text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting and cloud-hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes the administration of a security questionnaire for certain providers, evaluation of certain provider's written security program, and review of security assessments and reports from certain providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factors captioned "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—The security or operation of our platform, networks, computer systems or data, or those of third parties with whom we work, have in the past, and may in the future, be breached or otherwise disrupted, and any such breach or other disruption could have a material adverse effect on our business and reputation" and "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—Interruptions or performance problems associated with our technology and infrastructure, or that of our third party service providers, including AWS and Azure, may adversely affect our business and operating results."

companyName: Veritone, Inc.

ticker: VERI

secItem: Item 1C


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our CIO, who has over 20 years of expertise in overseeing corporate information technology functions, and our CISO, who has 20 years of experience in the cybersecurity industry.


text: Our CIO and CISO are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our CIO and CISO are also responsible for approving cybersecurity budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's Chief Executive Officer, CIO, security management team, and our legal team (including privacy). These stakeholders work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports, summaries or presentations from the CISO concerning the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them.


text: Risk Management, Governance and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: OOMA INC

ticker: OOMA


text: Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation. We have tools and protocols in place designed to prevent, detect and escalate security incidents within the Company.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.


text: We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.


text: The "Risk Factors" section includes further detail about the material cybersecurity risks we face. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.


text: Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.


text: As a company, we devote significant resources to cybersecurity and risk management processes in order to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is led primarily by our Vice President - Cybersecurity & DevOps, who has over 15 years' experience in cybersecurity, information technology, and related compliance and holds a Certified Information Systems Security Professional certification. The information security team works cross-functionally, with significant involvement from other members of senior management and oversight by the Board.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: The information security team is responsible for, among other matters: • designing, implementing and periodically assessing our cybersecurity safeguards and related policies and procedures, including those pertaining to encryption standards, antivirus protection, remote access, multi-factor authentication, data classification, device management, and the use of the internet, social media, email and wireless devices; • monitoring current and emerging cybersecurity threats to which the business may become exposed; and • providing oversight of risks of cybersecurity threats associated with our use of third-party service providers, including reviewing such engagements when proposed in order to identify and assess risks potentially arising therefrom.


text: In addition, the information security team is responsible for obtaining and maintaining Service Organization Control Type 2 ("SOC-2") certification for the Company's product portfolio. The Company has obtained SOC-2 certification for many of its products, which subjects those products to an annual compliance audit conducted by a third party, and we work to include progressively more products within the scope of the audit year over year.


text: We view cybersecurity as a shared responsibility throughout the Company. At a management level, we have performed tabletop exercises incorporating external resources, advisors and relevant members of the Board as needed. The Company requires all employees to participate in an annual cybersecurity training reviewed by the information security function, and management regularly communicates with employees about potential cybersecurity risks and methods for reporting incidents. The Company has adopted and maintains an Incident Response Plan, which provides for various methods of reporting and escalation of incidents, activation of an incident response team consisting of relevant cross-functional leaders (e.g., legal, information security, operations), assessment of the severity of incidents, processes for investigating and remediating incidents and compliance with related legal and regulatory obligations, among other matters. The Incident Response Plan provides for the involvement of the Company's Disclosure Review Committee to assess the materiality of cybersecurity incidents and any disclosure obligations required in respect thereof. Management periodically reviews the Company's cybersecurity risk management strategy and processes - including the Incident Response Plan - to assess their efficacy in light of current and emerging threats.


text: The Company's Board, which is responsible for oversight of risk management related to our business as a whole, has delegated responsibility to the Audit Committee for oversight of the Enterprise Risk Management ("ERM") program and cybersecurity risk, among other matters. Cybersecurity risk is among the risks monitored by the ERM program, which establishes an annual cadence for identifying material risks facing the Company, as well as quarterly reporting to the Audit Committee on the severity of each such risk and mitigation measures being implemented. The Audit Committee also receives an annual update from the information security function on the Company's current cybersecurity risks, recent enhancements to the Company's safeguards and related policies. The Company's Incident Response Plan provides for notification of and consultation with the Audit Committee in the event of a cybersecurity incident exceeding specified levels of severity.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have no t materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to, and breaches of, our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled, "Cyberattacks, security, privacy, or data breaches or other security incidents that affect our networks or systems, or those of our service providers, involving our or our customers' sensitive, personal, classified or confidential information could expose us to liability under various laws and regulations across jurisdictions, decrease trust in us and our products and services, increase the risk of litigation and governmental investigation, and harm to our reputation, business, and financial condition" in Item 1A- Risk Factors - "Information Technology and Data Risks."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: We design and assess our program based on International Organization for Standardization ("ISO") 27001 and Payment Card Industry Data Security Standard ("PCI DSS") standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO and PCI DSS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • internal audits; • bug bounties, phishing and penetration tests; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, as well as dedicated and expert incident commander(s) to steer incident response and resolution; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the section titled "Risk Factors—Risks Related to Data Privacy, Data Protection, Cybersecurity and Technology—The collection, processing, storage, use and disclosure of personal information are governed by a rapidly evolving framework of privacy, data protection, cybersecurity information transfers or other laws or regulations worldwide and may limit the use and adoption of our services and adversely affect our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management receives briefings from our CISO on our cyber risk management program and escalates matters to the Board as needed.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. The CISO, who reports to our Chief Technology Officer, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO is an industry-recognized and credentialed executive with over a decade of leadership in information security, holding multiple professional certifications.


