framework, which addresses legal, compliance, operational, and financial risks, alongside cybersecurity risks. Through this integration, we aim to optimize resource allocation, improve risk identification, and strengthen our cybersecurity governance.

companyName: Waystar Holding Corp.

ticker: WAY


text: Our cybersecurity risk management program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) and is aimed to assess, identify, and manage risks from cybersecurity threats. The processes comprising our cybersecurity risk management program include risk assessments, vulnerability scanning and penetration testing, threat intelligence monitoring, and employee training and awareness programs. To respond to and handle cybersecurity incidents, we have implemented and maintain a comprehensive incident response process that is regularly tested and updated.


text: To protect our information systems from cybersecurity threats, we employ technical processes as a crucial component of our multi-layered cybersecurity risk management program. These processes include firewalls, intrusion detection and prevention systems, access controls, endpoint protection, data encryption, vulnerability management, security information event management, data loss prevention, regular security assessments, and penetration testing. Our technical processes are regularly reviewed and updated.


text: As part of our cybersecurity risk management program, we undergo regular assessments and audits by external and independent auditors. These include assessments following the Health Information Trust Alliance (HITRUST) Common Security Framework. We also undergo independent System and Organization Controls 2 (SOC 2) Type 2 audits and assessments to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirements. We carry a HITRUST certification and PCI certification. The results of these audits and assessments are reported to our Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary or appropriate based on the information provided by these assessments and audits.


text: Our cybersecurity team, which is led by our Digital Information & Cybersecurity Officer (DISO), implements and maintains our cybersecurity risk management program and is dedicated to mitigating risks and protecting the confidentiality, integrity, and availability of our systems and data. Our cybersecurity team's functions include security operations, vulnerability management, security engineering and architecture, compliance and audit support, threat intelligence, security awareness training, and policy development. Our cybersecurity team is also responsible for developing and executing the incident response plan.


text: Because we rely on third-party vendors, including for information technology services, we have processes to oversee and identify risks from cybersecurity threats associated with our third-party vendors. These processes include vendor screening and due diligence, contractual requirements, security assessments and audits, incident response planning requirements, and ongoing monitoring.


text: We are not aware of any risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A "Risk Factors," there is a risk that we could experience a security incident and a compromise of our information technology systems and data. There is no assurance that our cybersecurity program will in all cases prevent such security incidents. We also maintain cybersecurity insurance that we regularly review to assess for appropriate coverage.


text: Role of the Board Our Board of Directors plays an active role in overseeing our cybersecurity risk management program. The Board of Directors or the Audit, Compliance, and Risk Committee receives a quarterly update on cybersecurity-related topics. The Board of Directors receives materials every quarter and presentations on alternating quarters from our Chief Technology Officer (CTO) on topics including significant cyberattacks and emerging threats, cybersecurity program performance, results of risk assessments, incident response updates, cybersecurity strategy, and cybersecurity program maturity. We have also established procedures for promptly informing the Board of Directors of any material cybersecurity incidents outside of these scheduled briefings.


text: Role of Management Our DISO is responsible for developing and implementing our cybersecurity program and holds certifications including ISO/IEC 27001:2002 Certified Information Security Executive, Cyber Security Executive Certification from Cornell University, Risk & Compliance Executive Certification from William & Mary University, and Healthcare Risk & Compliance Certification from American College of Medical Practice Executives (ACMPE). Our DISO's responsibilities include managing cybersecurity risk, leading the cybersecurity team, staying informed about threats, reporting on cybersecurity performance, promoting a culture of security, and compliance and audit support. Our DISO regularly updates senior management and the Board of Directors on the performance of the cybersecurity program and the state of cybersecurity risk. Our DISO reports directly to our CTO who provides executive leadership and support for the overall technology and cybersecurity strategy.


