text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the National Institute of Standards and Technology Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

secItem: Item 1C


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a management team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Business interruptions could adversely affect future operations, revenues, and financial conditions, and may increase our costs and expenses."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the internal Security Incident Management Team or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Security Incident Management Team, which includes our Chief Financial Officer, the Executive Director of Information Technology, Chief Legal Officer and the Quality Assurance Director, has approximately 30 combined years of risk management experience and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Security Incident Management Team's experience includes prior work experience in cybersecurity; financial management and controls, data quality assurance and liability and risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors (the "Board"), primarily through its audit committee of the Board (the "Audit Committee"). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report on Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors, "We are reliant on information technology systems and may be subject to damaging cyber-attacks or security breaches" and "We are subject to data privacy laws, rules and regulations and any non-compliance with such laws, rules and regulations, could adversely affect our business, financial condition and operating results" in this Annual Report on Form 10-K.


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Senior Vice President Head of Information Technology ("SVP IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.


text: Under the oversight of the Audit Committee, and as directed by the SVP IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.


text: The SVP IT brings over two decades of extensive experience in global technology organizations spanning various industries. With a background encompassing more than 20 years of expertise in information security, risk management, and compliance, the SVP IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as Payment Card Industry ("PCI") and Sarbanes-Oxley ("SOX"). The SVP IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training, equipped with the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. With expertise in threat detection, incident coordination, and remediation, the IRT Security Officer contributes to enhancing the Company's cybersecurity posture and readiness.


text: All dollar amounts expressed in thousands, except per share amounts The SVP IT oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The SVP IT also coordinates with the Company's General Counsel and Interim Chief Financial Officer and Chief Accounting Officer (the "Interim CFO and CAO") to assess and manage material risks from cybersecurity threats. The SVP IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO and CAO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO and CAO, SVP IT, General Counsel, Corporate Controller, and IRT Security Officer.


text: The SVP IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO and CAO regarding cybersecurity disclosures in public filings. The SVP IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.


text: Risk Management and Strategy Our cybersecurity risk management program, a critical component of our overall enterprise risk management program, is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, Center for Internet Security Controls, regulatory guidance, and other industry standards. These frameworks provide a risk-based model for organizations to identify and manage cyber risks inherent to their business model.

companyName: SIERRA BANCORP

ticker: BSRR


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Using people, processes, and technology, we employ a variety of preventative and detective tools designed to monitor, alert, contain, and/or block suspicious activity. We design and implement controls designed to mitigate cyber risk, including ongoing education and training for employees and customers, preparedness simulations and tabletop exercises, and recovery and resilience tests. We actively monitor email for malicious phishing email campaigns and monitor remote connections. Additionally, we maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers.


text: Our Incident Response Plan, coordinated through the Senior Information Security Officer, provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation. The Incident Response Plan includes key members of executive and senior leadership, facilitates coordination across multiple parts of our organization, and is evaluated regularly.


text: We perform regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists, and engage independent auditors to periodically review our cybersecurity program, including our process, systems, and control effectiveness, and provide recommendations to continuously strengthen our program. Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness. For additional discussion, on cybersecurity risk, see Item 1A. Risk Factors, section 1.08 "Unauthorized disclosure of sensitive or confidential information, whether through a cyber-attack, or breach of our computer systems or any other means, severely harm our business."


text: The Senior Information Security Officer, Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program. The Director of IT and Director of Information Services report to the Chief Administrative Officer and are responsible for designing and maintaining the company's network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence. The Senior Information Security Officer (ISO) reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities. The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.


text: Our Board of Directors and Executive Officer Committee have delegated oversight authority to a management-level IT/Operations Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise. The IT/Operations Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience. The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats. This information is subsequently reported up to the Board Risk Committee.


text: The Board Risk Committee is responsible for oversight of the Company's enterprise risk management program, which encompasses information technology, information security and cybersecurity. This includes management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs. Annual independent assessments of the Company's cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee. The Chief Administrative Officer and Chief Risk Officer report to the Board and/or Board Risk Committee on cybersecurity risks and other matters reviewed by the IT/Operations Committee. Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Administrative Officer and/or the Chief Risk Officer, who will share these with the Company's Executive Officers and Board members, as appropriate.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Senior Director of Information Technology (IT) is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has nearly 15 years of experience as an information technology professional.


text: Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.


