text: Risk Management and Strategy Aurora's Information Security team has implemented a robust cybersecurity risk management program in order to protect the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. The program, which is integrated with our overall risk management system, aims to identify, assess, and mitigate cybersecurity risks for both the product and the organization. It includes a cybersecurity incident response procedure ("CIRP") that defines roles and responsibilities during cybersecurity incidents, outlines incident handling procedures, including detection, investigation, and mitigation of incidents, and provides a framework for assessing incidents. Aurora's CIRP contributes to satisfaction of certain elements of Aurora's Safety Case. Additionally, the CIRP is referenced in and integrated into the Company's Cross-Functional Incident Response Plan, which serves as an outline of the actions to be taken across the Company immediately following a vehicle incident.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Aurora's Information Security team reports to and is led by our Vice President of Security Engineering, who is responsible for structuring and driving all cybersecurity initiatives at Aurora. This individual regularly reports cybersecurity progress to our Board of Directors, as well as senior leadership across the Company.

secItem: Item 1C


text: The Information Security team proactively reports, on a company-wide basis, the status of cybersecurity initiatives and risks, along with various assessments of our information security programs and the emerging threat landscape. We also perform periodic assessments and audits internally and also leverage third party experts, and the results of such assessments and audits are reported directly to senior leadership. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards and regularly monitor the effectiveness of our safeguards. We also actively engage with key partners, vendors, customers, industry participants, government entities, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures, especially around self-driving / autonomous vehicles. We work to identify, assess, and oversee risks from cybersecurity threats associated with third-party service providers, including, where appropriate, by contractually requiring third-party service providers to promptly inform us of incidents impacting their systems that could result in access to, loss, or unavailability of Aurora's data. In addition, prior to engagement, we conduct thorough security assessments of all third-party service providers that handle confidential Aurora information or connect to Aurora computing environments. Such assessments include analysis of the service providers' data handling practices and the security of their integrations with Aurora's systems. This approach is designed to mitigate risks related to cybersecurity threats originating from third-parties.


text: Risks from Threats and Incidents We are subject to risks from cybersecurity threats and incidents to our vehicles and cloud infrastructure, including operational systems, security systems, integrated software and partners' data processed by us or third-party vendors or suppliers. However, as of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Our Business Operations."


text: Our information security management team, including our Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats. Our Interim Chief Information Security Officer, who also serves as Vice President of Security Engineering has more than ten years of experience as a network and security engineer and more than seven years of experience leading information security teams at renowned technology companies.


text: Members of our security operations team are responsible for notifying the information security management team about cybersecurity incidents. The information security management team is responsible for assessing cybersecurity incidents; managing the analysis, mitigation, and remediation of incidents; and conferring with other members of management about incidents, including the Chief Information Security Officer and other members of our senior executive management team.


text: Our Audit Committee, composed of members of our Board of Directors, oversees risks from cybersecurity threats and our cybersecurity risk management program as an integrated part of our overall risk management processes. We conduct quarterly assessments to identify and evaluate cybersecurity threats and present our findings to the Audit Committee. In consultation with the Disclosure Committee, we also notify the Audit Committee about cybersecurity incidents and risks related to cybersecurity incidents. The Audit Committee is responsible for advising the Company on appropriate incident response steps.


text: Aurora's Information Security team reports to and is led by our Vice President, Head of Security Engineering, who is responsible for structuring and driving all cybersecurity initiatives at Aurora. This individual regularly reports cybersecurity progress to our Board of Directors, as well as senior leadership across the Company.


text: Risks from Threats and Incidents We are subject to risks from cybersecurity threats and incidents to our vehicles and cloud infrastructure, including operational systems, security systems, integrated software and partners' data processed by us or third-party vendors or suppliers. However, as of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Our Business Operations."


text: Our information security management team is responsible for assessing and managing material risks from cybersecurity threats. Our Vice President, Head of Security Engineering has more than thirty-five plus years of experience as a security expert and more than twenty-five plus years of experience leading information security teams at renowned technology companies.


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, financial information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information and employee information. In an effort to protect this information from cybersecurity risks, we have developed a cybersecurity program which incorporates policies and practices designed to protect the confidentiality, integrity and security of our sensitive information.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: As part of our cybersecurity risk management procedures, we perform system monitoring and scanning and utilize security tools supported by a third-party managed services provider. We also conduct penetration testing performed by a third-party provider. Employees are enrolled in cybersecurity awareness training courses designed to help them identify cybersecurity concerns and take appropriate actions, and we conduct periodic simulated phishing tests in an effort to further raise cybersecurity awareness and reduce the risk of a successful cyberattack. We have established an incident response plan to guide us in responding to cybersecurity incidents. We also take steps to protect against business interruption and conduct annual restoration testing for major systems. In addition, we are developing a cybersecurity risk management program for our third-party vendors. This program aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity practices.


text: Our cybersecurity program is managed by our IT Director, who reports directly to senior management on matters regarding cybersecurity, as appropriate. Our IT Director has over twenty years of experience in IT, including cybersecurity, and previously served as the IT Director at another biopharmaceutical company. Together, our senior management and IT Director are responsible for leading company-wide cybersecurity strategy, policies, standards, and processes.


text: The Audit Committee, pursuant to its charter, has oversight over management of cybersecurity risks. Senior management and our IT Director provide the Audit Committee with periodic updates on data management and cybersecurity initiatives, as well as on significant existing and emerging cybersecurity risks, including cybersecurity incidents, as applicable.


text: We have a process to record identified risks from cybersecurity threats in our risk register, along with an assessment of the severity of the potential impact and the likelihood of occurrence. This process is designed to facilitate a unified and integrated assessment of corporate risk and governance. The risk register is reviewed periodically by senior management and at least annually by the Board of Directors. Our cybersecurity program is also periodically evaluated by external security consultants, with the results of those reviews reported to senior management and the Audit Committee, as appropriate.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors may experience threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, please see Section 1A. Risk Factors.