text: Our CISO takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk management and strategy We implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and outfitters.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Our Information Security Department and Security Management functions, led by our Chief Information Officer ("CIO") and supported by our Director of Information Security and Compliance, (collectively, "Security Team"), help identify, assess and manage the Company's cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry's risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, outfitter security awareness training, asset management, managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Security Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, for example: professional service firms including legal counsel, threat intelligence service providers, cybersecurity consultants, 24/7 cybersecurity monitoring software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services and forensic investigators, managed detection and response providers, and external threat hunting partners.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers, and review of System and Organization Controls reports for certain providers. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences", in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and our Director of Information Security and Compliance, who has over 20 years of experience in the information technology industry and is a Certified Information Systems Security Professional (CISSP).


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO, Director of Information Security and Compliance and the CFO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the CIO, the Chief Executive Officer and others. These individuals work with the Company's incident response team, pursuant to a documented incident response policy, to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the Security Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We recognize the importance of cybersecurity risk and the protection of information across our enterprise and have been working towards the integration of our processes for assessing, identifying, and managing risks from cybersecurity threats into our overall risk management system. As further described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information as well as personal information in our computer systems and networks.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: We rely on third parties for a significant portion of our information technology functions and conduct periodic risk assessments with assistance from a third-party consultant. We also rely on third-party hardware, software, network infrastructure, storage systems and vendors to maintain and upgrade our technology systems in order to support our business operations. Computer viruses, hackers, employee misconduct and other external hazards can expose our information systems to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. As previously disclosed, in May 2023, we experienced a network intrusion in which an unauthorized third party accessed and exfiltrated certain information from specific systems. In response to this incident, we secured our digital assets within our computer systems, promptly shut down our financial reporting systems on a temporary basis and commenced an investigation with assistance from an outside cybersecurity firm. In connection with this incident, we have incurred certain incremental one-time costs of $ 0.3 million during the 2023 fiscal year related to consultants, experts and data recovery efforts, and expect to incur additional costs related to cybersecurity protections in the future. Although we have not been the subject of any legal proceedings involving cybersecurity incidents, it is possible that we could be the subject of claims from persons alleging that they suffered damages from such incidents.


text: We have implemented a variety of measures to enhance our cybersecurity protections and minimize the impact of any future attack, including by (i) requiring that all external vendors who need to access any internal/cloud resources utilize secure encrypted tunnels or be physically internal and utilize authorized terminals with provided credentials, (ii) conducting security awareness training for our staff and (iii) requiring longer log retention for all tracking telemetry information. However, cybersecurity threats are constantly evolving, and there can be no guarantee that a future cybersecurity event will not occur. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including through the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as the use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we seek to prioritize the identification and management of cybersecurity risk at several levels in our organization, including through oversight by our Board of Directors and management team. Our Board of Directors oversees risk from cybersecurity threats and our procedures for protecting our cybersecurity infrastructure, and members of management responsible for our cybersecurity risk management program are expected to periodically report to the Board of Directors regarding cybersecurity risk.


text: Our Executive Vice President of Technology has nearly 20 years of experience working in technology and technology infrastructure and has completed college coursework in computer engineering. Together with our Chief Corporate Officer and Chief Development Officer, our Executive Vice President of Technology oversees our cybersecurity risk management processes, including those described in "—Risk Management and Strategy" above. Our cybersecurity risk management program seeks to implement tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, as well as strategies to address threats and incidents.


text: At the employee level, we maintain an information technology team tasked with implementing our privacy and cybersecurity program and who support management in reporting, security and mitigation functions. We also hold employee trainings on privacy and cybersecurity, records and information management, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: Cybersecurity Risk Management and Strategy We recognize the need to continually monitor and assess material risks associated with cybersecurity threats as such term is defined in Item 106(a) of Regulation S-K. Additionally, we maintain a comprehensive risk management framework designed to respond quickly to perceived threats and mitigate the impact of a cybersecurity incident. Some of the cybersecurity risks we face include - but are not limited to - unauthorized access of sensitive information, breach of critical systems resulting in loss of constellation control, and denial of service of critical systems.