text: The Company deploys advanced cybersecurity technologies and best practices to deliver a highly secure technology platform for its internal operations and hotels throughout its national portfolio. Our program is built around best practice guidance taken in part from both NIST and PCI DSS framework.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Risk Management and Strategy We have engaged a third-party IT and cybersecurity firm to assist us in protecting us from cybersecurity threats. Our IT partner has been in business for over 33 years and has a national footprint of 175 offices nationwide. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers.


text: TPG's Corporate IT footprint and systems are not used to process guest transactions. Corporate systems do not have connectivity to any hotels.


text: All IT assets and infrastructure are monitored 24/7/365 through a combination of automated detection software, SIEM software and a fully staffed 24/7 SOC. We have continuous monitoring for viruses, intrusions, and malicious activities.


text: We deploy a sophisticated blend of layered security that protects systems and data that exist or operate within partitioned/segregated networks.


text: Employee cybersecurity training and phishing email training are required for all employees and is performed monthly to continually enhance awareness and responsiveness.


text: We do not store any customer data input during the reservation process. The customer reservation systems are specified, implemented, and managed by the global hotel brands.


text: Each hotel or operating asset within our portfolio is a standalone network. Therefore, if a security breach were to occur at one location, it is fully isolated from other properties or networks.


text: We deploy stringent email filtering that prohibits incoming messages from insecure email systems (i.e., gmail, yahoo, aol, etc.) that are known to carry viruses, spyware, crypto ransom, etc. We perform regular internal and external penetration tests.


text: We have in place a Cybersecurity Incident Response plan that dictates the process for responding to incidents and remediation of events. We have relationships with third-party business partners to assist with cybersecurity as well as assess their cybersecurity risks.


text: We utilize Self-Assessments using industry standards and benchmarks to identify cybersecurity incidents and threats that could potentially impact the company.


text: Our IT internal controls are audited by an external audit firm as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.


text: We or our third-party manager currently maintain cybersecurity insurance policies that provide coverage for security incidents. Although the risks we face from cybersecurity threats are many and change daily, we have not experienced any cybersecurity incidents that have materially affected our operations, strategy, financial positions or operations. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition.


text: Despite the policies and procedures that have been implemented to ensure the integrity of our IT systems, we may not be effective in identifying and mitigating every risk in which we are exposed to, especially newly identified vulnerabilities. Furthermore, the hospitality environment requires that the hotels access information in third party environments that are managed, hosted, and provided by others. As such the company will have difficulties in anticipating and implementing preventive measures that mitigate the harm should a break occur.


text: Malicious actors, which can operate on a larger and more sophisticated scale, are using various tools and methodologies to gain access to systems. Such attacks are ransomware, denial of service attacks, phishing, social engineering, and other cyberattacks. A breach of these systems either managed by us or a third party may result in the loss of business data, personal information, disruption of business.


text: Our board of directors are responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On a quarterly basis, our board of directors and audit committee receive a report from management on our cybersecurity threat risk management processes and strategies. Outside of quarterly meetings, our board of directors and audit committee are notified following any cybersecurity incident and meet to address and identify the cybersecurity threat's severity levels. Our board of directors and audit committee also review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Risk Management and Strategy We have programs for assessing, identifying, and managing material risks from cybersecurity threats through the use of a suite of various security programs and tools including, but not limited to, Managed Security Service Provider and Extended Detection and Response monitoring and alerts, internal reporting mechanisms, monitoring tools, detection tools and continuous training. Our information security program undergoes regular evaluations, internal audits and various exercises, including tabletop, penetration, vulnerability testing and simulations. The findings from these activities, including identified security gaps, are integrated into our risk remediation process and subsequently updated across our suite of security tools and applications. Additionally, we conduct annual Payment Card Industry Data Security Standard compliance reviews and third-party penetration testing.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Our global cybersecurity team consists of multidisciplinary Information Technology ("IT") resources from key areas and locales led by our Global Director of Cybersecurity. They are primarily responsible for delivering comprehensive reporting to executive management and auditors, addressing a wide array of cybersecurity threats, assessments, findings and future direction and strategy.


text: Continuous endpoint monitoring is ensured through collaboration with a third-party cybersecurity firm. Rapid response protocols are in place for high or critical severity incidents, involving isolation, segmentation and forensic examination by our cybersecurity team. In addition, we have engaged a dedicated third-party threat hunter to assist in identifying Indicators of Compromise.


