text: Risk management is further managed through the use of an expert third party company to assist in managing relevant risks. We outsource our monitoring to a third-party provider whereby we benefit from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to us promptly by our third-party provider and material and potentially material incidents would be assessed by management for remediation and future prevention and detection. business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property.


text: Any disruption, compromise, or breach of our network systems or infrastructure due to a cybersecurity threat or incident could adversely affect our operations, services, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our customers' and partners' proprietary information, which may include personally identifiable information. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction and harm to our relationships with corporate partners.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH

secItem: Item 1C


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from common attacks to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Silo Pharma, Inc.

ticker: SILO


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.


text: Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, any incident will be reported to our Board of Directors who will then formulate a plan for mitigation, recovery, and notification. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate the Business Combination. However, because we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: Cantor Equity Partners I, Inc.

ticker: CEPO


text: The Board and the Audit Committee oversee risk for us and are generally responsible for the oversight of risks from cybersecurity threats. Our management will promptly report to the Board and the Audit Committee any cybersecurity incidents impacting us and the measures that may be taken to mitigate such incidents.


text: In the event of a cybersecurity incident, we intend to follow an incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel and the Board and the Audit Committee. It is possible that the occurrence of any cybersecurity incidents, or a combination of them, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. We have not encountered any cybersecurity incidents since the Initial Public Offering.


companyName: Cantor Equity Partners, Inc.


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Accordingly, we address these risks by implementing and maintaining processes, and technologies designed to prevent, detect, and mitigate incidents that could pose cybersecurity risk. We are equally subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; interruption of business activities and activities of our customers; violation of privacy laws; litigation and legal risk; and reputational risk. In adopting our risk assessment and management program, we are committed to safeguarding our systems and data.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Additionally, we monitor emerging laws, industry standards, and regulations related to information security and data protection. Although we have not experienced any cybersecurity incidents or threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition to date, and though we are actively monitoring our networks and access points by implementing security updates regularly, we cannot provide any assurance that there will not be incidents or threats in the future that may materially affect us, including our business strategy, results of operations, or financial condition.


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed and these assessments incorporate various activities including information security assessments and independent reviews of our information security control environment and operating effectiveness. We utilize managed detection and response systems, endpoint protection, content filtering aimed at blocking malware and software to eliminate phishing, ransomware, and fraud. We also utilize multi-factor authentication on all sensitive applications and information entry-points, review access to data regularly, and have failover-protected business disaster recovery and backup storage systems. The Company conducts cybersecurity training and testing programs regularly.


text: Governance Pursuant to our risk management policy, responsibility for the implementation of our risk management policy resides with the Chief Financial Officer. Management performs a periodic assessment (at least annual) of compliance, financial, IT, and fraud risks. Responses are consolidated and reviewed with management and the Audit Committee. The result of the risk assessment effort is leveraged to formalize management's operating effectiveness testing plan for the next year. The Audit Committee receives an update on the Company's risk management process, risk trends and any incidents at least annually from the management team. In the event of any incident, the Company expects to notify the Audit Committee immediately, or as soon as possible. For additional information regarding cybersecurity risks, see Item 1A "Risk Factors."


text: The Sponsor recognizes the importance of managing cybersecurity risks to protect its business operations, clients, and stakeholders. The Sponsor has implemented a comprehensive Cybersecurity Policies and Procedures Plan for the Funds, which outlines our approach to identifying, assessing, and mitigating cybersecurity threats and vulnerabilities in alignment with industry standards and best practices.

companyName: VS Trust

ticker: SVIX


text: The Funds have established a risk-based cybersecurity framework to manage cybersecurity risks effectively. This framework includes regular assessments of its information systems, physical and virtual infrastructure, and the data therein, to identify potential cybersecurity threats and vulnerabilities. Our cybersecurity strategy is integrated into the Funds' overall risk management processes, with specific consideration given to the confidentiality, integrity, and availability of our information systems.


text: Third-Party Service Providers: The Funds engage with various third-party service providers for critical operations and services. The Sponsor conducts rigorous cybersecurity risk assessments of all vendors and business partners with access to our networks or sensitive information. These assessments ensure that third-party cybersecurity policies are robust and align with our cybersecurity standards.


text: To date, there have been no material cybersecurity incidents that have significantly impacted the Funds' business strategies, results of operations, or financial condition. The Sponsor continues to monitor our systems and processes to mitigate potential cybersecurity risks actively.


text: Sponsor Oversight: The Sponsor of the Fund has a fundamental role in overseeing the Funds' cybersecurity risk management. The Sponsor receives regular updates on cybersecurity matters from management and third-party service providers, ensuring that cybersecurity risks are managed proactively at the highest level of the organization.


text: Management's Role: Our Chief Compliance Officer, Chang Kim, is responsible for overseeing the development, implementation, and ongoing management of the Fund's Cybersecurity Policies and Procedures including the monitoring of our systems for potential cybersecurity events and the implementation of preventive and mitigative measures.


text: We are a blank check company with no business operations. Since our initial public offering ("IPO"), our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We do not engage any assessors, consultants, auditors, or other third parties in connection with any processes for accessing, identifying, and managing material risks from cybersecurity threats. Our board of directors (the "Board") is generally responsible for the oversight of risks from cybersecurity threats, if there are any. If management determined that there was a cybersecurity incident, management would bring the incident to the Board. Management has no formal committee relating to cybersecurity, nor does any personnel have any specific experience relating to cybersecurity. We have not encountered any cybersecurity incidents since our IPO.

companyName: Plum Acquisition Corp. III

ticker: PLMJF


text: Risk Management and Strategy Management believes the Company has adequate processes and systems to maintain the confidentiality of its communications and records. However, given our current business plan and lack of significant operations and employees, management does not believe that cybersecurity threats constitute a material risk for the Company. The Company currently does not have formal processes for assessing, identifying and managing risks from cybersecurity threats to the Company directly or through third-party service providers. We do not engage assessors, consultants, auditors or other third parties in connection with cybersecurity. The Company has not experienced any cybersecurity incidents to date.