companyName: Spire Global, Inc.

ticker: SPIR


text: Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Transformation Officer ("CTO"), our senior management team and our Board of Directors. We retain an ISO 27001:2013 certification related to our information security management system ("ISMS") that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products. Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident. This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response. In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams. These Legal and Compliance professionals then advise on any additional notification or reporting requirements.


text: We regularly assess risks related to regulatory compliance, technical operations, business operations, and product and contract deliverables. Risks are managed, documented, and tracked as part of operating the ISMS and other processes. Risks are internally assessed and categorized based on perceived likelihood and impact to system confidentiality, integrity, and availability as described by the ISO 27005 Information Security Risk Management international standard. We also engage third party penetration testers, assessors, vendors, and auditors to assist with external network vulnerability scanning, penetration testing, internal audits, external audits, threat intelligence, and employee training activities. Additionally, we utilize a variety of self-hosted and SaaS tools to assist with vulnerability identification, mitigation, and remediation.


text: Identified risks and vulnerabilities are ranked and prioritized for mitigation based upon the aforementioned factors. Some risk mitigation and minimization activities include: regular software patches and updates; permitting only required connections to sensitive and critical systems; reactive response to newly identified and discovered exploitable vulnerabilities; implementation of additional auditing and monitoring controls; and cadence-driven system security assessments for critical systems.


text: We assess the cybersecurity posture of third-party service providers, vendors and suppliers at least annually and whenever the vendor implements significant product or operational changes. We maintain consistent communications via email, chat services, ticketing systems, and regular meetings with these partners to promptly address and remediate any perceived vulnerabilities.


text: Additionally, we also provide mandatory training to our employees to help identify, avoid and mitigate cybersecurity threats. These trainings cover a wide range of cybersecurity topics such as insider threats, phishing, spoofing, and the like.


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity threat or incident that materially affected or is reasonably like to materially affect our business or operations, but there can be no guarantee that we will not experience such an incident in the future. We aim to incorporate industry best practices throughout our cybersecurity program and continue to invest in additional controls designed to ensure the resiliency of our networks and prevention of cybersecurity incidents. We describe how cybersecurity threats are likely to materially affect us, including our business strategy, results of operations, and financial condition, in the section titled "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our cybersecurity program is overseen by the Company's CTO in close collaboration with the CEO and our legal and compliance teams. O ur CTO has a technical background and is well informed about cybersecurity risk management best practices, as well as our Company's risk management framework. Our legal and compliance teams supporting the Company's cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.


text: Our CTO regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of all material cybersecurity incidents and the results of any third-party assessments. Additionally, our Board has designated a single Board member, who has experience in assessing and managing cybersecurity risk, to lead the Board-level oversight of cybersecurity risk matters, including staying abreast of cybersecurity best practices and briefing the full Board when significant industry developments occur.


text: Daily risk management and oversight of the Company's cybersecurity posture is the responsibility of the Director of IT and Security, who directly reports to the CTO, and the cybersecurity professionals on his team. All of these team members have extensive experience in networking, cloud and on-premise infrastructure, software development, corporate IT, intelligence, Linux system administration, and data center operations. These individuals are responsible for approving and implementing security operations, security program development, and governance, risk and compliance related to cyber matters.


text: Risk Management and Strategy We are a clinical stage biopharmaceutical company with no commercial operations or revenue streams and our sole business activity has been ongoing research into our drug therapies. We have certain processes for assessing, identifying and managing cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems, which are built into our overall risk management program. Our processes are designed to preserve the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Such processes include physical, procedural and technical safeguards, and response plans on our systems. We engage an external consultant to manage cybersecurity tooling and incident response, as well as general information technology, or IT, systems, which enhance our cybersecurity oversight. We consider the internal risk of oversight programs of the third-party consultant before engaging them in order to help protect us from any related vulnerabilities. As our company grows, we plan to expand our strategy for cybersecurity in alignment with nationally accepted standards.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: Based on an assessment using the previously described cybersecurity risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K.