text: Our Global Director of Cybersecurity leads a quarterly cybersecurity governance meeting, comprising of all IT teams from our subsidiaries. This meeting serves as a platform to review and discuss ongoing and upcoming security projects, compliance, and regulations.


text: We conduct a comprehensive annual tabletop exercise facilitated by an external cybersecurity specialist. This exercise involves simulating various attack vectors, utilizing our incident response plans and procedures to respond effectively, prevent, block, and remediate potential threats. This exercise also includes preparing for other related potential impacts to the Company, such as business interruptions, business continuity plans, backup strategies, data protection policies and compliance, incident response, third-party forensic and legal assistance, as well as consideration of regulations such as GDPR, CCPA, PCI and other cybersecurity regulations. This tabletop exercise is attended by members from all subsidiaries, including IT management teams as well as finance, legal, insurance, and operations management teams. We believe our holistic approach ensures we are well-prepared and coordinated to handle a range of cybersecurity scenarios.


text: Our annual testing, which is conducted by an industry-leading third-party cybersecurity firm, encompasses external and internal penetration tests, Wi-Fi tests, social engineering and physical access testing for all subsidiaries. We also use a vulnerability management platform to provide comprehensive visibility and tracking of assets to aid us in systematically identifying, measuring and prioritizing cybersecurity and technology risks. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.


text: Our third-party information technology vendors are assessed by independent auditors for compliance with System and Organization Controls ("SOC") 1 and SOC 2. Access to our networks for third-party vendors is limited exclusively to the application related to the services for which they are engaged to provide. We routinely conduct external risk analyses by employing third-party rating tools to assess our vendors, quantifying and prioritizing identified risks based on the number and severity of vulnerabilities. Subsequently, we communicate these risks to our vendors proactively, seeking their collaboration in remediation efforts.


text: We annually purchase cybersecurity risk insurance policies that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Our board of directors maintains comprehensive oversight of company-wide risk assessment by conducting in-depth analysis of key risks related to information security, technology and cybersecurity threats. The audit committee of our board of directors oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee receives quarterly reports on cybersecurity matters, including material risks and threats, from our Chief Information Officer ("CIO") and our cybersecurity team. In the event of a cybersecurity incident, our Global Director of Cybersecurity or senior Information Technology management will notify our Disclosure Committee in accordance with the escalation criteria set forth by our incident response plan and related processes. Security incidents and events are classified based on severity (Critical, High, Medium), impact, and nature, as outlined in the Incident Response Plan. This classification system assists the cybersecurity team in prioritizing responses, allocating resources efficiently, and effectively managing risks.


text: Our Disclosure Committee is comprised of, among others, our Chief Financial Officer, Chief Growth and Operations Officer, CIO, Senior Vice President of Finance, Executive Vice President and Director of Strategic Planning, Senior Vice President of Investor Relations and Treasurer, Senior Vice President of Legal Counsel, Vice President of Legal Counsel, and the most senior members of the financial reporting, internal audit, financial planning and analysis, and tax functions.


text: Our CIO has over 28 years of experience leading our technology operations and a total of over 40 years of experience in information technology experience in the banking and fashion apparel industries. Our Global Director of Cybersecurity has over 20 years of experience in information technology, including a dedicated focus of more than 6 years in cybersecurity, risk management and compliance and he is a Certified Information Systems Security Professional ("CISSP") and a Certified Ethical Hacker ("CEH"). Additionally, our Global Director of Cybersecurity currently serves in the role of a governing body member for the New York Evanta CISO community.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see our "Risks Related to Cybersecurity, Data Privacy and Information Technology" contained in Item 1A - Risk Factors of this Annual Report on Form 10-K.


text: We depend on a variety of information systems and technologies to maintain and improve our competitive position and to manage the operations of our business, including supply chain, merchandising, point of sale, e-commerce, marketing, finance, accounting, and human resources. Our core business systems consist mostly of purchased software programs that integrate together with our internally developed software solutions across a company-wide network that connects all corporate users, stores, and our distribution center infrastructure.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: We manage data security and privacy at the highest levels. The Company's Board of Directors oversees an enterprise-wide approach to risk management (ERM), designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. Management is responsible for the Company's day-to-day risk management activities and processes, and our Board's role is to engage in informed oversight of, and provide guidance with respect to, such risk management activities and processes. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, proactive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Collaborative Approach. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt identification and escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards. The Company's Security Operations Center, led by our Vice President IT Risk Management (Chief Information Security Officer), constantly and proactively monitors our network and application landscape for threats and anomalies. The Security Operations Center deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Plan. The Company has established and maintains a comprehensive incident response plan that addresses the Company's response to a cybersecurity incident.