text: To promote strong governance and oversight in managing cybersecurity risk, we have established a Cyber Risk Council, which is composed of our CTO, DISO, Chief Privacy Officer, Chief Financial Officer, Chief Legal & Administrative Officer, and representatives of our technology and cybersecurity teams. The Cyber Risk Council is responsible for overseeing cybersecurity risk, monitoring performance of the cybersecurity risk management program, providing strategic guidance, and direction of the cybersecurity risk management program, among other oversight and monitoring functions.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Concord Acquisition Corp II

ticker: CNDA


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Board oversees management's execution and performance of its risk management responsibilities, which includes cybersecurity threats. The Board receives at least one cybersecurity report every quarter from our Chief Information Officer, our Chief Information Security Officer, our Chief Risk Officer or other professionals. The Board also reviews and approves the business resiliency and information security programs intended to guard against cybersecurity and related risks. Lastly, the Board receives input on cybersecurity issues from external entities such as our independent auditor, regulators and consultants. Each of these steps further the Board's efforts to ensure we have established and are proactively maintaining an enterprise-wide cybersecurity risk program with appropriate policies, practices and controls designed to ensure resiliency in the face of emerging threats.


text: Management holds relevant expertise in assessing and managing cybersecurity threats. Numerous members of management and employees across the information security and risk functions hold nationally recognized designations and certifications, including the Certified Information Systems Security Professional designation, Global Information Assurance Certifications and Amazon Web Services Cloud Certifications. We also provide role-based security training to workers with assigned information security-related roles and responsibilities. This includes topics on social engineering tactics and other general threats posed for system compromise and data loss. The initiatives and processes discussed further below also contribute to the expertise and experience of management.


text: The framework for our overall process for managing risk encompasses the management of risks posed by cybersecurity threats. Management's role, responsibilities and processes for identifying, assessing, monitoring, reporting and managing risks, which includes cybersecurity risks, is discussed further in Item 1. "Business — Risk Management." As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization.


text: We test for and resolve vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing and adversary emulation, also known as red teaming and hire a third party to do the same at least once a year. We maintain a vulnerability disclosure program to enhance discovery and remediation of external-facing vulnerabilities. We also undergo a third party maturity assessment of our information security program every two years and a third party enterprise penetration test annually. We leverage external resources to help define information security and technology standards for our environment.


text: Our cybersecurity controls are monitored and refined based on learnings from regular red team engagements and analysis by third party threat hunters. All cyber defense operations are supported through a dedicated cybersecurity threat intelligence function. We collaborate with information security peers across the industry to augment threat intelligence. Our threat intelligence program helps create awareness and understanding of potential cybersecurity threats and adversaries.


text: We proactively assess potential risks presented by new services or systems integrated with our network or data and ensure appropriate controls are applied under such circumstances. We have proactive security controls built into our software development life cycle that help engineers identify and resolve security issues at every stage of software development. Our identity verification processes, which include multi-factor authentication and other identity verification technologies, provide further protection for clients and customers. We perform due diligence and monitor third party relationships to assess the suitability of their cybersecurity controls and protocols based on risk profile for the business operations or services for which they are engaged.


text: Our awareness and training program is designed to create a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have trained our employees to recognize and resist phishing attempts with our simulated phishing program. At least quarterly, our employees are presented with simulated phishing scenarios that deliver hands-on experience and on-the-spot education opportunities. All engineers and employees holding equivalent roles who are involved in software development also receive mandated secure software development training.


text: We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise. The plan ensures stakeholders across the organization are identified who have the appropriate experience, training and expertise in incident management and that the organization is well positioned to address incidents. For example, we carry out cybersecurity incident response exercises to develop widespread familiarity and experience in responding to cybersecurity incidents.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: As we have positioned ourselves as a public company acquisition vehicle, and have limited operations, we do not have any significant operations that face cybersecurity threats. Although we do depend on the digital technologies of third parties, and any deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, information and sensitive or confidential data, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Viskase Holdings, Inc.

ticker: ENZN


text: We are a special purpose acquisition company with no business operations. Since inception, our sole business activity has been to complete the Proposed Offering. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: FG Merger II Corp.

ticker: FGMC


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our inception


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining a firm cybersecurity posture to safeguard our information systems, protect the confidentiality, integrity and availability of our data and mitigate risks associated with cyber threats and attacks.