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. We seek to address cybersecurity risks through a cross-functional approach.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our audit committee, comprised of members with substantial experience in information technology governance and risk management, oversees our cybersecurity strategy. Our board of directors receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our executive officers are responsible for the day-to-day management of the material risks that we face. Our executive officers are led by a third-party consultant, who oversees company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The third-party consultant is advised by their Security Operations Center Manager with a variety of technical certifications, as well as extensive background in IT infrastructure, risk mitigation, and incident response planning.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and we take a holistic approach to the oversight and management of cybersecurity and related risks. This approach is supported by our Board of Directors and management who are actively involved in the oversight of our risk management program.

companyName: Karman Holdings Inc.

ticker: KRMN


text: Like all companies that utilize technology, we face significant cybersecurity threats that include, among other things, attempts to gain unauthorized access to sensitive student and employee information; attempts to compromise the integrity, confidentiality and/or availability of our systems, hardware and networks, and the information on them; insider threats; malware; ransomware; threats to the safety of our directors, officers and employees; and threats to our facilities, infrastructure and service. As cybersecurity threats may arise, the cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of a perceived threat or possible cybersecurity incident, the cybersecurity team is trained to assess, among other factors, student safety impact, data and personal information impact, the possibility of business operations disruption, projected cost, if any, and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.


text: Management of the Company is responsible for overseeing our enterprise risk management. In that regard, management receives periodic updates, as appropriate (and no less frequently than annually), regarding the Company's cybersecurity risk management processes and the risk trends related to cybersecurity. Our Board of Directors, in coordination with the Audit Committee, shall review and discuss with management the Company's risks related to information security, including cybersecurity.


text: While we have experienced minor cybersecurity threats in the past, such as spear phishing or smishing (SMS phishing), to date no such threats have materially affected the Company or our financial position, results of operations and/or cash flows.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information contained therein.


text: We maintain cybersecurity insurance coverage in amounts that we believe are adequate to address any incidents such as data destruction, extortion, theft, hacking, denial of service attacks and other such incidents.


text: See "Risk Factors— Technology failures or cybersecurity breaches or other unauthorized access to or use of our information technology systems or sensitive or proprietary information could have a material adverse effect on the Company's business and operations."


text: Risk Management and Strategy We periodically assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity processes, and practices as part of our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our senior management, in consultation with our third-party information technology, or IT, vendor assesses risks based on probability and potential impact to our business and information systems and processes. Any identified risks that are considered high are monitored and tracked as part of our overall risk management program overseen by our board of directors.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: We collaborate with our third-party IT vendor to assess the effectiveness of our cybersecurity prevention and response systems and processes and have not had a need to utilize cybersecurity assessors, consultants or other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks or to support any necessary mitigation plans.


text: Neither cybersecurity incidents nor cybersecurity threats have materially affected our company, including our business strategy, results of operations, or financial condition. We are not aware of any cybersecurity threats that are reasonably likely to materially affect our company. Refer to the risk factor captioned "Our business and operations may be adversely affected by information technology ("IT") system failures or cybersecurity or data breaches" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company. Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies and measures in collaboration with our IT vendor that are designed to address cybersecurity threats and incidents. Our IT vendor with oversight from our Chief Executive Officer, Mr. Lee, is currently responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our IT vendor has over 25 years of experience in information security and possesses the requisite expertise and experience expected of such an individual given our company's risk profile.


text: Mr. Lee provides periodic updates on any cybersecurity incidents and threats to our Board of Directors and to the Audit Committee of our board of directors as such incidents may arise.


text: We have established policies and procedures for assessing, identifying and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We leverage well-known and established third parties as industry partners to support our key business processes and utilize the services of reputable external advisory firms for running important functions such as cybersecurity assessments and technical security management activities, including network security management. Our Chief Financial Officer and Chief Operating Officer are jointly responsible for managing cybersecurity risks and implementing the required policies across the Company. Our Chief Executive Officer is responsible for making strategic decisions and approving external communication releases related to cybersecurity risks or incidents. Our Chief Executive Officer and Chief Financial Officer work closely with our third-party IT manager to stay informed about and monitor the prevention, detection, mitigation and remediation of any potentially significant cybersecurity incidents, including making determinations on the materiality of a cybersecurity incident.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees our risk management program, which focuses on the most significant risks we face. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity. Our Chief Financial Officer or Chief Operating Officer reports on our enterprise risk profile on an annual basis or more frequently as needed. Our Audit Committee also engages with external counsel on legal matters related to cybersecurity incident management and reporting.


