text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President and Chief Risk Officer, Chief Operations Officer, Chief Financial Officer, Mortgage Systems Administrator and Enterprise Risk Manager. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Audit Committee and minutes of the committee's meetings are subsequently reported by the Audit Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Enterprise Risk Manager make monthly/quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.


text: Risk Management Personnel The IT Manager has the primary responsibility for managing the Program to identify, assess, manage and control cybersecurity risk. The IT Manager reports directly to our Chief Operations Officer. Our IT Manager has approximately 20 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR

secItem: Item 1C


text: Monitoring Cybersecurity Incidents The IT Manager is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to our executive management team, the Audit Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.


text: Reporting to Board of Directors The Audit Committee receives reports from the Chief Operations Officer, IT Manager or Enterprise Risk Manager and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.


text: Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platform, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations the risks associated with cyber security also increase.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: LSB utilizes an enterprise-wide risk management process to identify, assess and manage risks faced by our organization. The Company's Enterprise Risk Management Committee ("ERM Committee"), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber and technology risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting tools. Our team uses widely adopted methods and models to identify, prioritize and manage cyber and technology risks and develop related information security controls and safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other cyber exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical controls and address a wide range of current cyber threats. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.


text: Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management's cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber risk. This ERM Committee is composed of the Company's Executive Vice Presidents and each of the Company's Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology ("IT") leads the information security program, manages cyber governance and incident management. The Vice President of IT and the Director of Infrastructure and Security have over forty-five years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reports to the Board of Directors on critical cyber risk and security topics presented to the Committee by management.


text: Incident Management We have implemented security procedures and measures in order to protect our information from being vulnerable to theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board of Directors. Although we make efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A. Risk Factors—General Risk Factors."


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for assessing, identifying, and managing material risks from cybersecurity threats. This process is supported by both management and our Board of Directors.

companyName: Zevia PBC

ticker: ZVIA


text: To prevent, detect, mitigate, and remediate information security threats, including a cybersecurity incident and/or threat, we maintain a cyber risk management process managed by our Senior Vice President, Operations ("SVP, Operations") who reports to our CEO. The SVP, Operations works with the Vice President, Deputy General Counsel ("Legal") on cybersecurity strategy, policy, training, standards, architecture, and processes. We have invested, and expect to continue to invest, in resources for the protection and safeguarding of our information technology systems, including, but not limited to, networks, applications, and outsourced technology services in connection with the operation of our business. These resources are designed to detect and respond to cyber incidents that may result in unauthorized access to, ransomware, damages, or destruction of, our information and systems.


text: Risk Management and Strategy Cybersecurity risk is a direct responsibility of management and the Company's information technology ("IT") team. Working cross-functionally with Legal, our SVP, Operations oversees the IT team that regularly monitors and assesses cybersecurity risks, implements measures designed to mitigate such risks and their associated effects on the Company and personal data collected, stored, and processed in our systems, and manages our information security training and cybersecurity awareness program. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: Our approach to cybersecurity risk management includes the following: • Multi-Layered Defense and Monitoring – We work to protect our computing environments from cybersecurity threats through multi-layered defenses and monitoring efforts to identify cybersecurity threats, and to help prevent future attacks. We utilize data analytics systems to detect anomalies and identify cyber threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use our internal audit partner to conduct additional reviews and assessments. • Insider Threats – We maintain organizational controls such as limited access, and access removal for terminated employees, designed to minimize insider threats, and address potential risks from within our Company. Our measures and controls are informed by industry practices, and designed to be consistent with applicable law, including privacy and other considerations. • Third Party Risk Assessments – We conduct privacy and information security risk assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access are required to participate annually in training, including phishing simulations and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – Our standard terms and conditions contain contractual provisions requiring that our third-party suppliers disclose to us the technical and organizational measures they maintain, the standards and certifications by which they are evaluated for information and cyber security, and their cybersecurity insurance protection level. We seek to mitigate risk by evaluating the foregoing against any potential cyber-related risks depending on the nature of the services being provided.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Nominating and Enterprise Risk Management ("NERM") Committee of the Board of Directors specifically assists the Board in its oversight of risks related to cybersecurity. In accordance with its charter, the NERM Committee receives regular reports at each of its quarterly meetings from management, including the SVP, Operations. Such reporting includes updates on the Company's cybersecurity program, information security matters, the evolving cybersecurity threat environment, applicable privacy law compliance, and the Company's mitigation plans and evolving mitigation strategy. The Chair of the NERM Committee regularly reports to the Board of Directors on cybersecurity risks and other related matters. In addition, both the NERM Committee and the Audit Committee, in a joint meeting, receive an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Management reports to the NERM Committee and/or the Board of Directors in between meetings as appropriate regarding any significant cyber events.