companyName: Unite Acquisition 2 Corp.


text: The board of directors oversees risks from cybersecurity threats. However, there are no specific processes by which the board may be informed about such risks.


text: Management is responsible for assessing and managing any material risks to the Company from cybersecurity threats. However, management has no specific expertise in such matters, and there are no specific processes by which management is informed about or monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. If any such risks were identified, management would report such risks to the board of directors.


text: If and when the Company completes a merger or other acquisition, the board of directors and management will assess the risks of cybersecurity threats to its business and adopt processes for assessing, identifying and managing risks from cybersecurity threats as warranted.


companyName: Palomino Laboratories Inc.


text: is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. " Risk Management and Strategy Cybersecurity

companyName: GAXOS.AI INC.

ticker: GXAI


text: risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and processes to align with the latest in industry best practices and an ever-changing threat landscape. risk assessment is performed on all new products and product updates; internal staff with security certifications, and we work with third parties to perform security vulnerability testing; to data protection laws are closely monitored and necessary changes are implemented; routine security training to employees and communicate any emerging threats; Review the security posture of all third parties that we engage; a comprehensive incident response plan; cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.


text: we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.


text: team responsible for monitoring and assessing cybersecurity threats, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity. Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.


text: The Sponsor's Chief Information Security Officer ("CISO") is responsible for overseeing the Trust's cybersecurity practices. The CISO also manages IT affecting the Trust. The CISO is responsible for overseeing the ongoing adequacy of design and effective implementation of these policies and procedures and to review these procedures at least annually. The CISO is trained as a computer scientist (Master of Science) with extensive programming and system administration experience. The CISO's background includes study of many of the IT building blocks of a modern office infrastructure, including the study and programming of network protocols, information theory, public key cryptography.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Information Systems Security The Sponsor's CISO oversees the maintenance of an inventory of information systems ("Information Systems") employed by the Sponsor of the Trust either directly or through a vendor. Information Systems include electronic and physical systems used to store, process or transmit information either directly or through a service provider. This includes all methods of data processing, transmission, and retention, both electronic and physical. Electronic Information Systems used by on behalf of the Trust must, at a minimum, adequately address security elements consistent with applicable state and local regulatory requirements and best practices pertaining to: Data Storage, User Access, and Data Transmission.


text: The adequacy of security measures used by service providers for internal information will be evaluated in connection with the risk assessment process outlined below in the section labeled Risk Assessment. The CISO is responsible for classifying information, identifying risks, and identifying risk mitigation strategies. The CISO is also responsible for evaluating the adequacy of risk mitigation strategies prior to deploying any Information System. Externally hosted applications (those not installed on the Sponsor's local network and servers) are reviewed by the CISO at least annually thereafter.


text: Risk Identification The CISO will identify reasonably foreseeable risks to the security or integrity of each Information System. The risk identification process will consider appropriate internal and external threat scenarios based on people, process or technology vulnerabilities that could cause the Information System to be compromised, damaged, tampered with or otherwise impaired.


text: The CISO will identify processes or controls to mitigate identified risks to the security or integrity of each Information System. The computer system security requirements set forth below in this policy may adequately mitigate certain identified risks. Other processes or controls may be required to adequately mitigate other risks.


text: As part of the Sponsor's ISSP for the Trust, the CISO will document in a risk assessment the Information Systems for the Trust, risks identified in Information Systems, and related risk mitigation processes and controls. Included in the risk assessment will be an assessment of each risk's potential impact on the operations affecting the Trust, on the security of the Trust's data, and also potential business consequences of each risk.


text: The CISO will review and update the risk assessment at least annually. Additionally, at least annually (for external hosted applications) and following any significant change in operations (for all applications), the CISO is responsible for gathering information about the operation of previously identified risk mitigation strategies and any changes to information classification, identified risks or risk mitigation strategies. The CISO must evaluate the risk mitigation strategies for ongoing adequacy. The evaluation must be documented in a form prescribed by the CISO. If the CISO concludes that risk mitigation strategies are inadequate for an Information System containing confidential or internal information, action will be taken to either correct the inadequacy in a timely manner or discontinue use of the Information System.


text: Cybersecurity Procedures The Sponsor has adopted procedures to implement the cybersecurity policy applicable to the Trust, which include the following:


text: The Sponsor maintains system access rights and controls for the Trust including: restricting Supervised Persons' (a "Supervised Person" is each employee, officer, member, and other persons who are subject to the Sponsor's supervision and control) network resources access to the systems which are necessary for their business functions, secure remote access protocols; The Sponsor maintains its systems carrying Trust data with appropriate updates and virus protections;


text: The Sponsor promptly eliminates access to all networks, devices, and resources as part of its HR procedures in the event a Supervised Person resigns or is terminated. Such Supervised Person is required to immediately return all Sponsor-related equipment and information to the CISO; The Sponsor has adopted procedures governing the use of mobile devices for the business purposes affecting the Trust;


text: The Sponsor prohibits Supervised Persons from installing software on company owned equipment without first obtaining approval from the CISO or other designated person(s);


text: The CISO or other designated person(s) conducts periodic monitoring of the networks affecting the Trust to detect potential cybersecurity events;


text: The CISO or other designated person(s) conducts periodic monitoring of the networks affecting the Trust to detect unauthorized data transfers;


text: Security procedures to protect information that is electronically stored or transmitted include authentication protocols; secure access control measures, and encryption of all transmitted files;


text: All suspicious activity involving the Information Systems affecting the Trust recognized or uncovered by personnel should be promptly reported to his or her supervisor and/or the CISO; and A Supervised Person must immediately notify his or her supervisor and/or the CISO to report a lost or stolen laptop, mobile device, and/or flash drive. There have been no cybersecurity incidents since the Trust has been founded.


text: Our cybersecurity team, led by our Chief Technology Officer, Peter Shelus, uses a multi-pronged approach to assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Myseum, Inc.