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our operations or financial standing. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Risk Management and Strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the International Organization for Standardization's ("ISO") international standard for Information Security ("ISO 27001") and the National Institute of Standards and Technology's Cybersecurity Framework 2.0 ("NCSF") and we evaluate and evolve our security measures as appropriate. As of December 31, 2024, we have not completed all of the requirements to be ISO 27001 or NCSF certified. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO's international standard for Supply Chain Security Management ("ISO 28001"), the NCSF, and the Customs-Trade Partnership Against Terrorism), and evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk Factors" in this Annual Report for additional information about risks related to cybersecurity.


text: Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management. The Board also receives annual reports on information security matters from members of our security team.


text: Our security efforts are managed by a team of IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.


text: We have designated a Network and Security Engineer, who reports to the Director of IT & Security, to assess and manage our material cybersecurity risks and threats. In this role, the Network and Security Engineer installs and manages our corporate firewalls, Enterprise Infrastructure engineering, and network analysis, but also supports our incident response and vulnerability management efforts. With over 10 years of experience in cybersecurity, the Engineer ensures our controls remain effective and that any emerging threats are promptly addressed.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal health information (including clinical trial data) ("Information Systems and Data").

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Our information technology function, which is led by Samir Gharib, our President, Chief Financial Officer, and Chief Compliance Officer, helps identify, assess and manage the Company's cybersecurity threats and risks. Our information technology function works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, employing both automated and manual tools and controls; conducting threat and vulnerability assessments; utilizing third-party services to monitor our information technology infrastructure; and performing internal audits.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, incident detection and response policies, network security controls for certain systems (including as applicable data segregation, data encryption, access controls, physical security, and systems threat monitoring), disaster recovery and business continuity plans, vendor risk management program, and dedicated cybersecurity staff and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, Mr. Gharib and the audit committee of the board of directors evaluate material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and supply chain providers. We have a vendor management program to manage cybersecurity risks associated with our use of service providers. The program includes, as applicable, risk assessment for certain vendors, security questionnaires, review of certain vendors' security programs and security assessments, and imposition of cybersecurity-related contractual obligations for some vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the sections titled "Risk Factors— If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" and "Risk Factors— We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations, and rules; contractual obligations; industry standards; and policies. Our (including the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions (which could include civil or criminal penalties); private litigation (including class-action claims) and mass arbitration demands; disruptions to our business operations; adverse publicity; and other adverse consequences that could negatively affect our operating results and business."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Mr. Gharib, who oversees enterprise risk management and information security for the Company.


text: Mr. Gharib is responsible for hiring information security personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Mr. Gharib is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Mr. Gharib and the Chief Executive Officer. Mr. Gharib works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from Mr. Gharib concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We continue to invest substantially in cybersecurity risk management, which is a core part of our overall enterprise risk management program. Our security program is based on ISO 27001, NIST 800-53, and GDPR frameworks to support our global business. We utilize various tools and processes to identify, monitor, evaluate, and address cybersecurity threats and incidents, including those involving third-party vendors and service providers. Our process includes identifying the source of a threat or incident, implementing countermeasures and mitigation strategies, and informing management and our board of directors about significant threats and changes in the cybersecurity landscape. We remain committed to investing in risk management tools and processes as cybersecurity threats evolve. Despite our efforts, we cannot guarantee that we can prevent, mitigate, or remediate risks in our own or third-party cybersecurity infrastructure.

companyName: AstroNova, Inc.

ticker: ALOT


text: Our Information Technology team which reports to senior management, is responsible for maintaining our cybersecurity risk management program. They collaborate with third-party security specialists as they believe necessary to conduct thorough risk assessments and system improvements. Together with our third-party security service providers, the Information Technology team oversees cybersecurity incidents, prevention, detection, mitigation, and resolution. We regularly train our employees on cybersecurity awareness and confidential information protection and continuously review and update our policies to adapt to the evolving threat landscape and legal developments.


text: Cybersecurity threats have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the dynamic nature of these risks and remain vigilant in our efforts to mitigate potential impacts. Refer to "Item 1A. - Risk Factors" in this Annual Report on Form 10-K, including, "We could experience a significant disruption in or security breach of our information technology system which could harm our business and adversely affect our results of operations," for additional discussion on our cybersecurity related risks.


text: Cybersecurity Governance Our management, including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer ("CTO"), and Information Technology team, is responsible for identifying and assessing cybersecurity risks, establishing monitoring processes and implementing mitigation and remediation measures. In fiscal 2025, we hired a full-time Director of Information Technology, who is a Certified Information Security Professional. Our cybersecurity programs are managed under the direction of our CTO and the Director of Information Technology, with support from internal and external third-party resources.


text: Our IT Steering Committee, which consists of our CEO. CFO, and other senior leadership employees, is responsible for coordinating our day-to-day management of cybersecurity risk. Each quarter, the IT Steering Committee receives reports from the CTO and Director of Information Technology on our cybersecurity program performance and emerging threats and incidents. The IT Steering Committee makes recommendations intended to ensure that hawse have adequate resources to address information technology risks.