text: To date we have not identified any cybersecurity threat or incident that has materially affected the Company or our financial position, results of operations and/or cash flows, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. We continue to invest in the cybersecurity and resiliency of our networks and enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors" included in this Annual Report.


text: Cybersecurity Risk Management and Strategy We recognize the need to continually monitor and assess material risks associated with cybersecurity threats as such term is defined in Item 106(a) of Regulation S-K. Additionally, we maintain a comprehensive risk management framework designed to respond quickly to perceived threats and mitigate the impact of a cybersecurity incident. Some of the cybersecurity risks we face include - but are not limited to - unauthorized access of sensitive information, breach of critical systems resulting in loss of constellation control, and denial of service of critical systems.

companyName: Spire Global, Inc.

ticker: SPIR


text: Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Technology Officer ("CTO"), our senior management team and our Board of Directors. We retain an ISO 27001:2013 certification related to our information security management system ("ISMS") that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products. Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident. This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response. In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams. These Legal and Compliance professionals then advise on any additional notification or reporting requirements.


text: We regularly assess risks related to regulatory compliance, technical operations, business operations, and product and contract deliverables. Risks are managed, documented, and tracked as part of operating the ISMS and other processes. Risks are internally assessed and categorized based on perceived likelihood and impact to system confidentiality, integrity, and availability as described by the ISO 27005 Information Security Risk Management international standard. We also engage third party penetration testers, assessors, vendors, and auditors to assist with external network vulnerability scanning, penetration testing, internal audits, external audits, threat intelligence, and employee training activities. Additionally, we utilize a variety of self-hosted and SaaS tools to assist with vulnerability identification, mitigation, and remediation.


text: Identified risks and vulnerabilities are ranked and prioritized for mitigation based upon the aforementioned factors. Some risk mitigation and minimization activities include: regular software patches and updates; permitting only required connections to sensitive and critical systems; reactive response to newly identified and discovered exploitable vulnerabilities; implementation of additional auditing and monitoring controls; and cadence-driven system security assessments for critical systems.


text: We assess the cybersecurity posture of third-party service providers, vendors and suppliers at least annually and whenever the vendor implements significant product or operational changes. We maintain consistent communications via email, chat services, ticketing systems, and regular meetings with these partners to promptly address and remediate any perceived vulnerabilities.


text: Additionally, we also provide mandatory training to our employees to help identify, avoid and mitigate cybersecurity threats. These trainings cover a wide range of cybersecurity topics such as insider threats, phishing, spoofing, and the like.


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity threat or incident that materially affected or is reasonably like to materially affect our business or operations, but there can be no guarantee that we will not experience such an incident in the future. We aim to incorporate industry best practices throughout our cybersecurity program and continue to invest in additional controls designed to ensure the resiliency of our networks and prevention of cybersecurity incidents. We describe how cybersecurity threats are likely to materially affect us, including our business strategy, results of operations, and financial condition, in the section titled "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our cybersecurity program is overseen by the Company's CTO in close collaboration with the CEO/Chairman of the Board of Directors and our legal and compliance teams. Both our CEO and our CTO have technical backgrounds and are well informed about cybersecurity risk management best practices, as well as our Company's risk management framework. Our legal and compliance teams supporting the Company's cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.


text: Our CTO regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of all material cybersecurity incidents and the results of any third-party assessments. Additionally, our Board has designated a single Board member, who has experience in assessing and managing cybersecurity risk, to lead the Board-level oversight of cybersecurity risk matters, including staying abreast of cybersecurity best practices and briefing the full Board when significant industry developments occur.


