text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions to our operations such as our clinical trials; claims that we breached our data privacy and security laws; reputational harm; a loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Compliance Officer and Vice President of Information Technology, both of whom have previously served in management roles at other public biotechnology companies.


text: Company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Company management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of our legal team depending on the circumstances. Our information technology team works with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Board Oversight Responsibilities The Board of Directors bears the ultimate responsibility for ensuring that an adequate cyber and information technology risk (IT risk) management framework is in place and functioning as intended. IT risk focuses on information and information systems, especially the most critical and vital information assets. Without reliable and properly secured information systems, business operations could be severely disrupted. Likewise, the preservation and enhancement of the Company's reputation is directly linked to the way in which both information and information systems are managed. Maintaining an adequate level of security is one of several important aspects of managing IT risk. The Board's oversight responsibility in this respect includes oversight of the Company's vendor management program and the periodic evaluation of the Company's IT risk management controls.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: The Board of Directors implements its IT risk oversight obligations primarily through the Board's Enterprise Risk Management Committee (ERM Committee). The primary function of the ERM Committee is to advise the Board of Directors regarding the enterprise risk management framework of the Company and to provide oversight to assist the Board of Directors in supervising enterprise risk management activities. The ERM Committee reviews and defines risk exposure limits for each specified risk category, including IT risk, while taking into consideration strategic goals and objectives and current market conditions. The Board ERM Committee reviews and approves any necessary changes to risk exposure limits after careful consideration of any changes in market conditions or corporate strategy and adopts guidelines, through the input of the Management Risk Committee's analysis and discussion, regarding the maximum loss exposure the Bank is able and willing to assume.


text: The Management Risk Committee is comprised of various members of Senior Management, Department Leaders, Compliance, Internal Audit and Risk Management. The Management Risk Committee is responsible for loss control and day-to-day oversight of the risk management function. Management Risk Committee meetings are held monthly. Results of the monthly review of risk categories are reported to the Board of Directors Enterprise Risk Management Committee (ERM) each quarter. In addition, the Company's risk position is reported to the Board of Directors quarterly.


text: At least annually, the Board of Directors reviews and approves the risk management program and policies based on information presented throughout the year from the ERM Committee and the Management Risk Committee.


text: In addition, the Information Systems (IS) Steering Committee, which is chaired by the Company's Chief Information Officer, serves as an advisory group providing assistance and guidance to management regarding customer information security, information systems planning, systems management organization, systems performance, business continuity, information security, system related expenditures, vendor management, and related policies and procedures. The IS Steering Committee meets on a monthly basis. Formal meeting minutes serve to document decisions and recommendations by the IS Steering Committee and are reported to both the Management Risk Committee and the Board ERM Committee. Management has appointed the Chief Information Officer the responsibility for overall management of the Company's "front line" IT risk.


text: Material Impact of Cyber Risk As discussed more thoroughly below, the Company devotes significant resources to implement, maintain, monitor and regularly upgrade our systems and networks with measures such as intrusion detection and prevention and firewalls to safeguard critical business applications. The additional cost to the Company of our cyber security monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting, and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cyber security. With the assistance of third-party service providers, we continue to implement security technology and establish procedures to maintain network security. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, but such insurance coverage may not always be sufficient to cover all losses.


text: IT Risk and Vendor Management We rely on third-party service providers to leverage subject matter expertise and industry best practice, provide enhanced products and services, and reduce costs. Although there are benefits in entering into third-party relationships with vendors and others, there are risks associated with such activities. When entering a third-party relationship, the risks associated with that activity are not passed to the third-party but remain our responsibility. At the direction of the Board and pursuant to its ultimate oversight, management is charged with the development and maintenance of a comprehensive vendor management program. In that respect, Company management has appointed the IS Steering Committee, chaired by the Chief Information Officer, to oversee the Company's vendor management program. The vendor management program is used to identify, measure, monitor, and control the risks associated with outsourcing arrangements. While focusing on information and operational risks, outsourced relationships are reviewed through structured assessments and addressed from an end-to-end perspective. While we have implemented a vendor management program to actively manage the risks associated with the use of third-party service providers, any problems caused by third-party service providers could adversely affect our ability to deliver products and services to our customers and to conduct our business. Replacing a third-party service provider could also take a long period of time and result in increased expenses.


text: Internal and External Risk Evaluations An annual Information Technology Audit, which is facilitated by the Internal Audit Department, is conducted via a co-sourcing agreement with a third-party auditor. The objective of the IT audit is to evaluate the effectiveness and efficiency of operations, test the reliability of data and IT controls, and ensure compliance with applicable laws, regulations, guidance, and industry best practices. The audit scope addresses IT Governance, IT Management, IT Operations, and IT Security. Testing of the internal network environment and external network perimeter are included in the Results of the IT Audit and are reviewed with the IS Steering Committee and Company management. For any exceptions identified, a responsible party is assigned, and action plans are developed to address corrective measures. The final results of the IT Audit are reviewed with the Board Audit Committee. The status of unresolved audit issues along with their priority ratings is reported to both Management's IS Steering Committee and the Board Audit Committee at each meeting.