text: As part of our cybersecurity risk management procedures, we perform system monitoring and scanning and utilize security tools supported by a third-party managed services provider. We also conduct penetration testing performed by a third-party provider. Employees are enrolled in cybersecurity awareness training courses designed to help them identify cybersecurity concerns and take appropriate actions, and we conduct periodic simulated phishing tests in an effort to further raise cybersecurity awareness and reduce the risk of a successful cyberattack. We have an incident response plan to guide us in responding to cybersecurity incidents, and have conducted tabletop exercises to test the plan. We also take steps to protect against business interruption and conduct annual restoration testing for major systems. In addition, we use a risk-based approach to assessing cybersecurity risks from certain critical third-party vendors. This program aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity practices.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related information ("Information Systems and Data").

companyName: Enovix Corp

ticker: ENVX


text: Our board, through our Nominating and Governance committee and our Information Security committee, together with company executives, IT and security management teams in conjunction with third party service providers who specialize in cybersecurity help identify, assess and manage the Company's cybersecurity threats and risks. We have a quarterly review of cybersecurity by our Nominating and Governance committee and our Information Security committee. We use a number of processes to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example via manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting routine scans of the threat environments, evaluating our and our industry's risk profile, performing annual assessments and penetration testing, evaluating the threats reported to us, coordinating with law enforcement concerning threats, conducting internal and external audits, conducting threat assessments for internal and external threats, reviewing third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, using of external intelligence feeds, conducting third-party- red/blue team testing and tabletop incident response exercises. In addition, we conduct internal tabletop exercise, third party red-team pen testing and OT security monitoring.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example incident response plans, incident detection and response policies and procedures, vulnerability management policy, disaster recovery plans, and encryption of data.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, we have (1) cybersecurity risk addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our information security committee evaluates material risks from cybersecurity threats against our overall business objectives and our CISO reports to the Nominating and Governance committee the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetrating testing firms, dark web monitoring services, forensic investigators and DHS CISA monitoring service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, security questionnaires, review of the vendor's written security program, review of security assessments, reports, vulnerability scans related to vendors, imposition of information contractual obligations on the vendors and other elements of vendor management program such as continuous cyber security monitoring by third-party service. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our batteries and our website, systems and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Nominating and Governance committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Nominating and Governance committee consist of members with years of experience in cybersecurity oversight.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Information Security Steering Committee which meets quarterly to review cybersecurity matters. Our Information Security Steering Committee is comprised of our Chief Information Security Officer, our CEO, CFO, COO, Chief Legal Officer, Vice President of Human Resources and Vice President of Information Technology. At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security with over 25 years of experience in leading security teams, developing security strategies, and managing risk across various industries. Our CISO has operated in this capacity at three other public companies and our CIO has over 25 years of information technology experience and managing cybersecurity risk including at other public companies.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They work in conjunction with our Nominating and Governance Committee Chair and member. Our CISO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and our Nominating and Governance Committee Chair and member. These officials work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Nominating and Governance Committee of the board of directors for certain cybersecurity incidents.


text: The Nominating and Governance Committee receives periodic reports from our CISO Information Security concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Nominating and Governance Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related information ("Information Systems and Data").


text: Our board, through our Nominating and Governance committee, together with our company executives through our Information Security committee, and our IT and security management teams in conjunction with third party service providers who specialize in cybersecurity, help identify, assess and manage the Company's cybersecurity threats and risks. We have a quarterly review of cybersecurity by our Nominating and Governance committee and our internal Information Security committee. We use a number of processes to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example via manual and automated tools, which are internally prepared and also through external third-party vendors, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting routine scans of the threat environments, evaluating our and our industry's risk profile, performing annual assessments and penetration testing, evaluating the threats reported to us, coordinating with law enforcement concerning threats, conducting internal and external audits, conducting threat assessments for internal and external threats, reviewing third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, using of external intelligence feeds, conducting third-party- red/blue team testing and tabletop incident response exercises. In addition, we conduct internal tabletop exercise, third party red-team pen testing and OT security monitoring.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Nominating and Governance committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Nominating and Governance committee consists of members with years of experience in cybersecurity oversight.


text: Our cybersecurity risk assessment and management processes are maintained by certain Company management, including the members of our Information Security Steering Committee, which meets quarterly to review cybersecurity matters. Our Information Security Steering Committee is comprised of our Chief Information Security Officer ("CISO"), CEO, Chief Financial Officer, Chief Accounting Officer, COO, Chief Legal Officer, Vice President of Human Resources and Vice President of Global Information Technology. At the management level, our CISO, who reports to our Chief Information Officer ("CIO"), is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cybersecurity with years of experience in leading security teams, developing security strategies, and managing risk across various industries. Our Vice President, Global Information Technology serves as our CIO, and has over 25 years of information technology and cybersecurity risk management experience, including at other public companies.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant stakeholders at our US headquarters, and each of our international subsidiary locations. Our CISO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. The CISO works in conjunction with our Nominating and Governance Committee Chair and committee members.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and our Nominating and Governance Committee Chair and members. These officials work with the Company's incident response team to help the Company mitigate and remediate any cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Nominating and Governance Committee of the board of directors for certain cybersecurity incidents.


text: The Nominating and Governance Committee receives periodic reports from our CISO and Information Security Steering Committee concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. The Nominating and Governance Committee also has access to the various historical reports, summaries and presentations prepared by the Information Security Steering Committee related to cybersecurity threats, risk and mitigation.


text: Cybersecurity is a material part of the Company's business. As a financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity events which have had a material effect (or are reasonably likely to have a material effect) on the Company's business strategy, results of operations, or financial condition. Notwithstanding, the impact of a cyber-incident could have a future impact on the Company's results of operations or financial condition. Cyber-attacks or other security breaches could adversely affect our operations, net income, or reputation.