text: Daily risk management and oversight of the Company's cybersecurity posture is the responsibility of the Director of IT and Security, who directly reports to the CTO, and the cybersecurity professionals on his team. All of these team members have extensive experience in networking, cloud and on-premise infrastructure, software development, corporate IT, intelligence, Linux system administration, and data center operations. These individuals are responsible for approving and implementing security operations, security program development, and governance, risk and compliance related to cyber matters.


text: Cyber Risk Management and Strategy We have processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties, including a contracted information technology consultant who is dedicated to our organization, to enhance our cybersecurity oversight.

companyName: PepGen Inc.

ticker: PEPG


text: In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also require annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors-Risks Related to Employee Matters, Managing Growth and Other Operational Matters -Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, or trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results."


text: Governance Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management and our contracted information technology consultant regarding cybersecurity matters. We have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Senior Vice President, or SVP, of Chemistry and Manufacturing, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the SVP of Chemistry and Manufacturing as well as to other executive management on cyber matters, as appropriate.


text: At UCT, cybersecurity risk management forms a critical component of UCT's overall enterprise risk management program. Led by our Chief Information Security Officer ("CISO"), and under the oversight of our Board of Directors, we have implemented processes to assess, identify, manage and report cybersecurity risks, which, together with our broader business continuity plans, aim to not only address immediate response to cybersecurity incidents but also ensure swift restoration of critical systems and the maintenance of core business functions in the face of digital threats. Our senior management and information technology ("IT") security teams devote considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our CISO, reporting directly to our Chief Information Officer ("CIO"), is responsible for designing, developing and implementing our overall information security program that sets forth a governance structure and processes to ensure regular risks assessments and timely reports regarding cybersecurity risks. We actively scan across our information infrastructure for security vulnerabilities inherent in our business as we rely extensively on information and technology systems for managing transactions, tracking financial performance, and storing sensitive data. We also continuously monitor and assess risks associated with the interconnected nature of many of our information and technology systems, such as ERP platforms, supply chain management systems, and electronic payment gateways. In the normal course of our monitoring process, upon identifying certain vulnerabilities within our business and information systems during a recent security assessment, our information security team, in close collaboration with a third-party expert, promptly began to remediate these vulnerabilities to prevent any potential compromise of our systems or data.


text: Using threat models and intelligence, we regularly assess a range of cyber threats, including hacking attempts, malware attacks, phishing schemes, infrastructure intrusions, and insider threats. In conjunction with our ongoing threat and vulnerability assessments, we evaluate the various ways, and the extent to which, cyberattacks may materially impact our business, including financial loss, regulatory penalties, reputation damage, and litigation risks. In this rapidly evolving cybersecurity environment, we recognize staying informed about emerging cybersecurity threats and industry best practices is an indispensable part of assessing and identifying cybersecurity risks, particularly within the manufacturing sector. Our involvement includes active participation in industry associations, sharing threat intelligence, and collaborating with regulatory bodies and law enforcement. This collaboration strengthens our defenses against potential threats to our financial and information systems.


text: As part of our ongoing commitment to maintain a robust cybersecurity program to protect all stakeholders, including our customers, investors, employees, and vendors, we have allocated significant resources to improve our IT security. We have deployed various protocols as part of a larger preventive framework against cyber threats, including advanced security technologies and services, firewalls outfitted with cutting-edge capabilities, layers of encryption protocols, Identity and Access Management ("IAM") controls, and muti-factor authentication. Our employees are required to complete cybersecurity best practice training on a regular basis (no less than once a year), the results of which are collected and reported to the senior management for further evaluation. We regularly engage third-party experts to assess the effectiveness of our security protocols and infrastructure, to detect potential threats and assist with remediation efforts, and to generally monitor and adapt our cybersecurity protocols to constantly evolving cybersecurity threats. In addition, we have deployed a Third-Party Risk Management ("TPRM") tool that sends questionnaires to our vendors designed to assess their cybersecurity vulnerabilities. These and other cybersecurity risk management protocols at UCT are being governed by our comprehensive cybersecurity policies, plans and incident response playbooks, to manage both our preventive efforts against cyber threats and quick and effective response protocols in the event of cybersecurity breaches. In the event of an incident, we are prepared to follow the steps outlined in these playbooks, from initial detection to mitigation, as well as notification to all appropriate functions, including the senior management and the Board.