text: Our board of directors has ultimate oversight responsibility for our overall enterprise risk management and, with input from our senior management, oversees our cybersecurity risk management. As part of its enterprise risk management efforts, our board of directors regularly receives reports from management on our cybersecurity programs with regard to any risks that may arise from specific cybersecurity threats and incidents. The board of directors oversees management's programs, policies and processes in place that identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which we are exposed.


text: Cybersecurity Risk Management and Strategy In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents. While we cannot completely protect against the possibility of a cybersecurity incident occurring, we take measures designed to mitigate risks from cybersecurity threats, including those implemented by our third-party managed services provider.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: As part of our cybersecurity procedures, we leverage a number of security controls, including network and device monitoring and system backup procedures. We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."


text: Cybersecurity Governance Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of our risk management controls, including controls in connection with risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors (the "Audit Committee") is primarily responsible for overseeing our compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of our information system and cybersecurity controls.


text: On a quarterly basis, the Audit Committee discusses with senior management, our processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of our cybersecurity processes. The Audit Committee also receives updates on, and monitors, our prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and processes and controls supporting requirements with the General Data Protection Regulation (GDPR). The NIST CSF offers a thorough set of guidelines and best practices to help establish a strong cybersecurity posture. Utilizing NIST CSF enables us to systemically identify, assess, and manage cybersecurity risks most relevant and impactful to our business operations. It is important to note that using the NIST CSF as a guide does not imply our cybersecurity program meets any specific technical standards or requirements.

companyName: Banzai International, Inc.

ticker: BNZI


text: We have an annual assessment performed by a third-party specialist of the cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a Risk Mitigation Plan to mitigate such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: We maintain policies over areas such as information security, incident management, business continuity, IT change and configuration management, acceptable use and access on/offboarding to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in our IT environment.


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to, configuration management, vulnerability scans, network protection and monitoring, remote monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes vendor due diligence prior to onboarding, a review of System and Organization Control (SOC) reports on an annual basis, regular review of vendor contracts, and compliance with service level agreements (SLAs).


text: In evaluating the risks identified as a result of the annual cybersecurity assessment process, our cybersecurity partners assist the Company to assess the likelihood, severity, and impact of relevant risks, including the impact on employees, stakeholders, and vendors. These risks are prioritized and monitored by the cybersecurity partners and management of the Company.


text: Our cybersecurity program includes an incident response plan that includes all relevant and critical members of management and third-party service providers alike. The team is responsible for assessing and managing cybersecurity incident response processes, response times, and communication plans in the event corrective actions and mitigation procedures are required to isolate and eradicate an incident.


text: Our management team, in conjunction with the Chief Technology Officer and cybersecurity service providers are responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. Management relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged in strategic cyber risk management, advisory and decision making.


text: Our Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber threats and vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practical through changes or updates to our internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as the cybersecurity risk assessment process and developed an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.


text: Risk Management and Strategy Our company is guided by a comprehensive cybersecurity framework to assess, identify, and manage material risks from cybersecurity threats. This framework is integrated into our overall quality and risk management system and is designed to protect our systems, data, and operations from cybersecurity threats. The framework includes policies to protect confidential information, guide periodic risk assessments, oversee and identify risks from cybersecurity threats associated with our use of third-party services providers, including through the use of a third-party risk management policy that accounts for such risks, and an incident response plan designed to detect, respond to, and recover from cyber incidents. Under this framework we may engage consultants and other third parties to assist in conducting cybersecurity risk assessments, implementing mitigation strategies, and testing the effectiveness of our cybersecurity controls.

companyName: VACCINEX, INC.

ticker: VCNX


text: There can be no guarantee that our policies and procedures will ultimately prove to be effective in every instance, especially considering evolving risk. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that these risks have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure related to cybersecurity risks, and our executive officers are responsible for the day-to-day assessment and management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Audit Committee.


text: Our Chief Operating Officer and Systems Administrator are primarily responsible for assessing and managing the cybersecurity risks we face under our policies and procedures, including those described in "Risk Management and Strategy" above. Our Chief Operating Officer is primarily responsible for reporting any material cybersecurity related incidents to our Audit Committee.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels, and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Nuburu, Inc.