companyName: William Penn Bancorporation


text: Our information security program is managed by our dedicated Chief Technology Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The specific experience of management who oversee cybersecurity are as follows:


text: Our Chief Technology Officer, who has over 40 years of industry experience and has facilitated the management of information security programs at financial institutions for the past 35 years. Our Chief Technology Officer is responsible for technology vendor selection and managing efficiency initiatives, including the implementation and upgrades of core banking technology.


text: Our Vice President and Director of Information Technology, who has over 20 years of industry experience and is a technology subject matter expert responsible for enterprise program management and information technology service management. Our Chief Risk Officer, who oversees entity-side risk management, including cybersecurity related risk.


text: To ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, management provides regular cybersecurity reports to the Board of Directors on a monthly basis. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and updates on the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. Through a third-party vendor, the Company's internal information technology team performs monthly vulnerability scanning and performs an annual risk assessment based on best practices from the Cybersecurity and Infrastructure Security Agency ("CISA"). We also use a third-party vendor to, among other things, undertake periodic penetration and vulnerability testing, and the results of all internal and third-party assessments and testing are reported to the Board of Directors. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see our risk factor titled "Cyberattacks and other security breaches could have an adverse effect on our business and operations, harm our reputation, and expose us to liability."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from the Chief Information Officer ("CIO") on our cybersecurity risks. In addition, the CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from the CIO on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Chief Executive Officer ("CEO"), CIO, Chief Marketing Officer, and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The CIO, in collaboration with the Audit Committee, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Energy Vault's CIO has more than 25 years of cybersecurity and risk management experience across multiple market verticals, including extensive experience overseeing critical and complex cybersecurity teams spanning multiple federal agencies and private industry. Further, the Audit Committee has a combined nine years of experience in organizational cybersecurity and risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information environment.


text: The Audit Committee receives regular reports from the Chief Information Officer ("CIO") on our cybersecurity risks. In addition, the CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Energy Vault's CIO has more than 25 years of cybersecurity and risk management experience across multiple market verticals, including extensive experience overseeing critical and complex cybersecurity teams spanning multiple federal agencies and private industry. Further, the Audit Committee has a combined twelve years of experience in organizational cybersecurity and risk management.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats alongside other risks is an integral part of our overall risk management system. This process is achieved by implementing specific controls, continuous monitoring, collaborative response plans, and regular reviews. Integration ensures a comprehensive view of risk and facilitates informed decision-making and a proactive approach to risk management. We employ various cybersecurity frameworks to ensure comprehensive protection of our systems and data, such as the NIST Cybersecurity Framework and elements of the CIS Controls Framework. By aligning with these standards and leveraging industry-specific best practices, we create a cybersecurity strategy to address the challenges of the solar power sector.

companyName: Altus Power, Inc.


text: Regular assessments are conducted to identify potential cybersecurity risks across our organization, ensuring a comprehensive understanding of our risk exposure. To support our capabilities, we engage assessors, consultants, auditors, and other third parties with specialized expertise in cybersecurity. Their assessments cover various aspects of our infrastructure, including penetration testing, vulnerability assessments, and compliance audits, enabling us to strengthen our defenses against current and emerging threats.


text: Additionally, we have established processes to oversee and identify cybersecurity risks associated with third-party service providers. Thorough evaluations of their cybersecurity practices are conducted before engagement, ensuring our standards are met. Contractual agreements include requirements that enforce compliance with our security protocols, mitigating risks associated with third-party interactions.


text: Cybersecurity threats have the potential to disrupt our day-to-day operations, compromise sensitive data, and damage our reputation. While we have not experienced any material cybersecurity incidents to date, we acknowledge the potential impact of such threats on our business strategy, operations, and financial status. Additionally, regulatory fines or legal liabilities resulting from data breaches or non-compliance with cybersecurity standards will have a significant financial impact.


text: The Board of Directors provides supervision of cybersecurity risks to ensure the security of our company's operations. The Board of Directors receives updates quarterly on cybersecurity threats, vulnerabilities, and incidents from management from the Chief Digital Officer and IT Manager. These updates include information on the prevention, detection, and remediation of cybersecurity incidents, as well as monitoring key performance indicators, such as the effectiveness of security controls and overall cybersecurity posture.


text: Management plays a critical role in assessing and managing the company's material risks from cybersecurity threats. Cybersecurity efforts are overseen by the Chief Digital Officer, supported by a dedicated team. The Chief Digital Officer has over 20 years of experience in leadership roles in the digital domain at renowned organizations such as Nasdaq and TIAA. Their expertise encompasses a deep understanding of cyber threats, risk management strategies, and regulatory compliance requirements which positions the Chief Digital Officer to lead the company against evolving cyber-related threats.


text: Notwithstanding our efforts described above, the Company cannot guarantee that it will be successful in identifying and preventing all cybersecurity risks. For a discussion of how the occurrence of such risks may impact Altus' business, see the section entitled "Risk Factors" above.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats alongside other risks is an integral part of our overall risk management system. This process is achieved by implementing specific controls, continuous monitoring, collaborative response plans, and regular reviews. Integration ensures a comprehensive view of risk and facilitates informed decision-making and a proactive approach to risk management. We employ various cybersecurity frameworks to ensure comprehensive protection of our systems and data, such as the NIST Cybersecurity Framework and elements of the CIS Controls Framework. By aligning with these standards and leveraging industry-specific best practices, we create a cybersecurity strategy to address the challenges of the solar power sector. Additionally, our cybersecurity disclosures are designed to align with the SEC's evolving guidance on cybersecurity risk management, ensuring we remain transparent and proactive in communicating our cyber risk posture.