text: Our Board of Directors has the overall oversight responsibility for our risk management, and delegates the cybersecurity and other risks relating to our information controls and security to our Audit Committee. Both the Audit Committee and the full Board regularly receive updates from our management on cybersecurity matters and our ongoing risk management efforts, and actively participate in ongoing discussions. In addition, the Board and the Compensation Committee review and approve the key performance indicators applicable to all management personnel responsible for effectively managing cybersecurity risk management programs at UCT, and engage in regular review of the Company's performance against those indicators.


text: We continue to face cybersecurity risks related to our business. While these risks have yet to materially affect us, we cannot guarantee that our ongoing and increasingly robust approach towards cybersecurity will be able to prevent cybersecurity incidents that could have a material adverse effect on us. For additional information about cybersecurity risks we face, see the risk factor item "Our business may be adversely affected by IT disruptions, including by impairing our ability to effectively deliver our products or services, which could cause us to lose customers" in Item 1A-Risk Factors.


text: Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or patients, and violation of data privacy or security laws. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our Board of Directors. Our cybersecurity policies and practices are aligned with relevant industry standards and are designed to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. This includes processes for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, implementing cybersecurity countermeasures and mitigation strategies, and informing and updating management and, as needed, the Audit Committee and our Board of Directors of cybersecurity incidents that may pose a significant risk for the business. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls, and data protection. We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including cybersecurity consultants, to evaluate and support our risk management systems. We also rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, as well as a description of an event that occurred in March 2023, see “Risk Factors—Risks Related to Our Business—Security breaches, loss of data, and other disruptions could compromise sensitive business or patient information, cause a loss of confidential patient data, employee data, personal information, or prevent access to critical information, and expose us to liability, litigation, and federal and state governmental inquiries and damage our reputation and brand.”


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the Audit Committee. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Digital & Technology Officer (CDTO).


text: Our CDTO is a member of our executive management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. Our CDTO has over twenty years of extensive experience in information technology and security, and works in coordination with other members of the management team, including, among others, the Chief Financial Officer, the Chief Compliance Officer and the Chief Legal Officer and their designees. We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: Our CDTO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CDTO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: The Company recognizes the importance of maintaining our technology and data systems. Our cybersecurity policies, standards, processes, and practices are integrated across our operational departments.


text: Cybersecurity Risk Management and Strategy As one of the elements of our overall risk management program, we focus on the following key areas: • Technical Safeguards: We deploy technical safeguards, including by not limited to firewalls, anti-malware functionality and access controls. • Outside Consultants: We utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, response, and documentation procedures.


text: We have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Board of Directors Oversight Our Board is aware of the critical nature of managing risks associated with cybersecurity threats. Management works with our Board to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board has delegated to our Audit Committee the primary responsibility for oversight of cybersecurity risks.


text: Management's Role Managing Risk Our Co-CEOs, CFO, and IT Manager play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has 7 years of experience with the Company, which includes managing cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.


text: Cybersecurity Risk Management and Strategy While we are in the process of fully implementing a comprehensive cybersecurity risk management program, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AIRGAIN INC

ticker: AIRG


text: Our cybersecurity risk management program not only fortifies our current defense but also serve as the building blocks for adopting an internationally recognized IT standards framework, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) or the International Organization for Standardization (ISO) 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.] Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments of our risk capacity, conducting pressure and gap analyses, and formalizing our risk tolerance; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a third-party risk management process for service providers, suppliers, and vendors, in which we assess their processes, controls, and monitor cybersecurity enhancements to safeguard our interests and mitigate potential risks.