ticker: BURU


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations, and cash flows, under the heading "Cyber-attacks and other disruptions, security breaches, and incidents could have an adverse effect on our business, harm our reputation, and expose us to liability" included as part of our Item 1A. "Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company outsources around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures, and cybersecurity risks. Periodically each year, the Audit Committee receives an overview from our Chief Executive Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The Company maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. We are subject to federal and state laws and regulations governing privacy, security, and breaches of patient information and the conduct of certain electronic health care transactions, including, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other health information privacy and security requirements. We rely on information technology networks and systems to process and store electronic information. We collect and store sensitive data, including PHI on our information technology networks. As we collect and manage large quantities of data, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our partners regard as significant. Increased global cybersecurity vulnerabilities, threats, computer viruses, ransomware and phishing attacks, and more sophisticated and targeted cyber-related attacks, as well as cybersecurity failures resulting from human error and technological errors, pose a risk to the security of the Company's systems and networks and the confidentiality, availability, and integrity of data on these products, systems, and networks. We have implemented security measures designed to prevent disruptions and shutdowns of our information technology networks due to attacks by hackers or breaches due to malfeasance by contractors, employees and others who have access to our networks and systems.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We expect to continue to invest in long-term solutions to protect against cybersecurity risks and threats. Except as otherwise provided herein, this Item 1C reflects the Company's cybersecurity policies and procedures as of December 31, 2024.


text: In 2024, we did not identify any cybersecurity threats that would have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report.


text: Risk Management and Strategy The Company employs an IT Security Team that is responsible for assessing and managing cybersecurity risks.


text: The Company has a designated IT Security Team to maintain its cybersecurity program and oversee third-party service providers that provide cybersecurity protection. The IT Security Team is tasked with the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and reports to our DevOPS/Security Manager. The team is comprised of personnel with a broad range of experience across the business and information technology industries, including our DevOPS/Security Manager, and employees in senior legal and administrative roles. The IT Security Team relies on the advice of the Manager DevOPS/Security related to the security of our data and any mitigation steps necessary.


text: Our DevOPS/Security Manager leads our cybersecurity program and is tasked with supporting our security functions of identifying, preventing, detecting, responding to, and recovering from cybersecurity threats and incidents. The DevOPS/Security Manager has 28 years of experience in IT networking, administration, and security related roles, including nine years at the Company. Prior to joining the Company, our DevOPS/Security Manager served for 15 years in a senior leadership role in the IT department of a large, publicly traded Fortune 500 company. The DevOPS/Security Manager reports directly to the Company's Chief Technology Officer, and provides quarterly updates to the Cybersecurity Subcommittee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The identification of cybersecurity risks is a continuous and evolving assessment. As a data company, we are subject to cybersecurity risks. We have identified certain cybersecurity risks specific to our business, which are identified above in Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: The Company utilizes a hybrid platform consisting of a local and cloud environment. Our local environment connects to the cloud environment via an encrypted virtual private network ("VPN") connection. Our Site-to-Site connection consists of a firewall in our local environment which responds to a connection from a firewall in our cloud. Our networks have segregated subnets, and only allow designated staff access to our cloud environment, which is only accessible from one of our local office segments. All firewalls are configured with intrusion detection systems and intrusion prevention systems, strict firewall rules, denial of service, spoof protection, advanced threat protection, and zero-day protection. Our firewalls are configured to receive definition updates as they are released, and firmware updates are automatically installed when available. We secure our local network by not utilizing any wireless access points connected to any of our networks or firewalls, enabling port security on switches, following a principle of least privilege policy, and implementing Security Information & Event Management ("SIEM") to capture all network traffic & security events from both networking equipment, endpoints, and servers. We enforce a strict password policy with multi-factor authentication.


text: All computers and servers utilized by the Company are protected by endpoint protection, which provides real-time protection of local and network files, internet activity, and utilizes ransomware protection, application protection, malicious behavior protection, anti-malware scan interface protection, file integrity monitoring, and data loss prevention. Our endpoint protection software updates immediately upon definition releases. This endpoint has live protection and performs a deep system scan daily. Our endpoint protection products are managed by our IT Security Team via a dashboard that provides our team with immediate alerts, device isolation, and investigation features, and also contracted the use of a Managed Detection and Response ("MDR") service. The MDR service monitors our protected endpoints, servers, and network equipment at all times. This service also investigates, eliminates, and mitigates any critical alerts, while notifying our IT Security Team issues identified. All endpoints and servers are updated with security patches and application updates to our systems from a Patch Management system.


text: Our IT Security Team reviews security logs daily, and performs quarterly audits of device access, building access, outages, application access, and IT & Development tickets. We employ data loss prevention policies to enforce HIPAA rules and also use stringent encryption controls. In addition, a Vulnerability Scanning system performs vulnerability detection on a quarterly basis. An independent third-party company conducts annual penetration and vulnerability detection as well.


text: Our offices are physically secured with key card access controls for parking and floor access. In addition, security guards monitor building reception areas and parking garages, and receptionists are located in our lobbies to greet visitors. The Company engages assessors, consultants, auditors, or other third parties in connection with its cybersecurity processes.