ticker: MYSE


text: This approach includes identifying and assessing risks through: (1) an enterprise risk management program, which is periodically refreshed and includes an identification of our top risks, including cybersecurity risks; (2) formalized security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal "red team" program, which simulates cyber threats, intended to allow us to fix vulnerabilities before threat actors identify them; (5) a threat intelligence program designed to model and research our adversaries; and (6) a privacy and security incident response program designed to investigate, respond to, and remediate known incidents. These processes vary in scope and maturity across the business and are processes we work to continually improve.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and notification provisions, and ongoing monitoring of vendors, as appropriate.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants.


text: The material cybersecurity threats identified through these processes are managed by our CISO and, where appropriate, our risk and compliance committee, in consultation with management.


text: Together, they identify responsive actions for inclusion in our annual strategic planning, or earlier resolution depending on the nature of the risk.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors" in Part I, Item 1A in this Annual Report


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function, which we rely on a third-party vendor who is associated with a Related Party to provide. Such processes include physical, procedural, and technical safeguards and routine review of our policies and procedures to identify risks and improve our practices. We use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Envoy Medical, Inc.

ticker: COCH


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled " Failure of a key information technology system, process or site could have an adverse effect on our business " in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.


text: Our third-party vendor, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller-reporting Company we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Columbus Acquisition Corp/Cayman Islands

ticker: COLA


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Red Rock Acquisition Corp.


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our initial public offering.


text: Risk Management and Strategy company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties.

companyName: CO2 Energy Transition Corp.

ticker: NOEM


text: We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management will report to the Board of Directors and provide updates on the Management's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.


text: To date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: Management and Strategy We have developed and continue to enhance our cybersecurity governance program to help protect the security of our computer systems, software, networks, and other technology assets against material risks from cybersecurity threats, including unauthorized attempts to access confidential information or to disrupt or degrade our business operations. Our cybersecurity governance program is strategically integrated into our broader risk management framework and aims to (1) proactively manage cyber and information security risks at the Company, (2) implement the internal controls required by cybersecurity regulatory requirements as well as the Company's information security control objective documents and information security standards, and (3) improve the efficiency, maturity, and effectiveness of technology functions and processes.

companyName: LogicMark, Inc.

ticker: LGMK


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until discovered.


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and has primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Chief Risk Officer ("CRO")


text: with the assistance of IT support plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings directly to the Board of Directors, as needed. These briefings encompass a broad range of topics, including any emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events that may occur. The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our CRO works closely with our IT support to assess, monitor, and manage our cybersecurity risks. Our IT support regularly provides updates and reports to our CRO of all aspects related to cybersecurity risks and incidents, which are then presented to the Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), as necessary. This helps ensure that the highest levels of management are kept abreast of the cybersecurity potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions, if any, are escalated to our Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Profusa, Inc.

ticker: PFSA


text: We recognize the critical importance of maintaining the safety and security of our systems and data, and have a holistic approach for overseeing and managing cybersecurity and related risks. Our Board of Directors (the "Board"), the Audit Committee of the Board (the "Audit Committee"), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. A key component of this is our standing Security Steering Group ("SSG") whose members include, among others, our Chief Information Security Officer ("CISO"), Chief Product Officer, and Chief Technical Systems Officer. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and practices will be properly followed in every instance or that they will be effective.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Although we are not aware of having experienced any prior material data breaches, regulatory non-compliance incidents, or cyber security incidents, we may in the future be impacted by such an event, exposing our clients and us to the risk of someone obtaining access to our information, to the information of our clients or their customers, or to our intellectual property, disabling or degrading service, or sabotaging systems or information. Any such security breach could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation, and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss. For additional information, see "Item 1A. Risk Factors" of this Annual Report.


text: Risk Management and Strategy Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and certain other applicable industry standards.


text: We have implemented a governance structure and processes to aggregate reported cybersecurity risks on behalf of Pega Cloud, Pega's software products, and the corporate environment. Our SSG is responsible for providing strategic direction for implementing and maintaining our cyber risk management program.


text: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is in the scope of our ISO 27001 certifications.


text: At least annually, we conduct cybersecurity risk assessments that consider information from internal stakeholders, known information security vulnerabilities, and information from external sources, such as reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessments are provided to our SSG and are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform our broader enterprise-level risk assessment. Key findings of these assessments are periodically presented to the Board and the Audit Committee.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.


text: Incident Response and Recovery Planning We have implemented Cyber Incident Response Programs, which are in the scope of our ISO 27001 certifications. We have also implemented Business Continuity Programs, which are in the scope of our ISO 22301 certification. We have established comprehensive incident response and recovery plans and test and evaluate the effectiveness of those plans regularly.


text: Third-Party Risk Management We have implemented a Vendor Cybersecurity Risk Management Program ("VCRMP"), which is in the scope of our ISO 27001 certifications. The VCRMP controls are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in making these risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We require all employees to participate in security awareness training, including frequent phishing tests. Currently, our mandatory employee training courses include Security Awareness, Physical Security Awareness, Mobile Device Security, Business Continuity and Phishing, Work From Home, and AI Chatbot. In addition, all of our employee software developers are required to take additional security awareness training, currently including Secure Development. We periodically adjust the list of mandatory and optional courses.


text: Corporate Security Posture We periodically conduct independent security assessments to assess its security posture and to inform where cyber security investments should be made. For systems in our corporate environment on which our cloud certifications have an operational dependency, we also maintain ISO/IEC 27001 certifications relating to overall IT processes and controls and ISO 22301 certification relating to business continuity.


text: Product Security Posture To facilitate identification of security vulnerabilities in our products, we periodically conduct third party penetration tests and participate in the independent Verified By Veracode program, as detailed on its website (https://www.veracode.com/verified/directory/pegasystemsInc) which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report. We also generate a monthly software bill of materials that identifies open source included in certain of our product offerings and periodically have an independent security assessment firm evaluate the security risks linked to suppliers we use, including source code repositories, the infrastructure employed for software development, and the mechanisms used for software delivery, such as Amazon Web Services ("AWS"), Google Cloud, and Microsoft Azure. Our Chief Product Officer reviews these findings and provides updates to our SSG.