text: We are building on our current program towards a more comprehensive cybersecurity risk management program. Our roadmap for the future is centered on the maturation of our cybersecurity risk management program to align to international IT frameworks, such as NIST and ISO 27001 that will strengthen our defenses, enhance our threat detection capabilities, and ensure the confidentiality, integrity, and availability of our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of our board of directors (Audit Committee) oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including CTO and IT Manager, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has several years of experience and have been trained for various roles in information technology and cybersecurity at numerous technology companies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of our Manager, a subsidiary of ACRES Capital Corp. ("ACRES"). As such, our Manager participates in ACRES' processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: ACRES upholds a robust cybersecurity initiative, encompassing policies and protocols aimed at safeguarding its systems, operations, and entrusted data, including ours, from potential threats or risks. ACRES employs a range of protective measures within its cybersecurity framework including physical and digital access controls, identity verification, mobile device management software, employee training programs emphasizing cybersecurity awareness and best practices, tools for identifying abnormal activities, and vigilant monitoring of data usage, hardware, and software.


text: At least annually, ACRES' third-party cybersecurity compliance consultant conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents. We also periodically perform simulations and tabletop exercises. All employees are required to complete training that includes various topics on cybersecurity risk management best practices. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Operations—Our business is highly dependent on communications and information systems, and systems failures or cybersecurity incidents could significantly disrupt our business, which may, in turn, negatively affect the market price of our common stock and our ability to operate our business" in this report.


text: Cybersecurity Governance As described above, ACRES has engaged a third-party IT firm and cybersecurity compliance consultant to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. ACRES management team oversees the work of the third-party IT and cybersecurity compliance consultant and regularly communicates with members of the team. Through the policies and controls described above, including an incident response policy, representatives of the third-party IT firm as well as members of ACRES management team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents.


text: The representatives of our third-party IT firm and cybersecurity compliance consultant who lead our cybersecurity risk management and risk assessment process have experience in managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans.


text: Our Company's Board and the audit committee are jointly responsible for overseeing our overall risk assessment and risk management program as well as our Manager's policies and practices related to our information technology systems, information security and cybersecurity risks. The Company's Board and the audit committee reviews at least annually our enterprise risks and related risk management program. In addition, the Company's Board receives periodic reports from our cybersecurity compliance firm on the primary cybersecurity risks that we and our Manager face and the measures we are taking to mitigate such risks. The chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the Company's Board would also be expected to review the Manager's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS) and other applicable industry standards and are integrated into our overall risk management system and processes. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Intrusions into our computer systems could result in compromise of confidential information."

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Our board of directors oversees our risk management program, including the management of cybersecurity threats as part of its general oversight function. Our Audit Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program and receives reports from management concerning our cybersecurity risk management program.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, finance, legal, human resources, among others. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our IT department have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware, software and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Our information security function, led by our Director of Information Technology, helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. Our Director of Information Technology helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, monitoring provided by a third-party security operations center, deploying manual and third-party service provider automated tools in certain environments, subscribing to reports and services that identify cybersecurity threats (and analyzing such reports), conducting scans of certain environments, evaluating our industry's risk profile and threats reported to us, conducting internal audits and threat assessments for certain threats, conducting vulnerability assessments using third-party tools to identify vulnerabilities, engaging third parties to conduct threat assessments, using external intelligence feeds and monitoring the dark web.


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data including, for example: incident response plans and policies; vulnerability management policy; disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls and data segregation for certain systems; access controls; physical security controls; asset management, tracking, and disposal; systems monitoring for certain systems; employee training; penetration testing of certain environments and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our Director of Information Technology works with management to help mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, forensic investigators and endpoint detection and response vendors.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may utilize various vendor management processes that may include reviews of security assessments or certifications and contractual measures.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties we rely on, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: We also have a Corporate Information Security Steering Committee ("CISSC"), which includes several members of senior management, including the Chief Financial Officer ("CFO") and General Counsel. The CISSC oversees corporate information security initiatives and the Company's responses to cybersecurity incidents, and reports to the board of directors on certain of the Company's corporate security programs and investments.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, Gio Hernandez, who has over 15 years of experience in information security. Mr. Hernandez reports to our CFO, Rodney Young, who has approximately 20 years of experience supervising the information technology function.


text: Mr. Hernandez is responsible for hiring appropriate personnel, helping to develop the Company's cybersecurity risk management strategy and communicating key priorities to relevant personnel. Mr. Hernandez is also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Mr. Young is responsible for approving cybersecurity-related budgets.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our CFO and Chief Executive Officer. Senior management through the CISSC works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal and financial data regarding our crew members and farmers, which we collectively refer to as "Information Systems and Data."