text: Regular assessments are conducted to identify potential cybersecurity risks across our organization, ensuring a comprehensive understanding of our risk exposure. To support our capabilities, we engage assessors, consultants, auditors, and other third parties with specialized expertise in cybersecurity. Their assessments cover various aspects of our infrastructure, including penetration testing, vulnerability assessments, and compliance audits, enabling us to strengthen our defenses against current and emerging threats. We also conduct regular company-wide security awareness training and phishing exercises to help our employees stay vigilant against evolving cyber threats. This training is updated at least annually and includes targeted education for higher-risk roles to ensure employees adhere to best practices.


text: We maintain a formal incident response plan (IRP) and business continuity/disaster recovery (BC/DR) procedures to ensure we can rapidly respond to and recover from cybersecurity incidents. These procedures, which include clear escalation paths and responsibilities in the event of a cybersecurity incident, are tested and updated annually to ensure their effectiveness.


text: Cybersecurity threats have the potential to disrupt our day-to-day operations, compromise sensitive data, and damage our reputation. While we have not experienced any material cybersecurity incidents to date, we acknowledge the potential impact of such threats on our business strategy, operations, and financial status. We also maintain cyber liability insurance coverage to help mitigate potential financial losses arising from certain cyber-related incidents, though it may not extend to all significant events. Additionally, regulatory fines or legal liabilities resulting from data breaches or non-compliance with cybersecurity standards will have a significant financial impact.


text: The Board of Directors provides supervision of cybersecurity risks to ensure the security of our company's operations. The Board of Directors receives quarterly updates on cybersecurity threats, vulnerabilities, and incidents from management, specifically from the Chief Digital Officer and IT Manager. These updates include information on the prevention, detection, and remediation of cybersecurity incidents, as well as monitoring key performance indicators, such as the effectiveness of security controls and overall cybersecurity posture.


text: Management plays a critical role in assessing and managing the company's material risks from cybersecurity threats. Cybersecurity efforts are overseen by the Chief Digital Officer, supported by a dedicated team. The Chief Digital Officer has over 20 years of experience in leadership roles in the digital domain at renowned organizations such as Nasdaq and TIAA. Their expertise encompasses a deep understanding of cyber threats, risk management strategies, and regulatory compliance requirements, which positions the Chief Digital Officer to lead the company against evolving cyber-related threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Viant Technology Inc.

ticker: DSP


text: We design and assess our program based on the CIS Critical Security Controls Version 8 ("CIS"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use CIS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program has its own governance channel and processes for monitoring and reporting risks. The current enterprise risk management framework is tailored to address risks around governance, process, technology, financial reporting, and fraud which could impact our financial statements. An enterprise effort to expand and integrate risks across all channels is underway.


text: Our cybersecurity risk management program includes the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for significant service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function. While delegated to the Audit Committee, the Board directly oversees management's implementation of our cybersecurity risk management program.


text: The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Board members receive presentations on cybersecurity topics from our Chief Information Officer ("CIO").


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO's experience includes over twenty (20) years of design, implementation and management of cyber-security programs at various levels and organizations.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Governance Our board of directors (the "Board") considers cybersecurity risk as part of its risk oversight function. While delegated to the Audit Committee, the Board directly oversees management's implementation of our cybersecurity risk management program.


text: Information Security Risk Management and Strategy The Company is committed to developing robust governance and oversight of cybersecurity risks and to implementing processes, controls and technologies designed to help assess, identify, and manage material risks. As described further in "—Information and Security and Governance Oversight" below, the Vice President of IT is responsible for Li-Cycle's information security program and as part of its broader risk oversight, while the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. Our information technology ("IT"), infrastructure, applications, and networks are susceptible to potential impacts due to the escalating sophistication and frequency of cyber-attacks and security incidents. Breaches in our technology systems, whether from circumventing security measures, denial-of-service attacks, hacking, phishing, computer viruses, ransomware, malware, employee errors, malfeasance, social engineering, vendor software supply chain compromises, physical breaches, or other actions, have the potential to compromise the confidentiality, availability, and integrity of crucial information. Such incidents may cause interruptions or malfunctions in our manufacturing systems, applications, and data processing, thereby disrupting other business operations. Additionally, critical information associated with our business operations is managed by some of our third-party vendors.

companyName: Li-Cycle Holdings Corp.


text: Anticipating or preventing all cyber-attacks requires an ever-present focus. A cyber-attack or a security incident leading to a breach could disrupt our business operations, harm our reputation, necessitate compliance with data breach notification laws, and subject us to litigation, regulatory investigation, or other liabilities under laws, regulations, and contractual obligations. This could result in increased costs, significant legal and financial exposure, and reputational damage.


text: We invest in information security and data privacy measures to safeguard our systems and data. This includes organizational investments, incident response plans, technical defenses, and employee training. We also utilize a third party to conduct vulnerability scans. Our approach to cyber-security risk management is designed to identify, assess, prioritize and manage major risk exposures that could affect our ability to execute our corporate strategy and fulfill our business objectives.


text: For instance, we utilize our existing information security measures to oversee operational landscapes, address suspicious events, and generate necessary reports shared during our monthly meetings. Additionally, as deemed necessary, we request third-party service providers to furnish System and Organization Controls ("SOC ") reports. Simultaneously, we are in the process of revising and formulating new IT policies, standards, and procedures in harmony with certain measures from the National Institute of Standards and Technology Cybersecurity framework and security requirements that may be applicable under privacy law, such as the General Data Protection Regulation (GDPR).


text: In 2024, we continued to mature our enterprise-wide communication initiative, focusing on cyber threats. This ongoing effort educates employees on recognizing and responding to potential cyber threats effectively, while continuously exploring new ways to engage and inform stakeholders about evolving threats. It serves as a reminder of the critical role each individual plays in safeguarding our organization's security.


text: We maintain the availability of cybersecurity consultants as required and regularly conduct vulnerability scans within our environment to identify areas for ongoing enhancements. Additionally, our IT General Controls (ITGC) undergo audits, encompassing processes that overlap with cybersecurity concerns such as access control, permissions, and robust password management. The insights derived from these and other assessments guide us in refining our information security practices, procedures, and technologies.