text: We regularly release new versions of our products to address identified security vulnerabilities, enabling clients to stay updated with the latest product releases. However, even after we make these updates available, it is possible that clients do not implement these updates or use products on extended support that do not include security updates.


text: Pega Cloud Security Posture Pega Cloud undergoes several security assessments a year. Redacted versions of these reports are made available to our clients. Pega Cloud also maintains several security certifications, which are listed at http://pega.com/trust which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.


text: Pega Cloud for Government is rated FedRAMP Moderate and undergoes several security assessments a year as part of the FedRAMP certification process. Our Chief Technical Systems Officer reviews these assessments and provides updates to our SSG.


text: As part of our corporate governance process, the Board, along with the Audit Committee, oversees our risk management process, which includes cybersecurity and related risks. Our CISO periodically meets with the Board and Audit Committee to inform and update them on our cybersecurity program.


text: SSG and Key Personnel We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Chief Technical Systems Officer. The SSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program. The SSG meets at least quarterly. Our CISO chairs the SSG and decisions and recommendations are based on a consensus of the members.


text: Our CISO has twenty years of professional experience, with eleven years specifically in information security roles. He has been with Pega for four years and has a Master of Science degree from Northwestern University.


text: Our Chief Product Officer has been with Pega for thirty-one years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.


text: Our Chief Technical Systems Officer has been with Pega for six years and has twenty-five years of technology management experience, with thirteen years of leadership roles in cloud services and related information security issues, and served in the U.S. Navy and holds a degree in Business Administration from the College of Technology at the State University of New York – Farmingdale.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a comprehensive approach to overseeing and managing cybersecurity and related risks. Our Board of Directors (the "Board"), the Audit Committee of the Board (the "Audit Committee"), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. A key component of this is our standing Security Steering Group ("SSG"), whose members include, among others, our Chief Information Security Officer ("CISO"), Chief Product Officer, and Vice President of Cloud Technology. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and practices will be properly followed in every instance or that they will be effective.


text: Although we are not aware of having experienced any prior material data breaches, regulatory non-compliance incidents, or cyber security incidents, we may in the future be impacted by such an event, exposing our clients and us to the risk of someone obtaining access to our information, to the information of our clients or their customers, or to our intellectual property, disabling or degrading service, or sabotaging systems or information. Any such security incident could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation, and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss. For additional information, see "Item 1A. Risk Factors" of this Annual Report.


text: Risk Management and Strategy Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and certain other applicable industry standards.


text: We have implemented a governance structure and processes to aggregate reported cybersecurity risks on behalf of Pega Cloud, Pega's software products, and the corporate environment. Our SSG is responsible for providing strategic direction for implementing and maintaining our cyber risk management program.


text: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is within the scope of our ISO 27001 certifications.


text: At least annually, we conduct cybersecurity risk assessments that consider information from internal stakeholders, known information security vulnerabilities, and information from external sources, such as reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessments are provided to our SSG and are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform our broader enterprise-level risk assessment. Key findings of these assessments are periodically presented to the Board and the Audit Committee.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.


text: Incident Response and Recovery Planning We have implemented Cyber Incident Response Programs, which are within the scope of our ISO 27001 certifications. We have also implemented Business Continuity Programs, which are within the scope of our ISO 22301 certification. We have established comprehensive incident response and recovery plans and test and evaluate the effectiveness of those plans regularly.


text: Third-Party Risk Management We have implemented a Vendor Cybersecurity Risk Management Program ("VCRMP"), which is within the scope of our ISO 27001 certifications. The VCRMP controls are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in making these risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We require all employees to participate in security awareness training, including frequent phishing tests. Currently, our mandatory employee training courses include Security Awareness, Physical Security Awareness, Mobile Device Security, Business Continuity and Phishing, Work From Home, and AI Chatbot. In addition, all of our employee software developers are required to take additional security awareness training, currently including Secure Development. We periodically adjust the list of mandatory and optional courses.


text: Corporate Security Posture We periodically conduct independent security assessments to assess our corporate environment's security posture and inform where cyber security investments should be made. For systems in our corporate environment where our cloud certifications have an operational dependency, we also maintain ISO/IEC 27001 certifications relating to overall IT processes and controls and ISO 22301 certification relating to business continuity.


text: Product Security Posture To facilitate identification of security vulnerabilities in our products, we periodically conduct third party penetration tests and participate in the independent Verified By Veracode program, as detailed on its website (https://www.veracode.com/verified/directory/pegasystemsInc) which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report. We also generate a monthly software bill of materials that identifies open source included in certain of our product offerings and periodically have an independent security assessment firm evaluate the security risks linked to suppliers we use, including source code repositories, the infrastructure employed for software development, and the mechanisms used for software delivery, such as Amazon Web Services ("AWS"), Google Cloud, and Microsoft Azure. Our Chief Product Officer reviews these findings and provides updates to our SSG.


text: We regularly release new versions of our products to address identified security vulnerabilities, enabling clients to stay updated with the latest product releases. However, even after we make these updates available, it is possible that clients do not implement these updates or use products on extended support that do not include security updates.


text: Pega Cloud Security Posture Pega Cloud undergoes several security assessments a year. Redacted versions of these reports are made available to our clients. Pega Cloud also maintains several security certifications, which are listed at https://pega.com/trust, which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.


text: Pega Cloud for Government is rated FedRAMP Moderate and undergoes several security assessments a year as part of the FedRAMP certification process. Our Vice President of Cloud Technology reviews these assessments and provides updates to our SSG.


text: As part of our corporate governance process, the Board, along with the Audit Committee, oversee our risk management process, which includes cybersecurity and related risks. Our CISO periodically meets with the Board and Audit Committee to inform and update them on our cybersecurity program.