companyName: Vital Farms, Inc.

ticker: VITL


text: Our Information Technology department, under the leadership of our Vice President of Information Technology ("VP of IT") and with cross-functional internal and third-party support, helps identify, assess and manage the Company's cybersecurity threats and risks. The Information Technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the risk profile of the Company and its industry using various methods, including regular threat assessments (including through interaction with law enforcement), internal and external audits, threat environment scans and third-party threat assessments, vulnerability assessments, external intelligence feeds and third-party-conducted tabletop training exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a written incident response plan and incident response policy, business continuity plans, data encryption for certain data, implementation of certain security standards, network security and access controls, data segregation, asset tracking/disposal systems, penetration testing and required crew member training programs.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Information Technology department and third-party providers work with our senior leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior leadership team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our Board of Directors ("Audit Committee"), which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, penetration testing providers, dark web monitoring services, cybersecurity consultants, forensic investigators, training platforms and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, supply chain resources (including warehousing and cold storage) and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes, for example, completion of a cybersecurity questionnaire, internal reviews of vendor security programs and assessments, security assessment calls with vendor personnel and imposition of information security obligations in our vendor contracts. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the section titled "Risks Related to Information Technology and Intellectual Property."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible under its committee charter for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, with the oversight of our Chief Financial Officer. Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Our VP of IT, in consultation with our Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our VP of IT has nearly 25 years of relevant experience, including leadership roles in the information technology departments of public and private companies. Prior to joining the Company, he served as VP of IT for another public company in the consumer packaged goods industry.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our internal disclosure committee and our senior leadership team. Senior leadership team members work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan provides for reporting of certain cybersecurity incidents to the Audit Committee.


text: The Audit Committee receives regular reports from our Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, requires certain covered entities to report a covered incident to the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency ("CISA") within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: The SEC adopted a new rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies in 2023, which applies to all public companies subject to the reporting requirements of the Securities Exchange Act of 1934 and requires disclosure of material cybersecurity incidents in Current Reports on Form 8-K and periodic disclosure of cybersecurity risk management, strategy, and governance in annual reports in Annual Reports on Form 10-K.


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations and many states have recently implemented or modified their data breach notification and data privacy requirements. The Company expects this trend of state-level cybersecurity regulatory activity to continue, and continues to monitor these developments.


text: In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank's systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors." See also the Company's disclosures regarding risk management, strategy, governance and incident disclosure under Item 1C.


text: Cybersecurity Risk Strategy and Management Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology ("NIST") cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business impact, threat context and vulnerability severity.


text: Business email compromise ("BEC") continues to be a top threat for cybersecurity risk leading to potential financial loss, data breach or further information systems compromise. Variants and combinations of BEC, including phishing, spear phishing, "adversary in the middle" attacks (i.e., attacks that allow interception of network communications) and, in particular, "zero-day" attacks (i.e., attacks that exploit a previously unknown vulnerability), present a financial, data loss and business continuity risk. The risk of these attacks exists within the Company, within our customer partners and within our vendor partners in the supply chain. BEC prevention is a top focus in our risk-based cyber-resiliency strategy. In addition to BEC, potential vulnerabilities could exist in business systems and associated infrastructure and are mitigated via protocol for managing update "patches"; this protocol is sometimes limited based on the era of legacy systems.


text: Superior engages cybersecurity partners and consultants to help strengthen its cyber-resiliency program. These engagements include but are not limited to incident response ("IR") planning and IR retainers, penetration testing, vulnerability assessments, IR plan testing, and advisement and awareness of latest threat vectors.


text: All of the Company's global suppliers must comply with its Supplier Code of Conduct ("SCOC"). The SCOC contains certain data security and notification requirements, and the Company explicitly maintains the right to monitor and audit compliance with the SCOC.