text: Third-Party Risk Management. The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Training. All Ulta Beauty associates have a role as stewards of Company data, and we educate them on how to keep data safe. As part of the Company's annual security awareness training and regular training around phishing, we train associates on how to keep devices and data safe in public places; how to avoid security threats and phishing scams; how to maintain a secure workplace; and everyday practices that help maintain the security of corporate digital devices, data and systems.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. We assess ourselves against the National Institute of Standards and Technology Cybersecurity Framework, Payment Card Industry Data Security Standard and management's defined technology controls to support internal controls over financial reporting. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness, including network penetration assessments. The results of such assessments, audits, and reviews are reported to the Audit Committee of the Board and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Also see "Information Security, Cybersecurity, Data Privacy, Regulatory and Legal Risks" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company's Board of Directors is actively engaged in oversight of cybersecurity, and it is part of the responsibilities of our Audit Committee. The Company's Chief Technology and Information Officer (CTIO) and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTIO and our Vice President IT Risk Management. The Company's CTIO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. To facilitate the success of the Company's cybersecurity risk management program, we have a unified and centrally coordinated team, led by our Vice President IT Risk Management, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across Ulta Beauty. Reporting to our Vice President IT Risk Management are a number of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: The Company's CTIO leads the core elements of Ulta Beauty's IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. He has served in various roles in information technology and information security for over 30 years, including serving as the Global Chief Technology Officer of a large public company prior to joining the Company. The Vice President IT Risk Management leads our information risk management organization responsible for overseeing the Company's information security program. She has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.


text: Risk Management and Strategy Management of cybersecurity risks is a component of our overall risk management strategy. We rely on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. Our operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. Our cybersecurity risk management strategy is designed to support us in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We have implemented several processes with the assistance of third parties that we engage to help us manage our overall information technology function. These include certain processes for assessing, identifying and managing cybersecurity risks and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack, as well as to secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and periodic review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and governance experts, to enhance our cybersecurity oversight and to gain valuable insights into the ever-evolving cybersecurity landscape.


text: Our use of third parties in the conduct of our business is significant (including suppliers, CROs, CDMOs, and other service providers, and a cybersecurity incident at third party could materially adversely impact us. We assess third party cybersecurity controls prior to engaging such third parties and include security and privacy addendums to our contracts where applicable. We also require that third party service providers or partners report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. During the reporting period we have not experienced any material cybersecurity incidents nor any series of immaterial cybersecurity incidents that would require to be disclosed in this year end report.


text: Our third party service providers report to our Principal Financial Officer who is responsible for the management of the Cybersecurity program. The Principal Financial Officer on a regular basis reports to the Audit Committee.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention material, which educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks.


text: Cybersecurity Incident Response Plan We have established a Cybersecurity Incident Response Policy ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. The CIRP provides a process for escalating certain cybersecurity incidents to the Board and members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.


text: Cybersecurity is an important part of our risk management program for our Board and management. The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through directory-based identity-related services for operation account security, firewall policies and periodical vulnerability threat scanning for network security and email-layer and endpoint-layer protections for data integrity on systems and user devices.

companyName: FGI Industries Ltd.

ticker: FGI


text: The Company's Director of IT is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our Director of IT has over 15 years of experience in information security positions and holds Master's degree in computer information systems. We also have constituted a cross-functional Cybersecurity Committee, comprised of Chairman, CFO, Management of Business Operations and Human Resources, which meets regularly to review enterprise-wide cybersecurity matters.


text: Our Board of Directors oversees management's approach to managing cybersecurity risks. The Board of Directors is charged with overseeing the Company's risk management program, which includes cybersecurity matters. The Board of Directors routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments and policies and practices and receives updates on technology trends and regulatory developments from the Director of IT periodically.