text: In addition, in accordance with Gramm-Leach-Bliley Act requirements regarding safeguarding and protecting customer information, an Information Security Risk Assessment is conducted at least annually by the Risk Department and reviewed with the Management Risk Committee, the ERM Committee, and the Board of Directors. A risk analysis is performed to evaluate current processes, identify information assets, and determine the adequacy of the safeguarding and protection of confidential customer information collected and maintained. For each information asset identified, the criticality of the asset, the threats to the defined asset, the likelihood of compromise of the asset, the business impact if an asset is compromised, and an overall risk rating for each asset are defined. The results of this assessment are reviewed with the IS Steering Committee and the Risk Committee and reported at least annually to the Board ERM Committee.


text: We maintain an information security program and governance framework that are designed to protect our information systems against risks related to cybersecurity.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Cybersecurity Risk Management and Strategy We define information security and cybersecurity risk as the risk that the confidentiality, integrity, or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification, or destruction. Information security and cybersecurity risk are incorporated into our comprehensive Enterprise Risk Management ("ERM") program, which we use to identify, aggregate, monitor, report, and manage risks.


text: The Written Information Security Program ("WISP"), our enterprise information security and cybersecurity program, is incorporated within the ERM program and led by our Chief Information Security Officer ("CISO"). The WISP is designed to (i) ensure the security, confidentiality, integrity, and availability of our information systems and data (ii) protect against any anticipated threats or hazards to the confidentiality, integrity, or availability of such information and information systems and (iii) protect against unauthorized access to information or information systems that could result in substantial harm or inconvenience to us, our associates, or our clients. The WISP is built upon a foundation of advanced security technology, a well-trained team of experts, and is designed to operate in alignment with applicable regulatory requirements. WISP deploys multiple layers of controls to identify, protect, detect, respond to, and recover from information security and cybersecurity incidents. These controls are measured and monitored by subject matter experts and a security operations center with integrated cyber detection, response, and recovery capabilities. The WISP includes our Incident Response program, which manages information security incidents involving compromises of sensitive information, and our Security Incident Response Plan ("SIRP"), which provides a documented framework for handling high severity cybersecurity incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills around security matters at both a technical and management level, and our associates receive annual cybersecurity awareness training.


text: The WISP incorporates reviews by our Internal Audit department and external third-party experts. Periodic independent third-party maturity assessments are conducted against the NIST Cyber Security Framework. Investments in threat intelligence, collaboration with peers, vulnerability management, incident response drills, and participation in industry and government forums are also part of our program.


text: Cybersecurity risks related to third parties are managed as part of our System and Services Acquisition Policy, which sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring, and termination. Our program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit, or destroy our information or have access to our systems may have additional security requirements, depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls. We also conduct reassessments of our third-party risk, using a risk-based approach to determine frequency. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that address the collection, use, sharing, and retention of user data, as well as compliance with appropriate security terms.


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. See Item 1A – Risk Factors" of this Form 10-K for additional information on cybersecurity risks.


text: Cybersecurity Governance Under our information security framework, our Board and our Risk Management Committee are primarily responsible for overseeing and governing the development, implementation, and maintenance of our WISP, with the Board designating our Risk Management Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least twice a year from our CISO or their designee. Our Risk Management Committee receives reports on cybersecurity at least four times a year, with ad hoc updates as needed. In addition, our Risk Management Committee annually approves our WISP program.


text: Our Operational Risk Committee ("ORC") provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor, and report information security risks associated with our information and information systems. The ORC escalates risks to the Risk Management Committee or our Board based on the escalation criteria provided in our information security framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Management Committee and the ORC. Our CISO leads the strategy, engineering, and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board and the ORC on our WISP, as well as ad hoc updates on information security and cybersecurity matters. Our CISO reports directly to the Risk Management Committee. The CISO has been with the Company since 2023 and has over 28 years of information technology and cybersecurity experience.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are a part of our decision-making processes at every level. Our risk management team works closely with our Information Technology (IT) team including our IT and cybersecurity vendors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third Party Risk Because we are aware of the risks associated with third party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Legal and Compliance Officer (CLCO) and our Chief Operating Officer (COO) and on an ongoing basis by our IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats We have not encountered, to date, cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CLCO, our COO, and our IT personnel. In their time with our company, our CLCO and our COO have become increasingly involved in investigating, responding to, and mitigating cybersecurity incidents and intrusion attempts. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CLCO and our COO oversee our governance programs, test our compliance with standards, remediate known risks, and oversee or lead our employee training program.