text: Cybersecurity Governance The Board of Directors maintains overall oversight of cybersecurity risk, and the Audit Committee provides direct oversight of the Company's activities to prevent, detect and respond to cybersecurity threats. The Chief Information Officer ("CIO") and a designated system security engineer are the primary responsible management parties to monitor, assess, and manage cybersecurity risk. Our CIO has led global IT organizations for over ten years with direct oversight responsibility for cybersecurity, the global IT landscape and its data integrity. Our security engineer is solely focused on monitoring, assessing, and managing Superior's cybersecurity breach prevention, detection and management, including the ongoing cybersecurity risk education of our employee base. Our security engineer's experience includes the design and implementation of IT security systems, tools, and processes, comprehensive security assessments, and the implementation of remediating action plans for detected weaknesses.


text: Risk is monitored and managed through a combination of vulnerability assessments, continuous monitoring, endpoint protection, incident response planning, security awareness training, regulatory compliance monitoring, and threat intelligence.


text: Utilizing the NIST cybersecurity framework, the CIO provides quarterly updates to the Audit Committee on cybersecurity risk management, including the Company's latest risk assessment, action plan status and metrics. The Audit Committee regularly briefs the full Board on these matters. In addition, the CIO provides an annual report to the Board on the Company's cybersecurity plan and key activities.


text: Management roles and responsibilities of Superior's cybersecurity incident management are defined within the Company's IR plan. The plan includes the formation of the Security Incident Response Team responsible for leading incident response. In the event of specific cybersecurity incidents, defined sub-teams are engaged, as necessary, to monitor the mitigation and remediation of cybersecurity incidents. These sub-teams are comprised of cross-functional experts including, but not limited to, legal, accounting, operational and IT leadership and relevant external counsel.


text: All incidents are prioritized and assessed for materiality. Cybersecurity incidents are reported to relevant stakeholders in accordance with the incident response plan. All notable cybersecurity incidents as well as the number of cybersecurity incidents are reported quarterly to the Board of Directors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is part of our overall enterprise risk management program and shares similar governance processes and reporting channels that apply across the enterprise risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management evaluation process for service providers, suppliers, and vendors with access to our information systems or data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management is required to update the Committee, as necessary, regarding any material cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Financial and Business Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel who in turn manage our retained external cybersecurity consultants. Our management team's experience includes significant responsibility for developing and maintaining cybersecurity risk management programs and for managing cybersecurity risks prior to joining us.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal IT environment.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy and Disaster Recovery Plan (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy sets forth the role of the Information Security Committee in preparing, implementing, and maintaining incident response procedures in consultation with senior management of the Adviser and Administrator.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: Our Information Security Committee is responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. The Information Security Committee includes our Chief Financial Officer and Chief Compliance Officer. At times we may also engage assessors, consultants, or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of RGC who provide services to us pursuant to the Advisory Agreement and Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Committee as needed, but no less frequently than annually. On at least a quarterly basis, management and the Information Security Committee report to our Board of Directors on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks that are material to us.


text: Cyber Risk Management and Strategy As part of our enterprise risk management program, we have implemented and maintain policies and processes to identify and mitigate risks posed by cybersecurity threats. Our policies and processes are based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and we utilize technologies to help identify and manage potential cyber threats. We have also secured cyber-specific insurance coverage as part of our overall insurance portfolio.

companyName: Savara Inc

ticker: SVRA


text: We have engaged an independent, third-party services provider to assist in monitoring our information technology systems, as well as identifying, assessing, and mitigating the associated cyber risk. With that provider, we conduct periodic assessments of our information security program to evaluate the effectiveness of applicable security controls, which include penetration testing, vulnerability scanning, and red teaming. Our Chief Financial and Administrative Officer ("CF&AO") reviews the results of those assessments with our third-party provider to reasonably address any identified potential gaps. We also utilize a range of tools and services to help ensure material threats are prevented or the risks of such threats are mitigated, which include, network and endpoint monitoring, system patching, user and server backups, annual awareness training, and periodic vulnerability evaluation. Management reviews monthly monitoring reports and meets with our third-party provider on a regular basis to review activities and debrief on any key IT-related issues.


text: We have an employee education program that includes annual training designed to raise awareness of cybersecurity threats, and we require employees to review and acknowledge our IT Security Policy on an annual basis. Additionally, we have adopted an IT Incident Response Plan that outlines the procedures to be followed in response to a data breach, whether internal or through a third-party, that are designed to help contain, assess, and respond to the incident and mitigate potential harm.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse, or theft of information and other data, confidential information, or intellectual property. However, to date, these incidents have not had a material impact on our operations. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Risk Factors – Risks Related to Information Technology and Data Privacy.