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats, derived from COSO framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, access control, and employee training. Risks identified by the Director of IT and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Director of IT also routinely discusses trends in cyber risks and our strategy with our Cybersecurity Committee and management on a regular basis, in addition to an annual review and discussion with the full board.


text: In addition, we endeavor to apprise employees of emerging risks and require them to undergo bi-annual security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Technology Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the President and, as discussed below, periodically to our board of directors.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Information Technology Officer and Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and reliance tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using third-party cybersecurity experts. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the Information Technology Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company.


text: Our Information Technology Officer is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.


text: Our board of directors has approved management committees including the Information Technology Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Information Technology Officer and includes the Information Security Officer and the Chief Operations Officer. This committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Technology Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Technology Officer Information Security Officer provide quarterly reports to the board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the board of directors reviews our cybersecurity risk profile on a quarterly basis.


text: Orchestra BioMed, ("Orchestra" or "Company") maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology environment including systems, hardware, software, data, people, and processes.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Cybersecurity Risk Management The underlying processes and controls of cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Orchestra has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: In addition, Orchestra maintains policies over areas such as information security, IT change and configuration management, acceptable use, access on/offboarding, and data backup and recovery to help govern the processes put in place by management designed to protect Orchestra's IT assets, data, and services from threats and vulnerabilities. Orchestra partners with industry recognized cybersecurity providers leveraging third-party technology and expertise. Cybersecurity partners to the Company, including consultants and other third-party service providers, are a key part of Orchestra's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability testing, identity access management controls, including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and traffic monitoring and automated alerting, ongoing cybersecurity user awareness training, remote monitoring and management, capacity management, industry-standard encryption protocols, formalized processes over asset and data destruction, formalized change management processes, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, and assessment. In the event of an incident, the Cyber Risk Committee would be notified and appropriate action would be taken to resolve the incident, including notifying senior management and, as appropriate, the Board.


text: Orchestra has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls and security standards of vendors, compliance with service level agreements, review of SOC 1 reports on an annual basis and a regular review of vendor contracts.


text: Orchestra's Cyber Risk Committee, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of Orchestra's cyber risk management program, and for informing senior management, the Board, and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes via selection of strategic third-party partners (such as the Company's virtual Chief Information Security Officer), and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Orchestra for strategic cyber risk management, advisory and decision making.


text: The Audit Committee of the Board of Directors oversees Orchestra's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Members of the Cyber Risk Committee brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Orchestra's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes reporting cybersecurity incidents and updates on Orchestra's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by Orchestra's Board of Directors, at least annually, as part of the Company's corporate risk oversight processes.


text: Orchestra faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Orchestra acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Orchestra's business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the Company's service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See "Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations" in Item 1A (Risk Factors) for more information on cybersecurity risks.


text: In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.

companyName: Ampio Pharmaceuticals, Inc.

ticker: AMPE


text: Given our current environment and structure of the Company, we outsourced a majority of our information technology functions in 2023, including but not limited to hosting and security access and cybersecurity generally, to third-party service providers. We relied primarily on third parties to assess, identify and manage material risks from cybersecurity threats. Our agreements with these third parties obligated these parties to provide us with various notifications and reports that help our management oversee and identify material risks from cybersecurity threats associated with our use of these third-party service providers.


text: Cybersecurity threats are just one of the many risks that we face. While we have not experienced a cyber-security incident, there is no assurance that we will not be impacted in the future. In 2023, risks from cybersecurity threats did not materially affect and were not reasonably likely to materially affect Ampio except to the extent that our management of risks from cybersecurity threats was reflected in our overall operations strategy in 2023. Like many of the specialized or highly technical functions within our company, we believe we obtained a greater depth of support and relevant expertise from third-party IT and cybersecurity resources at an overall lower cost profile than hiring our own employees.


text: Under the charter of our Audit Committee, the Audit Committee oversees management's development and implementation of policies with respect to risk assessment and risk management, which includes risks associated with cybersecurity threats. In 2023, the Audit Committee also discussed with management the Company's significant financial risk exposures and the actions management had taken to limit, monitor, control or mitigate such exposures. Our executive officers are responsible for managing risks from cybersecurity threats, which was primarily performed in 2023 by overseeing third parties involved in the management and monitoring of IT systems. Our executive officers also received reporting and information from third parties in 2023. Our management regularly reported to the Audit Committee on these risks. The Audit Committee also received reports from our legal counsel and internal auditors on cybersecurity matters. Currently, the Audit Committee also comprises the entire Board so we believe there is direct visibility by the Board to cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy Our information technology ("IT") and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Vice President of Information Technology ("VP IT") is responsible for establishing, implementing, and executing our cybersecurity program and strategy. Our VP IT has more than 25 years of IT, IT audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques. All IT staff are obliged to include cybersecurity as part of their everyday considerations and tasks.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our IT department proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: A formal enterprise-wide cybersecurity policy and related standards; Cybersecurity training and employee phishing simulations; Ongoing vulnerability assessment, identification, and remediation; Cyber incident response, IT disaster recovery, and business continuity plans; Identity and access management controls; Automated patch management and security updates; Network isolation of key operations environments; and Email filtering with attachment inspection and targeted threat protection.