text: SSG and Key Personnel We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Vice President of Cloud Technology. The SSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program. The SSG meets at least quarterly. Our CISO chairs the SSG and decisions and recommendations are based on a consensus of the members.


text: Our CISO has over twenty years of professional experience, with twelve years in information security roles. He has been with Pega for five years and has a Master of Science degree from Northwestern University.


text: Our Chief Product Officer has been with Pega for thirty-two years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.


text: Our Vice President of Cloud Technology has been with Pega for seven years and has twenty-five years of networking and security management experience, with seventeen years of leadership roles in cloud services and related information security issues.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity program is designed to protect and preserve the confidentiality, integrity, and availability of our networks and systems, as well as information that we own or is in our care, through a risk-based approach. The Company's program is based on the U.S. National Institute for Standards and Technology standards and other applicable industry frameworks. Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing a comprehensive set of practices, processes, and technologies designed to protect our data digital assets and data.

companyName: Strategic Education, Inc.

ticker: STRA


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which includes periodic "phishing" testing; • intrusion detection by monitoring network and system activities to detect unusual or suspicious behavior; • access management and access controls which aim to implement "least privilege" access; • protection of sensitive data through "at rest" and "in transit" encryption; • industry-standard monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • developing plans for recovering from security incidents and maintaining business continuity in the face of cyberattacks; and • a cybersecurity incident response plan that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents.


text: The Company's cybersecurity program is integrated within the Company's enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks.


text: The Company maintains arrangements with third party information infrastructure (IT) vendors—including "cloud computing" vendors. The Company has processes designed to manage cybersecurity risks arising from our use of such vendors, including conducting risk assessments prior to integration into the Company's networks and additional assessments prior to contract renewals or extensions. Cybersecurity measures employed by significant third-party service providers are also assessed prior to introduction into our environment. The Company also commissions third-party risk assessments of certain IT vendors to identify and evaluate risks associated with each third party and to minimize potential disruptions and liabilities that may arise from external partnerships. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.


text: To date, the risks from cybersecurity threats have not materially affected the Company. Our cybersecurity program is designed to detect and prevent cybersecurity events that would have a material adverse effect on the Company. Despite our efforts, however, the threat of sophisticated, targeted computer crime poses a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Notwithstanding our efforts to protect intellectual property and confidential and personal information, our facilities and systems may be vulnerable to cybersecurity events. See "Item 1A. Risk Factors – Risks Related to our Business."


text: We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team ("CSIRT") responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO's professional background, the CISO maintains several relevant industry credentials, including ISACA Certification in Risk and Information Systems Control ("CRISC") and ISC2 Certification in Information Systems Security Professional ("CISSP").


text: The Audit Committee of the Company's Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company's enterprise risk assessment and risk management policies and guidelines, including cybersecurity. The Audit Committee receives quarterly cybersecurity updates from the Chief Information Officer and/or the CISO. Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.


text: The Company maintains a process to escalate certain cybersecurity incidents promptly so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity program is designed to protect and preserve the confidentiality, integrity, and availability of our networks and systems, as well as information that we own or is in our care, through a risk-based approach. The Company's program may leverage aspects of U.S. National Institute for Standards and Technology standards and other applicable industry frameworks. Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing robust practices, processes, and technologies designed to protect our data digital assets and data.


text: Our cybersecurity program includes: • annual compliance training, which includes modules on information security, and provides quarterly phishing simulation exercises to reinforce awareness and enhance cybersecurity practices; • intrusion detection by monitoring network and system activities to detect unusual or suspicious behavior; • access management and access controls which aim to implement "least privilege" access; • protection of sensitive data through "at rest" and "in transit" encryption; • industry-standard monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • developing plans for recovering from security incidents and maintaining business continuity in the face of cyberattacks; and • a cybersecurity incident response plan that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents.


text: The Company maintains arrangements with third party information infrastructure (IT) vendors—including "cloud computing" vendors. The Company has processes designed to manage cybersecurity risks arising from our use of such vendors, including conducting risk assessments prior to integration into the Company's networks and additional assessments prior to contract renewals or extensions. Cybersecurity measures employed by significant third-party service providers are also further analyzed prior to introduction into our environment. The Company also commissions third-party risk assessments of certain IT vendors to identify and evaluate risks associated with each third party and to minimize potential disruptions and liabilities that may arise from external partnerships. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.


text: The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity at the executive level. The CISO oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with the Chief Information Officer and reports to the Chief Financial Officer and Chief Administrative Officer. The CISO also leads a cross-functional Cybersecurity Incident Response Team ("CSIRT") responsible for responding to and managing cybersecurity incidents. The CSIRT consists of professionals from various departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas. The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO's professional background, the CISO maintains several relevant industry credentials.


text: The Audit Committee of the Company's Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company's enterprise risk assessment and risk management policies and guidelines, including cybersecurity. The Audit Committee receives quarterly cybersecurity updates from the Chief Information Officer and/or the CISO. Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which may report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.


text: Our cybersecurity program is designed and implemented to assess, identify, mitigate and manage risks from cybersecurity threats that may result in adverse effects on the integrity and availability of our production and information systems. Among other items, our cybersecurity program is comprised of policies, standards, plans and frameworks for information security, business resilience, insider threat mitigation, technology asset management, cyber risk management, incident response and procurement. Material risks from cybersecurity threats include, among other things, operational disruption, including failure to meet our service level agreements, loss or destruction of data, hardware or intellectual property, and cyber extortion through ransomware. The management of cybersecurity risks, which involves significant and sustained resource commitments and Management attention, is also integrated into the Company's enterprise risk management program through formal processes that help identify and elevate the most serious risks, including those pertaining to cybersecurity, for management at the enterprise level and oversight at the Board level. For more information on the Company's cybersecurity risks and their possible impact on our business strategy, results of operations, or financial condition see Risk Factors – Cybersecurity and Technology Risk Factors in Part I, Item 1A of this Form 10-K.