text: The CLCO and the COO regularly inform our CEO and CFO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing our company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Monitor Cybersecurity Incidents Our CLCO, our COO, and our IT personnel are periodically informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CLCO and COO implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CLCO and COO, along with our IT personnel, are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Management's Role Managing Risk The CLCO and the COO play a pivotal role in informing the Board of Directors about cybersecurity risks. They provide comprehensive briefings to the Board of Directors, with a minimum frequency of not less than once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: In addition, at regular meetings of the Board, the Board members, including the CEO, and the CLCO and COO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board members actively participate in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Board of Directors conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Board of Directors Oversight The Board of Directors as a group is responsible for oversight of cybersecurity risks and bears the primary responsibility for oversight of this domain. The Board has delegated to the Audit Committee the primary responsibility of overseeing risk management relating to cybersecurity. The Board of Directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying and managing cybersecurity risks and have integrated cybersecurity risk management into our overall risk management processes. We have implemented processes to identify, assess, detect, evaluate, and mitigate ongoing security threats to our information technology systems and data as well as those of third parties upon which we rely.

companyName: IonQ, Inc.

ticker: IONQ


text: We conduct periodic and ad-hoc risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing of both our digital and physical assets, maintain ongoing risk assessments, and monitor various third-party risk feeds. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program. Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have obtained a SOC 2 Type 2 Certification. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.


text: We maintain an incident response plan which includes, among other areas, prioritization guidelines, data collection and evidence handling, communication channels and partners, and if required, law enforcement engagement. We maintain relationships with both local and national law enforcement agencies. We evaluate security incidents on a scale of severity to determine the appropriate incident handling protocols.


text: We require all employees to undertake data protection and security training at least annually. We provide specialized training to targeted groups of employees depending on their role and the larger threat landscape. We are briefed regularly by national law enforcement, and work with external consulting firms on custom training and evaluations.


text: While we have experienced cybersecurity incidents in the past, to date, none have materially affected the Company or our financial position, results of operations, or cash flows. We continue to invest in the cybersecurity and resiliency of our systems and networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "If our information technology systems, data, or physical facilities, or those of third parties upon which we rely, are or were compromised, we could experience adverse business consequences resulting from such compromise," which should be read in conjunction with the information contained within Item 1C, Cybersecurity.


text: Cybersecurity Governance The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees. Our Audit Committee is responsible for the oversight of cybersecurity risks, including our assessment of potential vulnerabilities and threats, evaluation of incidents, and monitoring of the implementation of key actions and/or projects to further enhance our ability to detect and manage ongoing security threats. Key members of management, including our security officer, provide updates to our Audit Committee on at least a semi annual basis. In addition to committee updates, our security officer also meets with the full Board of Directors at least annually to discuss the Company's overall risk profile and associated ongoing mitigation efforts. The briefings provided to our Audit Committee and Board of Directors include updates on the Company's key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.


text: Our security officer has over a decade of management and executive level information technology experience and reports to our SVP of Engineering and Technology. Our security officer is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, SVP of Engineering and Technology, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies. Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters. Where in the past we leveraged an outside fractional Chief Information Security Officer ("CISO"), during the year we transitioned to an in-house security leadership team. Our team includes personnel for supply chain security, governance risk and compliance and security engineering. We continue to leverage external industry partners in key areas including penetration testing, forensics, and for our security operations center. We use industry standard security tools across our program and reevaluate these annually as we digest the evolving threat landscape.


text: The Company's overall risks and assessments are monitored via a cross functional team composed of members of senior management, security, legal, and financial reporting. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process designed to assess, identify, and manage material risks from cybersecurity threats. This process is supported by both management and our Board of Directors.

companyName: Zevia PBC

ticker: ZVIA


text: To prevent, detect, mitigate, and remediate information security threats, including a cybersecurity incident and/or threat, we maintain a cyber risk management process managed by our Senior Vice President, Operations ("SVP, Operations") who reports to our CEO and has seven years of experience overseeing information technology processes and procedures, including cybersecurity matters. The SVP, Operations works with the Company's Legal team on cybersecurity strategy, policy, training, standards, architecture, and processes. We have invested, and expect to continue to invest, in resources for the protection and safeguarding of our information technology systems, including, but not limited to, networks, applications, and outsourced technology services in connection with the operation of our business. We have implemented cybersecurity systems and controls based on industry best practices and the U.S. National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use such standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. These resources are designed to detect and respond to cyber incidents that may result in unauthorized access to, ransomware, damages, or destruction of, our information systems.