text: Information Security and Governance Oversight The Vice President of IT is responsible for Li-Cycle's information security program. In this capacity, the executive oversees the enterprise-wide cybersecurity strategy, ensuring the development of policies and standards, the implementation of processes, and the management of architectural elements. The Vice President of IT is responsible for assessing and managing material risks from cybersecurity threats, and is supported in delivering this function with a dedicated internal IT team. The Vice President of IT has over nine years of leadership experience as a Chief Information Officer and Chief Technology Officer, with experience overseeing information security, risk management, and compliance functions. The Cybersecurity Steering Committee convenes no less than quarterly to evaluate and address significant risks stemming from cybersecurity threats.


text: Additionally, as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. As reflected in its charter, the Audit Committee is required to periodically review and receive reports from management regarding risks and exposures related to information technology and cyber security.


text: The Vice President of IT submits reports to the Audit Committee and other senior management members as appropriate. These reports provide insights into the evolving threat landscape, updates on the organization's cyber risks and threats, evaluations of the information security program, and the status of initiatives aimed at improving the information security program and its systems.


text: Risk Management and Strategy The Company's risk management program includes governance through the Board of Directors and regular reporting by management to the Board. Our Chief Technology Officer is tasked with integrating any cybersecurity risk considerations into overall risk management strategy. Risk management includes regular risk assessments to identify internal and external risks and to evaluate the magnitude of harm that could arise out of such risks. Further, risk management may utilize third party service providers where complementary and supplementary to the Company's overall business strategy. Lastly, risk management includes training and education over the continuously evolving landscape of cybersecurity threats.

companyName: Mondee Holdings, Inc.

ticker: MOND


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.


text: Material Effects of Cybersecurity Threats Although cybersecurity risks have the potential to affect the business, financial condition, and results of operations, the Company does not believe that risks from attacks, including results from any previous cybersecurity incidents or threats, have materially affected or reasonably likely to materially affect the Company's strategy, operations or financial condition. However, no matter how well controls or designed or how well cybersecurity risk management procedures are implement, there can be no full assurance given that risk remains of an incident that could cause material harm to the business. See "Any significant IT systems-related failures, interruptions or security breaches or any undetected errors or design faults in IT systems could result in limited capacity, reduced demand, processing delays, privacy risks and loss of customers, suppliers or marketplace merchants and a reduction of commercial activity" in Item 1A, Risk Factors in this Annual Report on Form 10-K.


text: Governance and Management The Audit Committee assesses cybersecurity risk management as part of its oversight functions. Cybersecurity risk management processes are devised, implemented and assessed quarterly by our Chief Technology Officer. Our Chief Technology Officer has more than 20 years of experience in cybersecurity and information technology, and based on his career, has a deep understanding of our information technology and business needs. Our Chief Technology Officer reports to the Audit Committee quarterly in regard to emerging risks and the overall cybersecurity environment and immediately if and when a cybersecurity incident occurs. Our Chief Technology Officer closely monitors cybersecurity risk, including our practices and procedures against the cybersecurity environment, including the operation of our incident response plan.


text: Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We firmly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving quarterly exercises, cyber-event simulations, training programs and an annual attestation to our Technology Acceptable Use Policy.


text: Cybersecurity Risk Management and Strategy Our Company maintains a comprehensive information technology security program based on the National Institute of Standards (NIST) Cyber Security Framework. The information technology security program aims to protect our Company from cybersecurity threats and ensure the confidentiality, integrity and availability of our data and systems. To provide such protection, our program implements a significant number of controls, including but not limited to physical and digital access controls, data protection controls, system development controls, acceptable use controls and monitoring controls. We deploy technical and administrative safeguards, such as firewalls, intrusion prevention and detection systems, anti-malware functionality and security awareness and phishing prevention training programs, which are regularly evaluated and improved. Further, in the event of a cybersecurity incident, our Company has a Cybersecurity Incident Response Team (the "CSIRT"), consisting of stakeholders from across the Company, to respond appropriately. The CSIRT provides a proactive approach to managing cybersecurity incidents and ensures incidents are controlled as quickly as possible to avoid and minimize the damage to systems, limit impact to client information, protect the Company's reputation and integrity and prevent future incidents. The Company also has a data incident response plan in place that outlines expected actions in the event of a data security incident. The Company prioritizes protecting and informing customers, clients and employees in the event of a data security incident, as is appropriate.

companyName: Finance of America Companies Inc.

ticker: FOA


text: The Company leverages both internal resources and third-party suppliers as needed for technology assets, systems and development to support its information technology security program. The Company uses third-party rather than internal resources when the Company determines that using a third-party better meets the needs of the business. Before contracting with a third-party supplier, the Company determines if the vended resource is compliant with Company policies. Formal approval for a third-party supplier is obtained through the appropriate Company processes according to the type of resource provided by the third-party supplier.


text: Third-party vendors can present cybersecurity risks to the Company's technology resources. The Company has a vendor management team that provides oversight of third-party vendors and engages with the enterprise security team to assess potential cybersecurity risks related to a third-party vendor's services, both at the time of initial engagement and as part of an annual review process. The enterprise security team considers a number of factors in assessing such risks, including the types of services provided by the third-party vendor, the data and systems the third-party vendor needs to access to provide the services and the policies and controls the third-party vendor has in place to mitigate cybersecurity risks. Some third-party vendors present a higher risk and require additional approval before a contract is signed or renewed. This ensures leadership is aware of risks posed by third-party vendors and can consider this information when evaluating contracts.