companyName: INNODATA INC

ticker: INOD


text: We are ISO/IEC 27001:2022 certified and the ISO Information Security Risk Management Standard is used as a reference guide for our risk management approach. We have a designated Chief Information Security Officer (CISO) who has primary responsibility for managing our cybersecurity risks. Our CISO has more than 28 years of experience in Information Security and holds a master's degree in Information Technology. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO is assisted by a team of Information Security Officers (ISOs) and a third-party consultant who has expertise in cybersecurity, information security risk management, and information systems audit and holds various certifications including, CISA, CISM, HITRUST Certified Common Security Framework Practitioner, QSA, and CSP.


text: Recognizing the inherent cybersecurity risks common to any organization, encompassing concerns such as unauthorized access to sensitive data, potential disruptions to business operations from cyber incidents, and the associated financial and reputational impacts arising from a cybersecurity breach, we have implemented comprehensive policies covering various aspects of cybersecurity and information management, including, without limitation, cyber risk management, information security practices, roles and responsibilities, access controls, cryptography, information classification, asset disposal, and vendor management. We periodically review and modify these policies to align with industry practice, trends and evolving threat landscapes. Compliance with these policies is expected from all employees and contractors.


text: We perform periodic assessments for identifying threats and vulnerabilities, covering relevant operational facets, and focusing on identifying, analyzing, evaluating, and treating cyber risks across business functions. Our risk assessment guidelines define risk measurement and prioritization, and consider factors such as likelihood, impact, and potential harm. Mitigation strategies are planned, covering technical and procedural measures, including incident response plans.


text: Incident Response We maintain a comprehensive incident response plan. Key components include regular updates to ensure effectiveness, employee training programs, and establishing communication channels and relevant systems for proper incident reporting and logging procedures. Communication and notification protocols are defined for notifying third parties such as regulatory bodies, customers, and partners. Recovery strategies are developed for restoring normal operations, and post-incident analysis is conducted to identify lessons learned and improvements for future incident response efforts. The incident response plan also outlines procedures for prompt detection, response, and remediation efforts to minimize the impact of incidents.


text: Incident materiality is assessed through a collaborative process involving key personnel within our organization. Responsibility for conducting a materiality assessment lies with our management team, in consultation with advice from our third-party cybersecurity consultant, as appropriate. The materiality assessment considers various factors, including financial impact, reputational risk, regulatory implications, and potential harm to third parties. Upon completion of the materiality assessment, the disclosure of incidents, including those related to contractual, regulatory, or technology/security aspects, is handled by designated members of our senior management team. We consult with outside counsel or experts as appropriate, including on materiality analysis and disclosure matters.


text: As of the fiscal year ending December 31, 2024, there have been no identified cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Engagement of Third Parties Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged a third-party consultant to assist with evaluating and testing our risk management approach. This enables us to leverage specialized knowledge and insights in connection with our cybersecurity strategies and processes.


text: To enhance our current cybersecurity posture, we continue to invest in advanced threat detection technologies, provide cybersecurity training based on the latest trends and guidance to the employees, collaborate with industry partners and regulatory bodies to stay informed about emerging threats, reinforce our cybersecurity incident response plan to align with industry-specific regulations and legal obligations, integrate threat intelligence feeds for automatic detection of any misconfigurations, security threats, and foster a collaborative, cross-functional, and accelerated approach to incident response.


text: Cybersecurity Governance Our Board of Directors is aware of the critical nature of managing the risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.


text: Board of Director Oversight Our Audit Committee has primary responsibility for overseeing risk management, including with respect to cybersecurity. The Audit Committee monitors management's compliance, and reports to the Board of Directors. The CISO, who is responsible for developing our cybersecurity strategy and managing our cybersecurity risks, reports directly to the Audit Committee on these matters.


text: Management's Role Our cybersecurity governance framework incorporates policies, procedures, regular meetings, and controls to manage and mitigate cybersecurity risks. Aligned with industry standards and regulatory requirements, the framework is overseen and regularly evaluated by our leadership team responsible for implementation. Regular risk assessments are conducted to identify and assess potential cybersecurity risks, informing the development of proactive risk mitigation strategies within the governance framework.