text: Risk Management and Strategy Cybersecurity risk is a direct responsibility of management and the Company's information technology ("IT") team, including our Director, IT who has over 15 years of experience building, implementing, and managing information systems, developing cybersecurity programs, and deploying risk mitigation strategies for such systems. Working cross-functionally with our Legal team, our SVP, Operations oversees the IT team that regularly monitors and assesses cybersecurity risks, implements measures designed to mitigate such risks and their associated effects on the Company and personal data collected, stored, and processed in our systems, and manages our information security training and cybersecurity awareness program. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: Our approach to cybersecurity risk management includes the following: • Multi-Layered Defense and Monitoring – We work to protect our computing environments from cybersecurity threats through multi-layered defenses and monitoring efforts to identify cybersecurity threats, and to help prevent future attacks. We utilize data analytics systems to detect anomalies and identify cyber threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use third-parties to conduct additional reviews and assessments. • Insider Threats – We maintain organizational controls such as limited access, and access removal for terminated employees, designed to minimize insider threats, and address potential risks from within our Company. Our measures and controls are informed by industry practices, and designed to be consistent with applicable law, including privacy and other considerations. • Third Party Risk Assessments – We conduct privacy and information security risk assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access are required to participate annually in training, including phishing simulations and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – Our standard terms and conditions contain contractual provisions requiring that our third-party suppliers disclose to us the technical and organizational measures they maintain, the standards and certifications by which they are evaluated for information and cyber security, and their cybersecurity insurance protection level. We seek to mitigate risk by evaluating the foregoing against any potential cyber-related risks depending on the nature of the services being provided.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Nominating and Enterprise Risk Management ("NERM") Committee of the Board of Directors specifically assists the Board in its oversight of risks related to cybersecurity. In accordance with its charter, the NERM Committee receives regular reports at each of its quarterly meetings from management, including the SVP, Operations. Such reporting includes updates on the Company's cybersecurity program, information security matters, the evolving cybersecurity threat environment, applicable privacy law compliance, and the Company's mitigation plans and evolving mitigation strategy. The Chair of the NERM Committee regularly reports to the Board of Directors on cybersecurity risks and other related matters. In addition, both the NERM Committee and the Audit Committee, in a joint meeting, receive an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Management reports to the NERM Committee and/or the Board of Directors in between meetings as appropriate regarding any significant cyber events.


text: Since the beginning of the last fiscal year, we have not identified any cybersecurity threat or incident that has materially affected the Company or our financial position, results of operations and/or cash flows, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. We continue to invest in the cybersecurity and resiliency of our networks and enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors" included in this Annual Report.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related data (collectively "Information Systems and Data").

companyName: MANNKIND CORP

ticker: MNKD


text: Our cybersecurity risk committee, which includes employees with responsibility for information technology, information security, operations, finance and legal matters, has oversight of the cybersecurity program which manages our cybersecurity threats and risks. Members of this committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including: • using automated and manual tools for identifying threats; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments; • evaluating threats reported to us; • conducting scans of the threat environment; • conducting internal and external audits; • analyzing reports of threats and actors; • evaluating our and our industry's risk profile; • subscribing to reports and services that identify cybersecurity threats; and • utilizing third-party threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our security incident response and communication plan; • our disaster recovery plan; • ongoing risk assessments; • implementation of security standards; • encryption of data; • network security controls; • access controls; • physical security; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • dedicated cybersecurity personnel.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our enterprise risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk heat map with a specified mitigation plan; (2) our information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our cybersecurity risk committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us periodically to identify, assess, and manage material risks from cybersecurity threats, including for example;


text: • threat intelligence service providers; • cybersecurity software providers; • managed cybersecurity service providers; • penetration testing firms; • dark web monitoring services; and • professional services firms, including legal counsel.


text: Certain third-party application providers provide critical services for our business. Our vendor management program to manage cybersecurity risks associated with our use of these providers includes audits and a review of security assessments. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and the imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in this Annual Report on Form 10-K, including "Risk Factors – If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of Information Technology, who has more than 30 years of experience of building and managing critical systems that house sensitive data, and a dedicated information security analyst with more than 15 years of experience in providing protection and resilience against evolving threats. Our Executive Director of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. This member of the management team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and communication plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The cybersecurity risk committee works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response and communication plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the cybersecurity risk committee concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, incidents, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Our cybersecurity program is designed to align with industry standards and best practices for similarly situated companies in our industry and at our stage of development, and includes benchmarking against standards such as the National Institute of Standards and Technology Cybersecurity Framework (the NIST CSF). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through periodic vulnerability scans, penetration tests and threat intelligence feeds. We use various tools and methodologies to manage cybersecurity risk that are tested on a periodic cadence.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training that is provided to our employees and contractors, including those who are involved in incident response; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • assessment of cybersecurity risks posed by third parties, including current and potential collaborators, service providers, suppliers, vendors and other contractual counterparties, in each case, to the extent they have access to our critical systems or information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process— Our business and operations, or those of our CROs or other third parties, may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity, which could materially affect our business, results of operations and financial condition.".