text: The Company has processes in place to assess the effectiveness of its information technology security program. The Company applies cybersecurity assessment tools that analyze the Company's ability to identify, protect from, detect, respond to and recover from cybersecurity threats and that analyze the various controls put into place by the Company's information security program. The Company also conducts an annual cybersecurity assessment to identify risks and issues and may conduct more frequent assessments as required by a material change to the Company's cybersecurity risk. Further, the Company engages third parties to conduct penetration tests to assess the performance of the information technology security program. The results of these assessments and tests are reviewed by the Company's enterprise security team and senior management and are used to identify areas of vulnerability, which the Company then works to address.


text: To date, risks from cybersecurity threats have not materially affected our Company or our business strategy, results of operations or financial condition. However, if we were the subject of a significant cyber-attack or security breach in the future, it could materially affect our Company, as discussed in further detail under "Item 1A. Risk Factors— Risks Related to the Business of the Company—A security breach or a cyber-attack could adversely affect our results of operations and financial condition."


text: Board of Directors Oversight The Board of Directors oversees the risks to the Company from cybersecurity threats by periodically reviewing information technology security reports from management, including our Chief Information Security Officer ("CISO"), as well as reports from the Audit Committee of the Board of Directors. These reports also include, as applicable, an overview of any cybersecurity incidents. The Audit Committee provides assistance to the Board of Directors with respect to its oversight of the Company's technology security and data privacy programs. The Audit Committee is responsible for reviewing the Company's information technology security controls with the CISO and evaluating the adequacy of the Company's information technology security program, compliance and controls with the CISO, which evaluation would include a consideration of any applicable cybersecurity incidents.


text: Management Oversight We have a dedicated enterprise security team responsible for assessing and managing our material risks from cybersecurity threats. Our enterprise security team is led by our CISO, Drew Robertson, who has extensive experience in cybersecurity. In addition to acting as our CISO, Mr. Robertson currently advises several companies in the Cyber Security Industry and is active in a number of information security communities and groups. Prior to his appointment as CISO in October 2021, he served as our Deputy CISO. Before joining the Company, Mr. Robertson worked for the National Security Agency and the United States Army, where he held various leadership positions in computer network defense, computer network exploitation and intelligence oversight. Mr. Robertson holds a BA in Organizational Management, an MS in Cybersecurity Policy and an MBA.


text: Our enterprise security team works closely with our senior management, information technology, legal and compliance teams to develop, implement, assess and improve our information technology security program, compliance and controls, as described in more detail above under "—Cybersecurity Risk Management and Strategy." By engaging in the development, implementation, assessment and improvement of our information technology security program, compliance and controls, the enterprise security team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. As described in more detail above under "—Board of Directors Oversight," our CISO reports to the Board of Directors regarding cybersecurity risks and cybersecurity incidents and also works with the Audit Committee to evaluate the program, compliance and controls in place to address cybersecurity risks and cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy Our Company maintains a comprehensive information technology security program based on the National Institute of Standards (NIST) Cyber Security Framework. The information technology security program aims to protect our Company from cybersecurity threats and ensure the confidentiality, integrity, and availability of our data and systems. To provide such protection, our program implements a significant number of controls, including but not limited to physical and digital access controls, data protection controls, system development controls, acceptable use controls, and monitoring controls. We deploy technical and administrative safeguards, such as firewalls, intrusion prevention and detection systems, anti-malware functionality, and security awareness and phishing prevention training programs, which are regularly evaluated and improved. Further, in the event of a cybersecurity incident, our Company has a Cybersecurity Incident Response Team (the "CSIRT"), consisting of stakeholders from across the Company, to respond appropriately. The CSIRT provides a proactive approach to managing cybersecurity incidents and ensures incidents are controlled as quickly as possible to avoid and minimize the damage to systems, limit impact to client information, protect the Company's reputation and integrity, and prevent future incidents. The Company also has a data incident response plan in place that outlines expected actions in the event of a data security incident. The Company prioritizes protecting and informing customers, clients, and employees in the event of a data security incident, as is appropriate.


text: The Company leverages both internal resources and third-party suppliers as needed for technology assets, systems, and development to support its information technology security program. The Company uses third-party rather than internal resources when the Company determines that using a third-party better meets the needs of the business. Before contracting with a third-party supplier, the Company determines if the vended resource is compliant with Company policies. Formal approval for a third-party supplier is obtained through the appropriate Company processes according to the type of resource provided by the third-party supplier.


text: Third-party vendors can present cybersecurity risks to the Company's technology resources. The Company has a vendor management team that provides oversight of third-party vendors and engages with the enterprise security team to assess potential cybersecurity risks related to a third-party vendor's services, both at the time of initial engagement and as part of an annual review process. The enterprise security team considers a number of factors in assessing such risks, including the types of services provided by the third-party vendor, the data and systems the third-party vendor needs to access to provide the services, and the policies and controls the third-party vendor has in place to mitigate cybersecurity risks. Some third-party vendors present a higher risk and require additional approval before a contract is signed or renewed. This ensures leadership is aware of risks posed by third-party vendors and can consider this information when evaluating contracts.


text: The Company has processes in place to assess the effectiveness of its information technology security program. The Company applies cybersecurity assessment tools that analyze the Company's ability to identify, protect from, detect, respond to, and recover from cybersecurity threats and that analyze the various controls put into place by the Company's information security program. The Company also conducts an annual cybersecurity assessment to identify risks and issues and may conduct more frequent assessments as required by a material change to the Company's cybersecurity risk. Further, the Company engages third parties to conduct penetration tests to assess the performance of the information technology security program. The results of these assessments and tests are reviewed by the Company's enterprise security team and senior management and are used to identify areas of vulnerability, which the Company then works to address.


text: To date, risks from cybersecurity threats have not materially affected our Company or our business strategy, results of operations, or financial condition. However, if we were the subject of a significant cyber-attack or security breach in the future, it could materially affect our Company, as discussed in further detail under "Item 1A. Risk Factors— Risks Related to the Business of the Company—A security breach or a cyber-attack could adversely affect our results of operations and financial condition."