text: Governance Related to Cybersecurity Risks The Audit Committee of our Board of Directors is responsible for the general oversight of risks related to data privacy and cybersecurity. The Audit Committee periodically reviews the Company's cybersecurity program with management, including (i) the adequacy of controls and security for the Company's information technology systems and (ii) the Company's response plan in the event of a security breach impacting those systems. Our CF&AO has primary responsibility for overseeing the day-to-day management of cybersecurity risks and has served in that role for three years. Our CF&AO oversees the policies and processes described above and provides the periodic management briefings to the Audit Committee, including any cybersecurity incidents and related responses. Further, at least annually, the Board of Directors receives updates of potential cybersecurity incidents, as well as the data privacy and compliance programs, and its members actively participate in discussions with management regarding cybersecurity risks.


text: Risks Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IGM Biosciences, Inc.


text: We conduct annual risk assessments and perform as needed updates to our risk register to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Information Technology (IT), who is also our Senior Vice President (SVP) of Group Operations and reports to our Chief Financial Officer (CFO), to manage the risk assessment and mitigation process.


text: Index to Financial Statements As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Legal, Human Resources and IT. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and company-wide communications.


text: We engage an experienced cybersecurity consultant as our Interim Information Security Advisor who coordinates our risk assessment processes with our Cybersecurity Steering Committee. We engage an experienced service provider as our 24x7 network and security operations center, to assist us to design and implement our cybersecurity policies and procedures, and to monitor and test our safeguards.


text: We assess the ability of our key third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of the Audit Committee of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Audit Committee is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.


text: Our SVP of Group Operations and our Cybersecurity Steering Committee, which includes our Chief Medical Officer, SVP-Corporate Controller, Executive Vice President of Process Development and Manufacturing, SVP of Preclinical Sciences, and our SVP of Legal Affairs, are primarily responsible for assessing and managing our material risks from cybersecurity threats. As part of our risk identification, assessment, and mitigation activities, we leverage the experience of our external cybersecurity advisor/consultant (CISSP, CISA, CISM, CRISC, QSA) who has extensive cybersecurity expertise across various industries. Our SVP of Group Operations, who manages our cybersecurity program, has over 25 years of experience in the Life-Sciences IT space, with over 8 years in IT security and cybersecurity functions.


text: Our SVP of Group Operations, in collaboration with our Cybersecurity Steering Committee, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our SVP of Group Operations is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through oversight of the external consultant and the IT department, which includes oversight of a combination of automated technologies and manual responses to detect, respond and recover from any cybersecurity incident, as well as oversight of the 24x7 network and security operations center. Our SVP of Group Operations is responsible for informing our executive leadership and our Audit Committee about confirmed cybersecurity incidents, and for providing regular updates to senior executive management, including our CFO, concerning our IT and cybersecurity posture.


text: Our SVP of Group Operations provides quarterly briefings to the audit committee and our executive management regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Management of Cybersecurity Risks and Cybersecurity Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity program shares common methodologies, reporting channels and governance processes as the risk management programs of other departments within our company, including the legal, compliance, strategic, operational, and financial departments.


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • ad hoc internal review of the cybersecurity practices of service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third party research institution collaborators, CROs, CDMOs, or other contractors or consultants, may fail or suffer cyberattacks or security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity program.


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Director of Infrastructure and Cybersecurity, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Director of Infrastructure and Cybersecurity, Senior Vice President of Business Technology, and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes demonstrated expertise in cybersecurity, life sciences, and security industry certifications such as CISM and CISSP.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make proactive and strategic investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are imbedded into our overall risk management governance and are reviewed at least annually by the Audit Committee of our Board of Directors.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Risk Management and Strategy We've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have engaged consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our information security policy is based on recognized industry standards and cover areas such as risk management, data backup, and data recovery. We engage consultants and IT managed service providers (IT MSP), to help us design and implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities and responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee. We conduct cybersecurity penetration testing as warranted to identify and remediate cybersecurity gaps.