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives scheduled annual reports from management on our cybersecurity risks, our cybersecurity risk management program and other cybersecurity-related educational topics. In addition, management updates the Audit Committee as necessary, regarding other cybersecurity incidents, including any material cybersecurity incidents.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management where it deems appropriate regarding cybersecurity.


text: Our management team—including our Chief Information Officer and our Vice President, Information Security, Risk and Compliance—is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer and our Vice President, Information Security, Risk and Compliance have more than 40 years of combined experience in the field of IT.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity risk management is a component of our overall risk management systems and processes and we recognize the importance of evaluating, detecting, and mitigating significant risks related to cybersecurity threats, including operational risks, theft of intellectual property, fraud, injury to employees or customers, and breach of applicable laws.

companyName: ARKO Corp.

ticker: ARKO


text: Our information security program aims to manage these cybersecurity risks and threats that we can reasonably anticipate using different methods, such as third-party assessments, internal IT audits, governance oversight, and risk and compliance reviews. We use various security tools designed to help protect our information systems from cyberattacks and to address any vulnerabilities or incidents in a timely manner, and we rely in part on third-party services to identify, prioritize, assess, reduce, and remediate cybersecurity threats and incidents.


text: Our information security program also evaluates potential risks associated with certain third-parties with whom we do business, especially our service providers that deal with sensitive employee, business, or customer data. This includes risk evaluation before choosing such vendors, periodic assessment thereafter and if a third-party has a reported cybersecurity incident, we perform an assessment to find and reduce risks related to such third-party incident that may affect us.


text: Our systems regularly face attacks that aim to interrupt and delay our operations or obtain information from our systems. Any major disruption or nefarious access, to our systems or a third-party's systems, could lead to disclosure or destruction of data, including employee, customer and corporate information, which may expose us to business, regulatory, litigation and reputation risk and could negatively affect our business and results of operations. As of the date of this Annual Report on Form 10-K, we have not encountered incidents from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. Refer to "Item 1A. Risk factors" in this Annual Report on Form 10-K, including "Significant disruptions of information technology systems, breaches of data security, or compromised data could materially adversely affect our business" for additional discussion about cybersecurity-related risks.


text: We perform various tasks designed to protect the Company from cybersecurity incidents, such as: conducting proactive cybersecurity reviews of systems and applications; performing penetration testing using external third-party tools and techniques; conducting employee training; and monitoring emerging laws and regulations related to data protection and information security. We evaluate risks from cyberattacks and technology threats and check our information systems for possible weaknesses. We use a risk quantification model created by the National Institute of Standards and Technology to find, assess and rank cybersecurity and technology risks and create related security controls and protections. Using third-party organizations and ongoing internal assessments, we regularly review and test our information security program to enhance our security measures and planning. We also engage an external auditor to perform an annual payment card industry data security standard review of our security controls protecting payment information, as well as quarterly third-party penetration testing of our cardholder environment and related systems.


text: We follow incident response and breach management processes that principally consist of four interrelated steps to identify and assess material risks from cybersecurity threats: (1) preparing for a cybersecurity incident; (2) detecting and analyzing a cybersecurity incident; (3) containing, eliminating and recovering from the cybersecurity incident; and (4) analyzing the cybersecurity incident after it is resolved. We assess, rank and prioritize cybersecurity incidents based on their severity and impact on our operations and business. Our information security team, with assistance from our legal team, oversees cybersecurity incident response and breach management processes and commencing with the formation of the Board's Cybersecurity Special Committee, reports to such committee.


text: GPM's Senior Vice President of Information Technology (the "SVP of IT"), who has more than 30 years of technology experience, leads our information security team. We also use additional employees with relevant educational and industry experience to support our information security program.


text: Until November 2023, our Board had oversight responsibility for cybersecurity threats, and the SVP of IT provided cybersecurity-related information to the Board on a periodic basis. In November 2023, the Board formed a Cybersecurity Special Committee which had oversight over our management of cybersecurity threats and until November 2024, was charged with periodically reporting on cybersecurity matters to the Board. The Cybersecurity Special Committee consisted of four independent directors. In January 2025, the Board changed the Cybersecurity Special Committee to be a subcommittee of the Audit Committee (the "Cybersecurity Subcommittee"). The Board's oversight, including through the Cybersecurity Subcommittee, includes receiving periodic reports from the SVP of IT and other information technology team members on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. In addition, the Cybersecurity Subcommittee is tasked with oversight of our annual cybersecurity assessment of key cybersecurity risks.


text: In November 2023, the Board adopted cybersecurity processes, which strengthened and formalized company-wide procedures related to identifying, managing and assessing cybersecurity threats. In the event of a cybersecurity incident which is potentially material, the SVP of IT must report such incident to the Company's CEO, CFO, General Counsel and the chair of the Cybersecurity Subcommittee, and these executives and board member determine whether, based on materiality or potential materiality, to report the cybersecurity incident to the Cybersecurity Subcommittee, which committee makes a determination if such cybersecurity incident requires a public filing.


text: Management's Role The Information Security function is led by the Company's Director of Cybersecurity & Architecture, under the direction of the Chief Information Officer ("CIO"). The Director of Cybersecurity & Architecture, assisted by a third-party fractional Chief Information Security Officer retained by the Company in August 2024, manages the Company's Cybersecurity program. The Company's cybersecurity management team includes members with relevant cybersecurity experience who hold cybersecurity certifications. Key responsibilities of this Information Security function include developing cybersecurity strategies; managing cybersecurity governance; performing cybersecurity risk assessments and tabletop exercises; ensuring compliance with security standards and regulatory requirements; managing identity and access; monitoring cybersecurity threats; validating cybersecurity alerts; preparing for and responding to cybersecurity incidents, business continuity and disaster recovery plans; and creating security awareness through periodic trainings of both Company leadership and Associates. The Company's CIO, Director of Cybersecurity & Architecture, and Chief Legal Officer ("CLO") have shared oversight responsibilities of the Company's Cybersecurity program.