companyName: VERISIGN INC/CA

ticker: VRSN


text: Our cybersecurity program leverages the NIST Cybersecurity Framework to help protect the Company's operations, information, production systems and networks from threats through cybersecurity practices, programs and tools that establish defenses in depth. The cybersecurity program includes, among other items, vulnerability and patch management, network and data segmentation, application of zero-trust principles, automated ingestion of multi-source threat intelligence, end point and network detection/response, application security, secure configurations for operating systems and databases, continuous security monitoring and 24/7 security operations. The program has dedicated business resilience, insider threat and governance, risk and compliance (GRC) functions. Incident management is governed by our Incident Response Plan that assigns incident command and control parameters and escalation protocols to management and the Board of Directors. Our cybersecurity program also focuses on risks from the use of third-party services. Our GRC team assesses the cybersecurity practices of current and prospective service providers for compliance with our requirements, and our procurement functions seek terms and conditions, including by example, audit rights and vulnerability or breach disclosure obligations, to enhance our defenses against supply chain risks.


text: Our cybersecurity program incorporates several control and best practice regimes, including for example, the Center for Internet Security (CIS) controls. We conduct regular internal and external assessments, audits, and tabletop exercises to assess security vulnerabilities, control compliance and incident preparedness. These assessments and exercises include, for example, red team exercises simulating external attacks, crisis management exercises, including incident response, and internal audit reviews. Management and the Board's Cybersecurity Committee reviews the results of these exercises, audits and assessments.


text: We also actively engage with third parties, such as key vendors, auditors, consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program. We monitor emerging data protection laws and cybersecurity and privacy regulatory requirements and implement changes to our standards and processes for continued compliance. Our cybersecurity program also includes employee and contractor training, which primarily consists of monthly educational videos, annual trainings and certifications, and phishing exercises.


text: Our cybersecurity strategy and program are led by our Executive Vice President and Chief Security Officer (CSO), who reports to the CEO. Our CSO is Danny McPherson, who has over 25 years of experience in technology and cybersecurity leadership positions and has authored several security-related books and numerous patents, IP standards, and security research publications. He has served in various capacities on various technology working groups and standards setting organizations including the Internet Architecture Board and the Internet Engineering Task Force. Our CSO manages a converged security, engineering and operations organization that helps to ensure that cyber and other security priorities are appropriately integrated throughout the Company. Our Chief Information Security Officer, Chief Information Officer and the head of architecture and engineering report to our CSO. These and other experienced employees lead the teams responsible for implementing various parts of our cybersecurity program.


text: In addition, a management-level Safety and Security Council ("Council") chaired by our CEO and comprised of our CSO and other senior officers, provides cross-functional coordination for the management of the Company's security functions. The Council receives information, typically monthly, on the status of the cybersecurity program, initiatives, incidents, cybersecurity risks, assessments, and threats, among other items. The Chair of the Board's Cybersecurity Committee is the Board's liaison to the Council and attends the regular meetings of the Council.


text: The Cybersecurity Committee assists the Board with its oversight of the Company's cybersecurity risks and our cybersecurity program. The Committee reviews our incident response plan, including escalation protocols, business continuity program plans, program budgets and resources, and our cybersecurity insurance program. The Committee also reviews and discusses the activities of the Council at each of its regularly scheduled meetings. The Committee operates pursuant to a written charter and calendar, each of which are reviewed on an annual basis. The Cybersecurity Committee and the full Board receive quarterly status reports on the cybersecurity program from the CSO, addressing progress and updates on various cybersecurity functions and initiatives including, for example, compliance, assessments, security operations and incident response, business resilience, distributed denial of service attacks, data privacy, technology and asset management, controls, and vulnerability management.


text: Our cybersecurity program is designed and implemented to assess, identify, mitigate and manage risks from cybersecurity threats that may result in adverse effects on the integrity and availability of our production and information systems. Among other items, our cybersecurity program is comprised of policies, standards, plans and frameworks for information security, business resilience, insider threat mitigation, technology asset management, cyber risk management, incident response and procurement. Material risks from cybersecurity threats include, among other things, operational disruption, including failure to meet our service level agreements, loss or destruction of data, hardware or intellectual property, and cyber extortion through ransomware. The management of cybersecurity risks, which involves significant and sustained resource commitments and management attention, is also integrated into the Company's enterprise risk management program through formal processes that help identify and elevate the most serious risks, including those pertaining to cybersecurity, for management at the enterprise level and oversight at the Board level. For more information on the Company's cybersecurity risks and their possible impact on our business strategy, results of operations, or financial condition see "Risk Factors – Cybersecurity and Technology Risk Factors" in Part I, Item 1A of this Form 10-K.


text: Our cybersecurity program leverages the NIST Cybersecurity Framework to help protect the Company's operations, information, production systems and networks from threats through cybersecurity practices, programs and tools that establish defenses in depth. The cybersecurity program includes, among other items, vulnerability and patch management, segmentation, identity and access management, application of zero-trust principles, automated ingestion of multi-source threat intelligence, end point and network detection/response, application security, secure configurations for operating systems and databases, continuous security monitoring and 24/7 security operations. The program has dedicated business resilience, insider threat and governance, risk and compliance ("GRC") functions that report to our Chief Information Security Officer ("CISO"). Incident management is governed by our Incident Response Plan that assigns incident command and control parameters and escalation protocols to management and the Board of Directors. Our cybersecurity program also focuses on risks from the use of third-party services. Our GRC team assesses the cybersecurity practices of current and prospective service providers for compliance with our requirements, and our procurement functions seek terms and conditions, including by example, audit rights and vulnerability or breach disclosure obligations, to enhance our defenses against supply chain risks.