text: The governance framework is closely integrated via a structured compliance reporting framework operating across various governance levels. This framework also operates across geographic locations, with location specific compliance meetings conducted at a local management level and led by the CISO with assistance from the ISO team. This structured compliance reporting is intended to ensure that the highest levels of management are kept abreast of potential cybersecurity risks facing the Company, with the escalation of significant cybersecurity matters to the Audit Committee and ultimately to the Board of Directors, as appropriate.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Although our program may not meet the technical requirements of the NIST CSF, we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, as we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards ("PCI DSS") in relation to our program.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment, including, by regularly scanning our environment for vulnerabilities, performing penetration testing and engaging third parties to assess the effectiveness of our technical cybersecurity practices;


text: a multi-disciplinary security team overseen by our Information Security Council, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis;


text: the use of a third-party Managed Security Service Provider ("MSSP") that includes a 24x7 security operations center ("SOC") that is designed to monitor and analyze suspected suspicious activity on our internal network and remediate or escalate activity as appropriate; regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;


text: use of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Detection and Intrusion Prevention (IDS/IPS) that scans data in transit to help detect and prevent the execution of harmful code; and a third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of steps the Company has taken to monitor or mitigate significant cybersecurity risks. The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from our Chief Information Officer ("CIO"), internal security staff and/or external experts, as appropriate, as part of the Board of Directors' continuing education.


text: Our management formed an interdepartmental Information Security Council ("ISC"), comprised of senior executives from multiple disciplines, including our CIO and Vice President of Infrastructure Services, to assess and manage our material risks from cybersecurity threats. The ISC has primary responsibility for our overall cybersecurity risk management program. Our CIO, Vice President of Infrastructure Services, and others within our Information Technology department supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Vice President of Infrastructure Services have a combined 50+ years of experience in information technology, with increasing oversight of cybersecurity responsibilities over the past 20+ years.


text: Our management teams, including the ISC, our CIO, Vice President of Infrastructure Services, and others within our Information Technology department, as appropriate, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy To effectively prevent, detect and respond to cybersecurity threats, we maintain a cyber risk management program under the responsibility of the head of the Information Technology ("IT") function. Our IT head has more than 25 years of IT experience in the biopharmaceutical industry where she has been responsible for technology leadership and digital transformation across core operations. Management and administration of cybersecurity systems and activities are primarily outsourced to consultants who have cross-functional expertise in cyber security and who perform the work under the supervision of the IT head. Our IT head, in turn reports to the Senior Vice-President and General Counsel who is responsible for and knowledgeable of legal and contractual cybersecurity risk for the organization. The program is comprised of policies, standards, architecture, and processes, which are reviewed and updated on a periodic basis. The program leverages a multilayered approach of utilizing different practices, technologies, vendors or techniques without an overreliance on a single vendor. We engage with consultants to help develop and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements, and also evaluate and adopt cybersecurity software from reputable vendors in cybersecurity, some that provide software as a service solutions backed by a Security Operations Center. We also engage separate third parties to provide penetration testing, risk consulting, cybersecurity incident assessment and forensics, as necessary and in addition to IT's internal risk assessment processes. We work with many companies that provide hosted software or support for software systems. It is important for these companies to also have effective cybersecurity measures to protect data and systems. We have a self-attestation form to assess cybersecurity readiness that is sent to select vendors based on a risk assessment. For certain vendors, we request System and Organization Controls (SOC) reports or similar documents to provide assurance that the vendors have audited practices or practices in keeping with our legal requirements even if SOC audit documentation does not exist. We have also engaged legal counsel to advise on cybersecurity matters and we have developed an escalation protocol to report cybersecurity incidents as legally required. No material cybersecurity incidents have occurred to date.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: The program also includes training that reinforces our policies, standards, and practices, as well as the expectation that employees comply with these policies. The training engages personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. We maintain a cybersecurity risk insurance policy.


text: Governance; Board Oversight Our Audit Committee is responsible for reviewing our information security programs, including cybersecurity. Our IT team provides regular updates to the Audit Committee on our IT security strategy, secure score assessments, penetration testing results, and status of risk mitigation activities, where applicable. Our IT team also notifies the Audit Committee and Executive Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities, as appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the Center for Internet Security (CIS) control objectives and benchmarks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS objectives and benchmarks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: cybersecurity awareness training and communications for employees;


text: a dedicated security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity controls to detect cybersecurity incidents or risks within our IT Systems;


text: internal and external risk assessments designed to help identify material cybersecurity risks to our critical systems and information; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our network may be the target of potential cyber-attacks and other security breaches that could have significant negative consequences."