text: Board of Directors Oversight The Board of Directors oversees the risks to the Company from cybersecurity threats by periodically reviewing information technology security reports from management, including our Chief Information Security Officer ("CISO"), as well as reports from the Audit Committee of the Board of Directors. These reports also include, as applicable, an overview of any cybersecurity incidents. The Audit Committee provides assistance to the Board of Directors with respect to its oversight of the Company's technology security and data privacy programs. The Audit Committee is responsible for reviewing the Company's information technology security controls with the CISO and evaluating the adequacy of the Company's information technology security program, compliance, and controls with the CISO, which evaluation would include a consideration of any applicable cybersecurity incidents.


text: Management Oversight We have a dedicated enterprise security team responsible for assessing and managing our material risks from cybersecurity threats. Our enterprise security team is led by our CISO, Drew Robertson, who has extensive experience in cybersecurity. In addition to acting as our CISO, Mr. Robertson currently advises several companies in the Cyber Security Industry and is active in a number of information security communities and groups. Prior to his appointment as CISO in October 2021, he served as our Deputy CISO. Before joining the Company, Mr. Robertson worked for the National Security Agency and the U.S. Army, where he held various leadership positions in computer network defense, computer network exploitation, and intelligence oversight. Mr. Robertson holds a BA in Organizational Management, an MS in Cybersecurity Policy, and an MBA.


text: Our enterprise security team works closely with our senior management, information technology, legal, and compliance teams to develop, implement, assess, and improve our information technology security program, compliance, and controls, as described in more detail above under "—Cybersecurity Risk Management and Strategy." By engaging in the development, implementation, assessment, and improvement of our information technology security program, compliance, and controls, the enterprise security team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. As described in more detail above under "—Board of Directors Oversight," our CISO reports to the Board of Directors regarding cybersecurity risks and cybersecurity incidents and also works with the Audit Committee to evaluate the program, compliance, and controls in place to address cybersecurity risks and cybersecurity incidents.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. The structure of our information security program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and other industry standards. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cricut, Inc.

ticker: CRCT


text: We conduct periodic risk assessments, including vulnerability scanning and penetration testing, to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include an inventory of assets, followed by identification of reasonably foreseeable internal and external vulnerabilities, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We monitor various cybersecurity resources to remain informed about new and emerging cybersecurity threats and attack vectors. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Executive Vice President of Platform Development, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on recognizing potential cybersecurity threats and implementing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings. We also conduct tabletop exercises for members of various functional areas on data recovery and incident response.


text: We engage security consultants and other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards and to conduct regular vulnerability assessments for our internal assets. We require each third-party service provider to give assurance that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We review third-party service providers' policies, data protection procedures, intellectual property protection measures and incident response measures. Our CISO oversees our relationships with these third-party service providers.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors under the heading "Risks Related to Privacy, Data Protection and Cybersecurity," which is incorporated herein by reference.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our CISO and our steering committee on information security, which includes members of our executive management as well as leaders of business functional areas, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CISO has over 20 years of experience leading in the information security field at well-known publicly traded technology companies. He also received a CIO Executive Education Certificate from Stanford University.


text: Our CISO and our steering committee on information security oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO and our steering committee on information security are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness.


text: Our CISO and representatives from our steering committee on information security provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Because many members of our board of directors regularly attend our audit committee meetings, the full board of directors regularly receives updates on cybersecurity.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We monitor various cybersecurity resources to remain informed about new and emerging cybersecurity threats and attack vectors. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO"), who reports to our Executive Vice President of Platform Development, to manage the risk assessment and mitigation process.


text: While we are not aware of any material data security breaches to date, for additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors under the heading "Risks Related to Privacy, Data Protection and Cybersecurity," which is incorporated herein by reference.


text: Our CISO and our steering committee on information security, which includes members of our executive management as well as leaders of business functional areas, together with our Privacy and Data Protection Team, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CISO has over 20 years of experience leading in the information security field at well-known publicly traded technology companies. He also received a CIO Executive Education Certificate from Stanford University.


text: Risk Management and Strategy and Governance We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Cybersecurity and risks related to our IT are an important focus of our board of directors' risk oversight. Our board of directors, with assistance from its audit committee, oversees our cybersecurity risk assessment and response program. The audit committee receives reports at least quarterly from executive management, including our Vice President of IT, on the identification and status of cybersecurity incidents, resolution, recovery and post incident management.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: Managing Material Risks and Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk assessment process evaluates our maturity across key areas of cybersecurity, and incorporates industry standard framework considerations, including the National Institute of Standards and Technology. The cybersecurity management program includes evaluation of our technical, administrative, and end-point security, including encryption, firewalls, security scans and anti-virus systems and logical security controls. We continue to promote a company-wide culture of cybersecurity risk management awareness and cybersecurity considerations are integrated in our decision-making processes. We have an experienced IT team led by our Vice President of IT, who has more than 20 years of industry experience. Our Vice President of IT reports directly to the executive team and works closely with our management team, and where necessary, engages external experts to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Vice President of IT provides regular updates on cybersecurity to the audit committee of our board of directors.


text: Engagement of Third Parties on Risk Management We engage with external experts, including cybersecurity consultants, to support our cybersecurity risk assessment and response program. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes biennial cybersecurity maturity assessments and consultation on security enhancements.