text: Our cybersecurity program incorporates several control and best practice regimes, including for example, the Center for Internet Security ("CIS") controls. We conduct regular internal and external assessments, audits, and tabletop exercises to assess security vulnerabilities, control compliance and incident preparedness. These assessments and exercises include red team exercises simulating external attacks, threat and vulnerability assessments, ransomware, application, and secure image testing, crisis management exercises, including incident response, and internal audit reviews. Management and the Board's Cybersecurity Committee reviews the results of these exercises, audits and assessments. We also actively engage with third parties, such as key vendors, auditors, consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program. We monitor emerging data protection laws and cybersecurity and privacy regulatory requirements and implement changes to our standards and processes for continued compliance. Our cybersecurity program also includes employee and contractor training, which primarily consists of monthly educational videos, annual trainings and certifications, and phishing exercises.


text: Our cybersecurity strategy and program are led by our Executive Vice President of Technology and Chief Security Officer ("CSO"), who reports to the CEO. Our CSO has over 25 years of experience in technology and cybersecurity leadership positions and has authored several security-related books and numerous patents, IP standards, and security research publications. He has served in various capacities on various technology working groups and standards setting organizations including the Internet Architecture Board and the Internet Engineering Task Force. Our CSO manages a converged security, engineering and operations organization that helps to ensure that cyber and other security priorities are appropriately integrated throughout technology and operations, as well as more broadly across the Company. Our CISO, Chief Information Officer ("CIO"), Chief Technology Officer ("CTO") and the head of architecture and engineering report to our CSO. These and other experienced employees lead the teams responsible for implementing various parts of our cybersecurity program.


text: In addition, a management-level Safety and Security Council ("Council") chaired by our CEO and comprised of our CSO, General Counsel, and other senior officers, provides cross-functional coordination for the management of the Company's security functions. The Council receives information, typically monthly, on the status of the cybersecurity program, initiatives, incidents, cybersecurity risks, assessments, and threats, among other items. The Chair of the Board's Cybersecurity Committee is the Board's liaison to the Council and attends the regular meetings of the Council.


text: The Cybersecurity Committee assists the Board with its oversight of the Company's cybersecurity risks and our cybersecurity program. The Committee reviews our incident response plan, including escalation protocols, business continuity program plans, program budgets and resources, and our cybersecurity insurance program. The Committee also reviews and discusses the activities of the Council at each of its regularly scheduled meetings. The Committee operates pursuant to a written charter and calendar, each of which are reviewed on an annual basis. The Cybersecurity Committee and the full Board receive quarterly status reports on the cybersecurity program from the CSO, addressing progress and updates on various cybersecurity functions and initiatives including, for example, compliance, assessments, security operations and incident response, business resilience, DDoS attacks, data privacy, technology and asset management, controls, and vulnerability management.


text: Risk Management and Strategy We have developed and implemented a cybersecurity framework designed to evaluate, identify and manage risks stemming from threats to the security of our information, systems and network using a risk-based approach. The framework is informed, in part, by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not necessarily mean that we meet all technical standards, specifications or requirements outlined in the NIST framework. Additionally, we maintain a Systems and Organization Controls (SOC) 2 Type 2 attestation.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our goal is to maintain an information technology infrastructure that implements physical, administrative, and technical controls. These controls are adjusted based on risk and designed to protect the confidentiality, integrity, and availability of our information systems, including the customer information, personal information and proprietary information stored on our networks.


text: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity. Our information security team assists in taking any remedial action in response to an incident, and external experts may also be engaged as appropriate.


text: Our overarching approach to cybersecurity risk management centers on governance, people, processes, and technology. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. This includes mandatory annual cybersecurity training and monthly phishing simulations. We also perform periodic tabletops or simulation exercises involving technical experts and business and functional leaders.


text: We conduct third party assessments of potential new vendors who process, store or transmit our data, which include a formal security review. This can include the review of documentation related to a vendor's security attestations, such as SOC 2 Type 2 or HITRUST certifications.


text: We leverage third party cybersecurity companies to periodically assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards. These assessments aid in continual improvement and help us identify and address risks from cybersecurity threats.


text: We also consider cybersecurity, along with our other top risks, within our enterprise risk management framework. This framework involves internal reporting at the business and enterprise levels, considering key risk indicators, trends and countermeasures. Our Senior Vice President, Chief Information Security Officer (CISO) serves on the Enterprise Risk Committee that assesses our enterprise-wide risks and oversees risk mitigation activities.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or our results of operations, cash flow or financial condition. However, the scope and impact of any future incident, or the identification of new information related to prior cybersecurity incidents, cannot be predicted. See "Item 1A. Risk Factors" for more information about our cybersecurity-related risks.


text: The Quality and Compliance Committee of our Board of Directors provides board-level oversight of cybersecurity risk. As part of its oversight role, the Quality and Compliance Committee receives reports about our practices, programs, or notable threats or incidents related to cybersecurity throughout the year, including through periodic updates from our CISO and other leaders. The Quality and Compliance Committee provides regular reports to the full Board about these matters and other areas within its responsibility, and the CISO and other leaders provide updates regarding cybersecurity matters to the full Board as appropriate.


text: Our CISO reports to our Chief Information Officer and leads our overall cybersecurity function. Our CISO has over 20 years of experience in various security roles, which include managing information security, development cybersecurity strategy, and implementing cybersecurity programs. Our CISO collaborates with senior leaders and other members of our organization to identify and analyze cybersecurity risks and implement controls as appropriate and feasible to mitigate these risks. The CISO also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including by collaborating with internal and external stakeholders. Our CISO is supported by a management-led Security Council, which consists of our Chief Executive Officer, Chief Financial Officer and other senior leaders throughout our organization, and which reviews and discusses our cybersecurity program as well as emerging cyber risks, threats, and industry trends, among other topics.


text: Risk Management and Strategy We have developed and implemented a cybersecurity framework designed to identify, detect, protect, respond to and recover from risks stemming from threats to the security of our information, systems and network using a governance-led risk-based approach. The framework is informed, in part, by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not necessarily mean that we meet all technical standards, specifications or requirements outlined in the NIST framework. Additionally, we maintain a Systems and Organization Controls (SOC) 2 Type 2 attestation.