companyName: SpartanNash Co


text: The Company's Board of Directors ("Board") has appointed the Audit Committee to assist the Board in fulfilling its responsibilities with respect to the oversight of cybersecurity, data security, privacy programs, and the Company's response to security breaches. Two Company Directors serving on the Audit Committee completed the National Association of Corporate Directors/Carnegie Mellon CERT cyber-risk oversight program along with required examinations and earned the CERT designation. The CIO provides at least quarterly updates to the Audit Committee on the Cybersecurity program, which include a current evaluation of the Company's maturity within the National Institute of Standards and Technology ("NIST") framework, including assessments against key performance indicators, updates on internal phishing campaigns, tabletop exercises conducted at various levels of the organization including with representation from the Audit Committee, and management training. The Audit Committee also reviews reports and recommendations from third parties periodically engaged by the Company to assess the cybersecurity control environment. In addition, the Company's Internal Audit function periodically audits elements of the security program and reports its observations to the CIO, CLO and the Audit Committee.


text: Risk Management and Strategy As a component of the Company's overall risk management process, which is aligned with a broader Enterprise Risk Management framework, the Company has implemented a multi-layered approach to minimize cybersecurity risk and safeguard its data. The Company conducts cybersecurity risk assessments on a regular basis and responds to identified risk exposures by employing a combination of risk mitigation strategies, including the adoption of cybersecurity controls and maintaining a cybersecurity insurance policy that provides coverage for security breaches. The Company engages third party consultants periodically to evaluate elements of the cybersecurity policy, processes, procedures and controls. The CIO and other members of the Executive Leadership Team respond to applicable recommendations arising from the third-party consultants. In addition, the Company engages a Qualified Security Assessor as part of the compliance requirements for Payment Card Industry ("PCI"). The Company also engages with a third-party risk management provider to ensure its vendors comply with internal security and privacy requirements and that key vendors are continually monitored for security risks. The Company's cybersecurity governance practices are based on the Company's common control framework which incorporates elements from the NIST Cybersecurity Framework, the Center for Internet Security's benchmark standards, and specific regulatory and industry requirements including Health Insurance Portability and Accountability Act and PCI.


text: The CIO provides at least quarterly updates on the cybersecurity program, including the results of the cybersecurity risk assessments and the related responses, to the Company's Security Governance Council composed of members of the Executive Leadership Team. The Company has a Cybersecurity Policy, Privacy Policy, Cybersecurity Incident Response Plan, and a materiality assessment framework inclusive of disclosure controls and procedures to assist the Company in satisfying disclosure obligations. The Company continually monitors cybersecurity threats and has a dedicated cybersecurity team in place to identify if any of the threats may lead to a cybersecurity incident. In the event of such an incident, the Company will take decisive measures to thoroughly analyze, contain, and eliminate the threat. The Company reviews cybersecurity incidents through a materiality assessment framework, which provides quantitative and qualitative considerations for evaluating the magnitude of an individual event. Based on the preliminary evaluation of an event, the Company's Cybersecurity Incident Disclosure Committee will convene to assess materiality and determine corrective actions and internal and external disclosure requirements. The Cybersecurity Incident Disclosure Committee is composed of the following individuals: the Chief Financial Officer, Corporate Controller, CLO, and CIO.


text: Effect of Cybersecurity Threats As of the effective date of this filing, the Company is currently not aware of any known or potential cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations, or financial conditions. Although the Company believes it has implemented sufficient security measures to protect against cyber-attacks, unknown cyber incidents could materially disrupt the Company's operations or compromise sensitive information.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: As one of the critical elements of the Company's overall risk management, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.


text: Risk Assessment: No less frequently than annually, our Adviser completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Adviser. To supplement our Adviser's internal assessment, our Adviser also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.


text: Technical Safeguards: Our Adviser deploys technical safeguards that are designed to protect the Company's and our Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: Our Adviser maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: Our Adviser provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Adviser's evolving information security policies, standards, processes and practices.


text: Our Adviser engages in the periodic assessment and testing of our Adviser's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Adviser adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Adviser. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Adviser, including the Adviser's Director of Information Technology.


text: The Adviser's Director of Information Technology, in coordination with relevant senior management and personnel of the Adviser, which includes our Adviser's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Adviser's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Adviser's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if a cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."