text: The Audit Committee of our Board of Directors is tasked with oversight of the Company network and data security efforts and is responsible for the Company's policies and practices with respect to cybersecurity and enterprise risk management. We have a dedicated Cybersecurity Operations Team in our Information Technology department which reports directly to the CIO. The Cybersecurity Operations Team is primarily responsible for evaluating our security efforts and coordinating with our CIO and other management employees as necessary. The CIO meets with our Audit Committee regularly to update the Audit Committee on any new or identified cybersecurity threats, the Company's cybersecurity efforts and plans for the upcoming quarters. Our Audit Committee also meets regularly with senior management, including our CIO, to receive updates and about the Company's cybersecurity initiatives.


text: Our CEO regularly meets with our CIO to discuss, in part, any significant cybersecurity issues. In addition to the CIO, our Cybersecurity Team and the Information Technology Team are responsible for the day-to-day monitoring of the cybersecurity landscape, the Company's monitoring and response processes and training of Company employees. The Chief Legal Officer, Vice President of Network Strategy and VP of Network Engineering may also be involved, as necessary.


text: Our CIO's experience includes over twenty years of experience in risk management and compliance, incident response, crisis management and security architecture and technology integration. Our Cybersecurity Operations Team includes three certified information systems security professionals and their experience includes cybersecurity architecture, engineering and administration together with the development of cybersecurity policies, practices and training.


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of the Trust's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: The Trust does not have computer systems or networks. Pursuant to the terms of the Trust Agreement, the Trust's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on the Trust, USCI and CPER. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. USCF engages a third-party consultant and service provider to assist with information technology services and advise on USCF's information technology infrastructure. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and the Trust.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Trust Series, including its business strategy, results of operations, or financial condition.


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing the Trust. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to the Trust.


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of USL's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: USL does not have computer systems or networks. Pursuant to the terms of the LP Agreement, USL's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on USL. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. USCF engages a third-party consultant and service provider to assist with information technology services and advise on USCF's information technology infrastructure. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and USL.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is no t aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect USL, including its business strategy, results of operations, or financial condition.


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing USL. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, and management's evaluation of cybersecurity risks material to USL.


text: As a heavily regulated financial services company, the Company has developed a comprehensive cybersecurity process that is designed to protect the security of confidential information. Two of the more significant risks to the Company, both in terms of financial and reputational harm, are a data security breach and/or ransomware attack which cause a material financial loss to the Company and/or materially harms its operational integrity or reputation with its customers as a safe and trustworthy institution. In order to mitigate this risk and comply with the regulatory standards required by the Company's and the Bank's regulators, the Company has developed a cybersecurity program and framework which is administered by a team of experienced professionals and supported by external technology and consulting services. Set forth below is an overview of the Company's risks associated with cybersecurity, its cybersecurity process, the role of management and the Board, and whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Risks Associated with Cybersecurity The Company is often targeted in an effort to obtain unauthorized access to its financial records and confidential information, destroy data, disable or degrade service, or sabotage systems. Such attacks may take various forms, including the introduction of computer viruses or malware, ransomware, phishing attacks, cyberattacks, or breaches due to errors or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to the Company's systems and networks. To date, these threats and attacks have not resulted in a material cybersecurity incident. However, a material failure, interruption or security breach could adversely affect the Company's business and operations through financial losses, remediation expenses, reputational damage, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance. For more information on risks to the Company from cybersecurity threats, see "Risk Factors – Operational Risks".


text: Cybersecurity Process and Management's Role Management is responsible for designing and implementing policies, processes and procedures and deploying physical and virtual technology and safeguards to measure, monitor and control cybersecurity risk. The primary executives responsible for the oversight of risk and cybersecurity are the Company's Chief Risk Officer, who has over 37 years of experience in the banking industry, including 25 years as a national bank examiner for the Office of the Comptroller of the Currency, and the Company's Chief Information Security Officer ("CISO"), who has an educational and experiential background in information technology and information security for public companies (bachelor's degree in computer science and service as the Company's CISO for the past 10 years, with 10 prior years of information technology and information security experience). The CISO leads the members of the Information Security Department, some of whom maintain a variety of certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Security+ (Plus) Certification (SEC+). Both of these executives, along with the other professionals in the Information Security and Information Technology Departments, have the appropriate knowledge and expertise to effectively assess and manage the Company's cybersecurity risk and establish a system of internal controls in an effort to safeguard the Company's network and comply with regulatory requirements.