text: Our goal is to maintain an information technology infrastructure that implements physical, administrative, and technical controls. These controls are adjusted based on risk and designed to protect the confidentiality, integrity, and availability of our information systems, including the customer information, personal information, and proprietary information stored on our networks.


text: Our overarching approach to cybersecurity risk management centers on governance, people, processes, and technology. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. This includes mandatory annual cybersecurity training and monthly phishing simulations. We also perform periodic internal tabletops or simulation exercises involving technical experts, business and functional leaders, as well as separate exercises with select critical third-party service providers.


text: We conduct third-party assessments of potential new vendors who process, store or transmit our data, which include a formal security review. This can include the review of documentation related to a vendor's security attestations, such as SOC 2 Type 2 or HITRUST certifications.


text: We leverage third-party cybersecurity companies to assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards as well as the HIPAA Security Rule. These assessments aid in continual improvement and help us identify and address risks from cybersecurity threats.


text: Our CISO reports to our Chief Information Officer and leads our overall cybersecurity function. Our CISO has over 20 years of experience in various security roles, which include managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. Our CISO collaborates with senior leaders and other members of our organization to identify and analyze cybersecurity risks and implement controls as appropriate and feasible to mitigate these risks. The CISO also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including by collaborating with internal and external stakeholders. Our CISO is supported by a management-led Security Council, which consists of our Chief Executive Officer, Chief Financial Officer and other senior leaders throughout our organization, and which reviews and discusses our cybersecurity program as well as emerging cyber risks, threats, and industry trends, among other topics.


text: Risk Management and Strategy Like every major financial services institution, Wintrust faces significant and persistent cybersecurity risks. Whether in the form of data theft, ransomware, phishing, denial of service, or third-party vendor incidents, threat actors continue to become more sophisticated and escalate their efforts against financial institutions. At Wintrust, the Board of Directors and executive management are committed to devoting the necessary resources into monitoring, detecting, preventing and mitigating cyber risk. As a regulated financial institution, we are required to comply with various regulations applicable to cybersecurity, as well as guidance issued by our regulators, and our cybersecurity program closely tracks to those requirements. Additionally, Wintrust leverages global cybersecurity standards as general guides, including the National Institute of Standards and Technology Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Cybersecurity oversight begins with the Information Technology & Information Security Committee ("IT/IS Committee") of the Wintrust Board of Directors. The Wintrust Chief Security Officer ("CSO") ") and Deputy Chief Information Security Officer ("Deputy CISO") oversee the cybersecurity program. The CSO has a dual reporting structure, reporting to both the IT/IS Committee and the Vice Chairman/Chief Operating Officer of Wintrust. The CSO and Deputy CISO, each with extensive industry experience, manage a team of skilled professionals with cybersecurity expertise. This team governs our cybersecurity program that follows seven pillars: strategy; prevention, detection, response, measurement, compliance, and training. Our cybersecurity program employs a wide range of technological, administrative, and physical security measures designed to address the confidentiality, integrity, and availability of the information and data of both Wintrust and our customers. We have established policies, processes and procedures to monitor, report and respond to suspected or actual security events. A critical function of the cybersecurity program is the Security Operations Center, which is constantly monitoring Wintrust systems to detect threats. If any credible threats are detected, the Security Operations Center notifies both the CSO and Deputy CISO, and the appropriate response plan is initiated. The CSO will advise executive management and other relevant stakeholders as necessary. We coordinate with our third parties and vendor partners through assessments and due diligence before sharing or allowing the hosting of data. We also work with our outside partners to investigate security events that may have impacted our confidential and other information, and to leverage lessons learned during those investigations. In addition, we contractually require our third-party service providers that possess or process any Wintrust or customer information to adhere to certain security requirements, controls and responsibilities based on the risk profile of the relationship.


text: Wintrust also recognizes that individual employees are frequent targets of threat actors. We regularly engage with employees on the importance of protecting the information and data of Wintrust, our customers and employees through monthly newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in monthly mock phishing campaigns. We also communicate with our customers about their role in enhancing cybersecurity.


text: Governance In addition to our dedicated cybersecurity team, Wintrust's approach to cybersecurity is supported by dedicated risk management and internal audit teams. Our governance program maintains policies and standards, which are validated through risk-based assessments, reviews and testing. The CSO reports at regular intervals to the Wintrust Enterprise Risk Management Committee, the IT/IS Committee, and the Audit Committee of the Wintrust Board of Directors, as well as the full Wintrust Board of Directors, as necessary. The Audit Committee performs an annual review of our cybersecurity program, which includes a discussion of management's actions to identify and detect threats and incident plans in the event of a response or recovery situation. The Audit Committee receives an annual review that includes review of recent enhancements to the cybersecurity program and management's progress on its cybersecurity strategic roadmap. In addition, the full Board of Directors receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and an overview of recent threats and how the Company is managing those threats. For more information on the material risks that cybersecurity threats pose to us, please see our risk factor disclosures under Item 1A of this Annual Report on Form 10-K.


text: Notwithstanding the extensive approach we take to cybersecurity, Wintrust continues to face risks and accompanying threats that could have a material adverse effect on the enterprise. We work to manage these risks and threats on a daily basis. To date, we have not realized any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are reasonably likely to, materially affect us, our business strategy, results of operation or financial condition. We continue to invest in our cybersecurity program, the resiliency of our networks and work to enhance our internal controls.


text: Risk Management and Strategy Like every major financial services institution, Wintrust faces significant and persistent cybersecurity risks. Whether in the form of data theft, ransomware, phishing, denial of service, or third-party vendor incidents, threat actors continue to become more sophisticated and escalate their efforts against financial institutions. At Wintrust, the Board of Directors and executive management are committed to devoting the necessary resources into monitoring, detecting, preventing and mitigating cyber risk. As a regulated financial institution, we are required to comply with various regulations applicable to cybersecurity, as well as guidance issued by our regulators, and our cybersecurity program closely tracks to those requirements. Additionally, Wintrust leverages global cybersecurity standards as general guides, including the National Institute of Standards and Technology Cybersecurity Framework.