text: Cyber Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. This process is overseen by the Director of IT Operations and Information Security, or the IT Director, and includes periodic security assessments, audits, and testing, which are informed by industry standards and supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. We periodically engage with third parties to support these efforts. We maintain internal information security policies, including an incident response plan, which are reviewed by or at the direction of the IT Director and are updated periodically to reflect material changes and improvement in our information security practices. We have a process to assess and review the cybersecurity practices of third-party vendors and service providers prior to onboarding and periodically throughout the engagement, including through vendor questionnaires and contractual requirements, as appropriate.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Governance Related to Cybersecurity Risks The IT Director oversees and manages the day-to-day functions of our cybersecurity risk management program. The IT Director reports to the VP of Information Technology and Facilities, or VP of IT. The IT Director and VP of IT roles are both held by individuals who each have over twenty years of professional information technology, or IT, management experience. The VP of IT meets regularly with the Audit Committee to report on and discuss information security and technology risks to our business, including our cyber risk management programs, controls, and procedures. The VP of IT and the Audit Committee also conduct a high-level review of the threat landscape facing our business, discuss risk mitigation strategies, and the prioritization of our remediation efforts.


text: The IT Director meets periodically with members of the Relay Information Security Council, or RISC, which is comprised of the VP of IT and senior leaders from various functions, including finance, legal, human resources, corporate development, and research and development. The RISC provides input to the IT Director in connection with proposed cyber strategies as it relates to potential business impacts from new or proposed technologies and security solutions across the organization, including implementation strategies designed to address potential risks and disruptions to the business. In the event we or one of our business partners experiences a cybersecurity incident, the RISC is responsible for assisting in evaluating the incident, including whether any disclosure of the incident is required. The VP of IT reports to the Audit Committee on cyber initiatives and implementation resulting from RISC discussions.


text: Through the Audit Committee, the Board of Directors is informed of: (i) security initiatives, (ii) existing and emerging cybersecurity risks, including cybersecurity incidents; and (iii) any disclosure obligations arising from any cybersecurity incidents. The Board of Directors oversees our general risk management strategy and the most significant risks facing our business, and is responsible for ensuring that appropriate risk mitigation strategies are implemented.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: ZimVie Inc.


text: Managing Material Risks and Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework. This integration ensures that cybersecurity considerations are an integral part of our overall risk management system and processes. In addition, our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our systems and to advise us on cybersecurity risk management processes. These relationships enable us to leverage specialized knowledge and insights, in an effort to keep our cybersecurity strategies and processes at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: Overseeing Third-party Risk We have implemented processes to oversee and manage risks from cybersecurity threats associated with third-party service providers. We conduct security requirements assessments of third-party providers before engagement and maintain ongoing monitoring for compliance with our cybersecurity requirements. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to risks from cybersecurity threats that could have that effect, as further described in Part I, Item 1A "Risk Factors" of this Annual Report.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and has established robust processes to oversee such risks.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and has been delegated responsibility for assessing and managing such risks. The Audit Committee members have diverse expertise in risk management, technology and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk and Reporting to the Board of Directors Our Chief Information Officer ("CIO") and Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee at their meetings on a regular basis. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to the scheduled meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. In addition, the Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of IT Security, reporting to the CIO. Our Director of IT Security oversees our cybersecurity program, tests our compliance with standards, remediates known risks and leads our employee security training program. With over 25 years of experience in the field of cybersecurity, our Director of IT Security brings a wealth of expertise to the role, including extensive experience as an enterprise head of security and recognition within the industry. Our Director of IT Security provides in-depth knowledge and experience, which is instrumental in developing and executing our cybersecurity strategies.


text: Monitoring Cybersecurity Incidents Our Director of IT Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have in place a detailed incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. In addition, our Director of IT Security is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition assists in the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, using widely recognized industry frameworks. We use risk management strategies that focus on vital areas such as data protection, access control, incident response, and vulnerability management, and we have integrated these processes into our overall risk management program. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Alector, Inc.

ticker: ALEC


text: We have implemented a multi-faceted cybersecurity program in accordance with globally recognized standards to protect the confidentiality, integrity, and availability of our information assets. The primary aims of this program are to devise, initiate, and maintain a cybersecurity approach that safeguards our systems, services, and data from unauthorized access, outages, exposure, modification, damage, and loss.


text: We have implemented a range of logical and technical controls to appropriately restrict physical and logical access. We maintain authentication controls in line with industry-recognized standards, including audit trails and logs for access. Access privileges are updated following any change in personnel or system, and are reviewed periodically, with the frequency determined by the associated risk of the application or system.


text: We engage the expertise of third-party organizations to assist us to design and implement our cybersecurity procedures, as well as to monitor and test our safeguards in the context of recognized industry standards and practices. This process aims to confirm that our security infrastructure is robust and efficient, and that it is designed to resist diverse security threats. We use the critical insights gained from these third-party assessments to continue to improve our security controls and protect our systems and data.


text: We evaluate potential cybersecurity risks associated with third-party service providers, including through a periodic vendor security review process overseen by our Head of Cybersecurity.


text: We have not encountered any cybersecurity threats or incidents to date that have materially affected, or that are reasonably likely to materially affect, our business, strategy, results of operations or financial condition. For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our Vice President, Technology and Digital Health, serves as our Head of Cybersecurity and is responsible for developing and executing our cybersecurity strategy and program. We also maintain a team of cybersecurity professionals who are responsible for security operations and report to the Head of Cybersecurity, who has more than 20 years' experience in cybersecurity and information technology infrastructure and operations.