text: The Company's cybersecurity framework includes an assessment of the Company's hardware, software, and data platforms across its lines of business; the risks associated with the Company's business; areas inside and outside of the Company that expose it to cybersecurity threats. As part of this framework, the Company employs policies, systems and safeguards to manage cybersecurity risks. The Company's CISO is responsible for identifying systems and security measures that reflect the appropriate safeguards designed to protect the Company's infrastructure and information and has implemented the majority of current cybersecurity controls in place with an emphasis on the confidentiality, integrity and availability (CIA) triad and a defense in depth methodology. The CISO uses a variety of threat intelligence resources, including law enforcement and industry groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), to help stay informed about current and emerging risks to the Company.


text: The CISO is also responsible for supervising and monitoring certain outside professionals or third-party service providers that assist in enhancing the Company's current cybersecurity safeguards. The Company has invested meaningful resources to address cybersecurity threats and partners with leading technology companies to implement solutions to address the fast-evolving threat landscape. These solutions and services help with the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: The Company's Internal Audit Department further assists the Company to ensure that the proper safeguards are in place to protect the Company's information by conducting internal audits on certain aspects of the information security program. Internal Audit engages professionals that specialize in information security to review and provide an annual examination and report on the sufficiency of the Company's cybersecurity process and information security program. The Company's independent public accounting firm also performs audit procedures regarding the information security program. In addition, the Company's and the Bank's regulators review and assess the Company's information security program on an annual basis.


text: The Company also maintains certain management committees that further assist in the prevention, detection, and mitigation of cybersecurity risks. Specifically, the CISO works closely with the Company's IT Steering Committee which, among other things, reviews the effectiveness of key controls and provides guidance around future initiatives that strengthen the Company's overall security posture. The IT Steering Committee is comprised of key executives such as the President and Chief Executive Officer and Chief Financial Officer, as well as senior employees that specialize in technology and information security, including the Company's CISO, Chief Technology Officer, and Chief Risk Officer, and representatives from the Board. This committee also monitors current events regarding cybersecurity threats to the Company and more broadly to the financial services industry to help the Company make informed decisions around any necessary internal control enhancements or adjustments. In addition to the IT Steering Committee, the IT Subcommittee assists the CISO to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. The IT Subcommittee typically meets quarterly and consists of members of the information technology and information security teams, the Director of Internal Audit, and senior management members of various business units. This committee is responsible for reviewing information technology and information security projects and the threat landscape.


text: Given the importance of maintaining the security of the Company's systems and information, cybersecurity risks are also reviewed and addressed relative to assessing new products and services and any third-party services providers that may be engaged to provide systems and services to the Company. As an essential element of the Company's cybersecurity program, the Company maintains a third-party service provider management program that assesses and addresses the risks associated with third parties providing systems, software and programs that access the Company's information. As part of this oversight, the Company's Risk Management, Legal and/or Information Security Departments review higher risk and material contracts with third party service providers, which includes an evaluation of the cybersecurity risks presented, any safeguards, and service organization controls reports provided by the third parties. Initial and continuing due diligence is also conducted on third party service providers to ensure that they are fulfilling their contractual obligations and satisfying the Company's data security requirements.


text: The CISO is also responsible for monitoring data security incidents at third parties who have access to the Company's information which may impact the Company or its customers if it was compromised. When the Company becomes aware of such events, the CISO engages with the impacted third-party service providers to understand the incident, assess the risk that the Company's information was released, and determine methods by which the Company can mitigate the damage, if any, and fulfill its notification obligations to impacted parties.