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Risk Management and Strategy and Governance We are committed to protecting the security and integrity of our systems, networks, databases, and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Cybersecurity and risks related to our IT are an important focus of our board of directors' risk oversight. Our board of directors, with assistance from its audit committee, oversees our cybersecurity risk assessment and response program. The audit committee receives reports at least quarterly from executive management, including our Senior Vice President of IT and Cybersecurity, on the identification and status of cybersecurity incidents, resolution, recovery, and post incident management.


text: Managing Material Risks and Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk assessment process evaluates our maturity across key areas of cybersecurity, and incorporates industry standard framework considerations, including the National Institute of Standards and Technology. The cybersecurity risk management program employs a multi-layered approach including: • Awareness and training for employees involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats; • Evaluation of our technical, administrative, and end-point security, including encryption, firewalls, security scans, and anti-virus systems and logical security controls, along with control policies and active review procedures which strengthen authentication and access protection; • Third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information; • Risk and vulnerability management encompassing both proactive and predictive defenses, which provides opportunities to assess, remediate, and validate; and • Managed detection and incident response, including advanced endpoint protection.


text: We continue to promote a company-wide culture of cybersecurity risk management awareness, and cybersecurity considerations are integrated in our decision-making processes. We have an experienced IT team led by our Senior Vice President of IT and Cybersecurity, who has more than 20 years of industry experience. Our Senior Vice President of IT and Cybersecurity reports directly to the executive team and works closely with our management team, and where necessary, engages external experts to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Senior Vice President of IT and Cybersecurity provides regular updates on cybersecurity to the audit committee of our board of directors.


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding any risks from cybersecurity threats, including as a result of any cybersecurity incidents that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, refer to Part I, Item 1A, "Risk Factors," within this Annual Report on Form 10-K.


text: We have accommodated a significant number of our employee population to work remotely. This accommodation to remote working has also increased our vulnerability to risks related to our computer, technology, and communications hardware and software systems and has exacerbated certain related risks, including risks of phishing and other cybersecurity attacks.


text: The damage or disruption to our or third-party systems, or unauthorized access to, or exposure of, intellectual property or personal or confidential information, could harm our operations, reputation and brand, resulting in a loss of business or revenue. It could also subject us to government sanctions, litigation from candidates, contractors, clients, and employees, and legal liability under its contracts, resulting in increased costs or loss of revenue. We may also incur additional expenses, including the cost of remediating incidents or improving security measures, the cost of identifying and retaining replacement vendors, increased costs of insurance, or ransomware payments.


text: Cybersecurity threats continue to increase in frequency and sophistication, thereby increasing the difficulty of detecting and defending against them. Furthermore, the potential risk of security breaches and cyberattacks may increase as we introduce new service offerings. Any future events impacting us or our third-party vendors that damages or interrupts our or our third-party vendors' computer, technology, and communications hardware and software systems, or exposes intellectual property or data or other confidential information, could have a material adverse effect on our operations, reputation, and financial results.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Aura Fat Projects Acquisition Corp


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented policies designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. While we have taken measures designed to protect the security of the confidential and personal information under our control, we cannot provide absolute assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

companyName: Innovative Eyewear Inc

ticker: LUCY


text: Our cybersecurity program is managed by our executive management team, including our Chief Executive Officer and Chief Technology Officer, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and received analysis reports from a cybersecurity advisor, and generally rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Company intends to provide the Board of Directors with periodic updates on cybersecurity and information technology matters and related risk exposures from management.


text: All customer and app user information is stored directly within Shopify, Amazon Seller, and Amazon Web Services platforms, which provide market-leading data security for their centralized servers. On occasion, limited amounts of customer information such as names and emails are exported from these systems solely for the purposes of accounting and filings, and is never shared outside of the Company and its contracted accounting consultants, which are under confidentiality agreements. Highly sensitive customer payment information is generally never revealed to the Company in any capacity and is hidden by payment processors for security purposes, with the sole exception being some wholesale accounts who provide written or digital copies of credit card information for payment processing on agreed upon terms. Such information is secured on locked Company computers and never distributed.


text: Risk Management and Strategy We have no employees. Our business is externally managed by the Advisor, an affiliate of Lightstone. We are dependent on the Advisor and affiliates of Lightstone (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT V, Inc.


text: The Advisor and its affiliates take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout their operations that are designed to address cybersecurity threats and incidents. The Advisor and its affiliates regularly assess risks from cybersecurity threats, monitor their information systems for potential vulnerabilities, and test those systems according to their cybersecurity policies, standards, processes, and practices, which are integrated into their overall approach to enterprise risk management. To protect their information systems from cybersecurity threats, the Advisor and its affiliates use various security tools that help them identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: The Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with the Company's disclosure obligations.


text: The Advisor and its affiliates also partner with independent third-party experts to provide a comprehensive cybersecurity solution that safeguards organizations against a broad spectrum of cyber threats.


text: This comprehensive cybersecurity solution offers advanced threat detection, prevention, and response capabilities, including real-time monitoring, threat intelligence, behavioral analysis, endpoint detection and response, malware prevention, and automated response actions. Additionally, the comprehensive cybersecurity solution also provides access to cybersecurity experts, who provide proactive threat monitoring and incident response support to effectively detect, investigate, and remediate security incidents.


text: The Advisor and its affiliates engage vendors to enhance cybersecurity safeguards and improve incident response and update or replace systems and applications as appropriate to improve data processing and storage management and enhance security. These cybersecurity safeguards include multi-tiered backup protocols, which incorporate immutable backups, embody an innovative approach to data security, providing an additional barrier against ransomware and other cyber threats. Immutable backups ensure that data remains unmodifiable and immune to deletion for a predefined duration, thereby shielding it from unauthorized tampering or access. This technology utilizes sophisticated methods, including immutable storage repositories and ransomware-resistant backup architectures, to uphold the integrity and accessibility of vital data. Through the enforcement of stringent access controls and encryption measures, the resilience and availability of backup data is ensured, empowering an organization to swiftly and securely recover from cyber incidents.


text: To further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.


text: The Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.


text: The Director of Information Technology is responsible for leading the assessment and management of cybersecurity threats. We have implemented a governance program for our cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents. The Advisor and its affiliates have developed and implemented policies to identify and mitigate cybersecurity risks and provide training to their employees at onboarding and thereafter as necessary. Such updates are communicated to all their employees, and actionable guidance is provided when new risks arise.


text: Risk Management and Strategy We have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT IV, Inc.

ticker: LTSV