text: The standards set in our cybersecurity program include the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. These standards are guided, in part, by the relevant National Institute of Standards and Technology (NIST) and American Water Works Association (AWWA) frameworks and guidance. We use various tools, security measures and technologies to aid in seeking to protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption. Assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities.


text: We have policies and procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including monitoring compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and related communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. In addition, a monitoring and detection system has been implemented to help identify cybersecurity threats and incidents. Our cybersecurity program also focuses on providing training and awareness to our employees and contractors on cybersecurity best practices.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our VP IT and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our VP IT and our third-party cybersecurity consultant to review our cybersecurity strategy. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see the risk factor titled "Our business could be adversely affected by cyber threats or other interruptions to information technology, communications networks and operations." in Item 1A of this Annual Report on Form 10-K.


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: SmartKem, Inc.

ticker: SMTK


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.. Our third-party consultant team is managed by our Chief Financial Officer who reports to the Audit Committee at the board-level, as appropriate.


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: The Company maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Company's overall risk management processes, which are overseen by the Board of Directors.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: Risk Management and Strategy The Company's Enterprise Risk Management Policy assists the Board of Directors and management in clarifying their tolerance for identifying those credit, market, liquidity, operational, legal, compliance, strategic, reputation and security (information and physical) risks that have the potential to cause material financial harm to the institution, as well as describing a methodology for determining the proper level of controls to manage and mitigate those risks. Cybersecurity is a critical component of risk management, given the increasing reliance on technology and the increasing cybersecurity threat landscape. The Information Security Program is built on the Federal Financial Institutions Examination Council (FFIEC) IT Handbooks, National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Cybersecurity Controls (CSC), and industry best practice. The Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect Company assets and information.


text: The Board of Directors is responsible for overseeing management's development and execution of the Company's risk management process. Risk management is administered by a senior management team called the Management Enterprise Risk Committee (MERC). Periodic risk assessments are performed to identify technical and physical risks to information systems. These risk assessments identify internal and external threats that could cause a cybersecurity incident, assessing the likelihood of potential impact of those threats, and assessing the measures and controls in place to manage the risks. As per FFIEC guidance, a Change Management Policy and Committee are in place to manage changes to technology and systems. Information Security is a member of this Committee to evaluate changes for information security impact.


text: The Company leverages internal and external auditors to periodically review information technology and information security policy, processes, and controls to ensure they meet regulatory compliance and operate effectively. Independent penetration testing is performed annually.


text: The Company maintains an Incident Response Plan and a Crisis Communication Plan that provide documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Chief Information Security Officer (CISO) and is reviewed and tested at least annually. The Crisis Communication Plan, managed by the Director of Marketing and Alternative Delivery, is reviewed and tested at least annually.


text: The Company uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Management Enterprise Risk Committee has established risk management guidelines for third-party vendors. Through the Vendor Management Committee, the Company conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Company's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed periodically. The Company cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Company may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Company shares with such providers.


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, the Company has not detected any material cybersecurity incident to our own systems. However, during the second quarter of 2023, a prominent third-party vendor experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer. For further information regarding this incident, please see our Quarterly Report on Form 10-Q for the quarter ended June 30, 2023 filed on August 10, 2023 and our Quarterly Report on Form 10-Q for the quarter ended September 30, 2023 filed on November 9, 2023. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, or financial condition.


text: The Company's information technology resources are managed by the Information Technology Department, which is responsible for the first line of defense – identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (CIO), who reports to the Company's President and CEO. The present CIO has been employed by the Company in the information technology area for two and a half years and was previously the CISO at the Company for two years. The present CIO has over thirty-five years of IT experience, twelve of that in banking. The CIO holds a current Certified Information Systems Security Professional (CISSP) designation.