text: In an effort to remain vigilant against cybersecurity attacks, the Company further provides annual and ongoing training to all of its employees so that they have an understanding and appreciation of the cybersecurity environment and risks and the Company's policies to combat such risks. Such training includes annual mandatory training sessions on cybersecurity for all employees, periodic informational notices regarding emerging threats, and periodic testing to ensure employees are reporting suspicious activities and are diligent in their efforts to avoid phishing attacks and cybersecurity breaches. The CISO also conducts and participates in annual table top exercises with management, and periodically with Directors, in order to be prepared in the event of a material cybersecurity event.


text: The Company's cybersecurity process and its ability to assess, manage, and remediate cybersecurity risks further centers around good communication among management. Management stays informed on cybersecurity risks through open communication with the Risk Management team, including through various reports and weekly reporting by the Chief Risk Officer to the Senior Management Committee about cybersecurity matters, as necessary. In the event there is a material cybersecurity incident, the Company's policies and procedures set forth an action plan, which includes notification of the appropriate personnel and management within the Company as well as regulators and impacted customers, as applicable. For cybersecurity incidents, including, but not limited to, incidents that are deemed material pursuant to SEC cybersecurity disclosure rules or that significantly impact vital services provided by the Company, notification to the Board will occur at or about the time the incident is discovered. Less severe incidents will be reported by management at the next Board or Risk Committee meeting.


text: Board of Directors' Role in Cybersecurity An integral part of Company's risk management oversight, which includes information security, is the role of the Board. This is reinforced by the independence and reporting structure of the Chief Risk Officer, who oversees the CISO and reports to the Board Risk Committee and administratively to the President and Chief Executive Officer.


text: In addition, cybersecurity risk is a fundamental risk of the Company which is overseen by the Risk Committee of the Board, including Directors with experience in risk management, internal audit, cybersecurity and/or the operations of financial service companies. In particular, the Chair of the Board, Eric E. Stickels, has experience with the risks associated with operating a financial institution based upon his prior service as the President of Oneida Financial Corp. In addition, Lead Director Susan E. Skerritt, the former Chief Executive Officer and President of Deutsche Bank Trust Company Americas, as well as director Kerrie D. MacPherson have received the Cyber-Risk Oversight Certification issued by the National Association of Corporate Directors ("NACD"), and utilize their business experience and cyber-risk expertise to assist the Risk Committee in its evaluation of management's cybersecurity systems. Directors Knauss and Singh also serve as Board representatives on the Company's IT Steering Committee and provide valuable oversight and insight to the committee based on their respective roles as (i) the former CEO of a digital marketing firm and (ii) current CEO of PAR Technology Corporation ("PAR"), a global food service technology company providing leading omnichannel cloud-based software and hardware solutions to the restaurant and retail industries.


text: The Risk Committee meets five times a year during which management provides updates to the committee regarding the material risks facing the Company. As part of this reporting, the Chief Risk Officer and the Risk Management Department have created a risk management program that identifies and evaluates the risks associated with various aspects of the Company's business and report their assessments to the Risk Committee for review or approval. Within the risk management process, cybersecurity risks are specifically reviewed and addressed, including risks related to current or proposed products and services to be offered by the Company, as well as the efforts taken or to be taken to mitigate such risks.


text: In addition, on at least a quarterly basis, the CISO presents an Information Security report to the Risk Committee, which includes the Company's cybersecurity alert level, controls rating, current and emerging cybersecurity risks, threats and trends, mitigation efforts and projects and audit and regulatory updates.


text: On an annual basis, the Board's Audit Committee also receives reports from outside consultants who perform various IT related audits, and the Company's independent registered public accounting firm regarding the effectiveness of the Company's cybersecurity program in connection with its review of the Company's financial statements.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, consumers, employees and other stakeholders and oversees cybersecurity matters. Management plays a central role in our information security program, which is a critical component of our enterprise risk management and includes the implementation of controls generally aligned with industry best practices and applicable frameworks to identify threats, deter attacks and protect our Company assets. We also include cybersecurity training as part of our mandatory, periodic employee training program. In addition, we engage a range of cybersecurity experts, including cybersecurity auditors, assessors, and consultants, in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure that our cybersecurity strategies and processes remain in line with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultations on security enhancements.

companyName: Monster Beverage Corp

ticker: MNST