text: Our Head of Cybersecurity is regularly informed about developments in cybersecurity, including potential threats and innovative risk management techniques in the interest of effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Head of Cybersecurity oversees the processes for monitoring our information systems, including periodic system audits to identify potential vulnerabilities and third-party audits and evaluations. In the event of a cybersecurity incident, the Head of Cybersecurity implements an incident response plan. This plan includes immediate actions to mitigate the impact of incidents and strategies for remediation of future incidents. The Head of Cybersecurity is responsible for reporting information about cybersecurity risks and incidents to our Chief Financial Officer and other members of executive management.


text: Our board of directors oversees our enterprise risk management, including our management of cybersecurity risks. The audit committee of our board of directors has primary responsibility for the oversight of risks from cybersecurity threats. The Head of Cybersecurity, or a delegate, provides quarterly reports to the audit committee on the effectiveness and overall status of our cybersecurity program, and is responsible for reporting to the audit committee information about our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with various applicable security and/or technical requirements and best practices, including those established by the National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as a framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership from both TKO and Endeavor that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC systems and personnel. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members from both TKO and Endeavor. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to TKO's Cybersecurity Executive Steering Committee, which includes TKO's Chief Administrative Officer, Chief Legal Officer, Chief Financial Officer, Deputy Chief Financial Officer, Chief Accounting Officer, Chief Product & Technology Officer, Corporate Secretary and Head of Investor Relations, as well as Endeavor's Chief Financial Officer, Chief Accounting Officer, Chief Legal Officer, Chief Compliance Officer, Chief Information Officer, SVP, Internal Audit, SVP, Global Privacy & Cybersecurity, SVP, Cybersecurity, SVP, Head of Corporate Security and Chief Communications Officer. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.


text: Our cybersecurity risk management program, thus, includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a written cybersecurity incident response plan; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our personnel, incident response personnel, and senior management not less often than once per calendar year; • phishing simulations at regular intervals (not less than quarterly) to all users of the Company's email system; and • a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the Company or the Company's confidential or proprietary information or otherwise is connected to any Company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the Company's cybersecurity team may propose remediation measures (which are set forth in the contractual obligations to be agreed upon by the vendor).


text: Our continually evolving cybersecurity strategies are informed by multiple threat intelligence resources, the status of ongoing remediation plans, and technical developments. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Business — Failure to protect our IT Systems and Confidential Information against breakdowns, security breaches, and other cybersecurity risks could result in financial penalties, legal liability, and/or reputational harm, which would adversely affect our business, results of operations, and financial condition."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from TKO's Chief Information Officer and SVP, Global Privacy & Cybersecurity, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board receives regular updates regarding the Audit Committee's activities.


text: Our management team, including TKO's Chief Information Officer and SVP, Global Privacy & Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Global Privacy & Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. In 2024, TKO's SVP, Global Privacy & Cybersecurity, leads a team of three dedicated privacy professionals in the Legal department.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity risk management and strategy Protecting our data, which includes information related to our patients, members, and customers, is a primary area of our focus. Given the critical nature of this information, we have developed and implemented a robust cybersecurity risk management program to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K. Cybersecurity is an important and integrated part of our risk management program that identifies, monitors and mitigates business, operational and legal risks.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: This program has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws.


text: To address cybersecurity risks facing our organization, we have adopted a "continuous risk assessment" process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the effectiveness of our program and related controls. The results of that assessment are shared with management, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.


text: We also have a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain and eradicate the issue and then restore systems in the event of a major disruption. Regularly, we conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: We have a commercial cybersecurity insurance policy that provides for coverage for losses sustained from cybersecurity incidents, subject to certain deductibles and limitations. However, costs and damages associated with cybersecurity incidents could exceed our commercial insurance coverage which could have a material adverse effect on our business, financial position and results of operations.


text: Third parties who provide services and solutions to our organization are also a source of cyber risk. Through a third-party risk management program, we review risks associated with these third parties through contractual reviews, vendor risk assessments, and continual risk reviews by monitoring the cybersecurity risk exposure these third parties pose and implementing remediation where necessary.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2024 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Information Technology - A cyber security incident could cause a violation of HIPAA, breach of patient or other persons privacy, or other negative impacts." under "Item 1A. Risk Factors."


text: Governance of Cybersecurity Cybersecurity is an integral part of our risk management program and is an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, including quarterly updates from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity, such as key risks facing the healthcare industry and our company, core topics, review of incidents, as well as progress against key information security initiatives. Senior executive leadership also engage in ad-hoc discussions with management on cybersecurity topics. In addition, our Board of Directors are provided with an annual report regarding cybersecurity information and related topics.


text: Our cybersecurity risk management and strategy processes are overseen by our CISO along with leaders from our Information Security, Compliance, Legal and Internal Auditing teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.