text: The Chief Information Security Officer (CISO) whose responsibilities constitute the second line of defense provides the vision, leadership, and strategies necessary to protect the information security of the Company. The CISO manages policy, procedure, and process to ensure the execution of the Company's Information Security and Business Continuity/ Disaster Recovery (BC/DR) Programs. The CISO reports directly to the Chief Risk Officer to provide segregation between the first and second line of defense. The Information Security Department, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Company's information systems, and monitors implemented security measures.


text: The Company has established a Management Technology Committee and a Board Technology Committee. These Committees provide oversight and governance of information technology and the Information Security Program and meet quarterly. The Board Technology Committee's responsibilities include: (1) monitoring the strategic deployment and usage of Information Technology throughout the Company using reports and presentations from management; (2) oversight of cybersecurity preparedness through information security reports, discussion of internal events and discussion of cybersecurity topics pertinent to the Company and the industry; (3) oversight of activities in support of the Company's business continuity/disaster recovery program to ensure optimal corporate resiliency in the unlikely event of a disaster; and (4) providing broad strategic guidance on the technology direction of the Company by, among other things, overseeing the development of the AmeriServ Strategic Technology Plan.


text: Cybersecurity Risk Management and Strategy The Company is committed to ensuring that it has processes in place to detect, mitigate, and respond to cybersecurity risks. We approach cybersecurity by implementing best practices based on known frameworks. These frameworks include highly developed security checklists that serve as a guide to addressing critical cybersecurity needs. We augment our internal controls to include industry-standard security measures that protect against unauthorized access to our systems and proprietary information. These controls consider cybersecurity risks like potential breaches, technological disruptions, regulatory non-compliance, data theft, and third-party cybersecurity threats.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: The Company reviews cybersecurity risks within their risk management function, which is led by our senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Vice President of Information Technology.


text: Cybersecurity Governance Our Board, as part of our risk management function, receives periodic updates on internal controls around information technology and evaluates incidents at least once a year. Our information technology team is led by our Vice President of Information Technology who has extensive experience working with information security systems. Management is responsible for developing and maintaining cybersecurity policies and standards, monitoring ongoing compliance, and ensuring our information security is aligned with our business objectives and strategies.


text: The Company has entered into agreements with third parties for hardware, software, telecommunications, and other information technology services in connection with our operations and is exploring other third-party vendors to support our cybersecurity needs.


text: Cybersecurity Risk As of December 31, 2023, the Company is not aware of any material cybersecurity incidents that impacted the Company. However, we routinely face risks of potential incidents, whether through cyberattacks or cyber intrusions over the internet, ransomware, and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion, or other scams. Notwithstanding our risk management efforts related to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material or other adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our information technology and cybersecurity risks.


text: Risk Management and Strategy The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as the National Institute of Standards and Technology (NIST), Financial Services Information Sharing and Analysis Center (FS-ISAC), Federal Financial Institutions Examination Council (FFIEC), and Ransomware Self-Assessment Tool (R-SAT), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations include reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at the required new employee orientation and subsequently receive information security tips via email. Employees also receive annual security awareness training.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts to accommodate for the ever-evolving information and cyber security threat landscape. The Information Security Officer ("ISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.


text: The Chief Operating Officer (COO) along with the ISO are responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our COO and ISO have over 25 years of combined related experience. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises and incorporate external resources and advisors as needed. The Program is overseen by the Information Security Committee, Board of Directors, and Compliance Committee.


text: The Company's Board of Directors monitors the Program including policies and practices. The Company's Compliance Committee and Information Security Committee along with the company's Board of Directors oversee areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The ISO also provides periodic cybersecurity updates to the Board of Directors.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial condition, to date. Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions and our business may be adversely affected by security breaches at third-parties.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: Cybersecurity Threats As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts and internal threat intelligence team. A team of dedicated privacy, safety, and security professionals oversees cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership of this team includes professionals with deep cybersecurity expertise, including our Chief Information Security Officer. Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: DarioHealth Corp.

ticker: DRIO


text: As part of our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Company recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee and senior management are actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages a third-party service provider specializing in information technology, which assists with the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: The Audit Committee oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. On an annual basis, the Audit Committee discusses with Senior Management cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. As applicable, the Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Senior management, in coordination with the Company's third-party service provider specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications with the third party service provider, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence ("AI") tools.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology ("NIST"), employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act ("GLBA"), the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool ("RSAT"). Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.