text: The Company engages third party vendors in connection with our cybersecurity processes, including penetration and vulnerability scanning, auditing of our information security management program (ISMP); and a provider of products and services to secure users, networks, and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. In addition, the Company engaged national accounting and advisory services firms to audit the operating effectiveness of our security program, which incorporates cybersecurity in our processes. On an annual basis, the Company conducts a SOC 2 Type II audit and a HITRUST assessment.


text: SOC 2 Type II audits assess risks from interactions with the Company's systems, particularly information about system controls that the Company has designed, implemented, and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the SOC 2 trust services criteria.


text: A HITRUST assessment address the need for a continuously relevant cybersecurity assessment that incorporates best practices and leverages the latest threat intelligence to maintain applicability with information security risks and emerging cyber threats, such as ransomware and phishing. HITRUST assessments also provide a level of assurance that delivers full transparency, accuracy, consistency, and integrity.


text: In 2023, the Company engaged a HITRUST Authorized External Assessor and AICPA member firm `, which completed independent assessments of MSP Recovery's system. These independent assessments verified that we met the healthcare industry's highest standards in protecting healthcare information and mitigating this risk, including compliance with the HIPAA Security Rule. On October 13, 2023, HITRUST certified that the platforms, facilities, and supporting infrastructure of our organization meet the HITRUST CSF v11 Implemented, 1-year (i1) certification criteria. For our cloud computing services, we currently use Amazon Web Services ("AWS") which is also HITRUST certified. On June 14, 2024, an Independent Service Auditor provided MSP Recovery a report opining that our data recovery system's commitments and system requirements meet or exceed the stringent SOC 2 Type II applicable trust services criteria.


text: The Company has processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: The Company maintains specific policies and practices governing our third-party security risks, including our third-party assessment ("TPA") process. Under our TPA process, we gather information from certain third parties who contract with the Company and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, utilize encrypted secure file transfer protocols to exchange data. We require counterparties to enter into Business Associate Agreements and Non-Disclosure Agreements that, among other things, require them to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.


text: The Board has established a Cybersecurity Subcommittee of the Audit Committee responsible for the oversight of risks from cybersecurity threats.


text: On February 7, 2024, the Board established the Cybersecurity Subcommittee of the Audit Committee (the "Cybersecurity Subcommittee") to assist the Board in fulfilling its oversight responsibilities with respect to assessing and mitigating the Company's cybersecurity risks. The Company's management, under the guidance of the IT Security Team, is responsible for the preparation, presentation, and self-assessment of the Company's cybersecurity policies and practices. The Cybersecurity Subcommittee shall be comprised of at least one independent director, and is tasked with reviewing and providing high level guidance on cybersecurity-related issues of importance to the Company.


text: The IT Security Team reports to the Cybersecurity Subcommittee on a quarterly basis to inform the committee about and monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents, and is tasked with notifying the Cybersecurity Subcommittee of a cybersecurity incident upon discovery. The Cybersecurity Subcommittee held three meetings during the year ended December 31, 2024.


text: Risk Management and Strategy The Company recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, and violation of data privacy laws.

companyName: MOVADO GROUP INC

ticker: MOV


text: Identifying and assessing cybersecurity risk is integrated into the Company's overall risk management processes. Cybersecurity risks are identified and addressed through internal information technology security, governance, risk and compliance reviews, as well as periodic third-party assessments. To defend, detect and respond to cybersecurity incidents, the Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and disaster recovery plans. The Company also performs penetration testing to test security controls and monitors emerging laws and regulations related to data protection and information security. In addition, the Company performs third-party risk management (including gathering information via questionnaires and/or service organization controls (SOC) reports) to identify and mitigate risks from third parties such as vendors, suppliers and major customers that process the Company's employee, business or customer data.


text: The Company's cybersecurity incident response and breach management processes are intended to detect and analyze security incidents; to contain, eradicate and recover from such incidents; and to conduct a post-incident analysis to determine whether any changes to processes or security measures are merited. Such incident responses are overseen by a Breach Response Team consisting of leaders from the Company's Information Technology, Legal, Finance, Risk Management and Human Resources departments, with the assistance of external technical, legal and law enforcement support, as and when appropriate. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business and privacy impact, as well as the potential need for timely public disclosure.


text: From time to time the Breach Response Team conducts tabletop exercises to simulate responses to cybersecurity incidents, including the analysis of risks and the development of detection, mitigation and remediation strategies. The Breach Response Team also uses these exercises as an opportunity to discuss other topics related to cybersecurity, including notable developments in this area.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents or incurred any material expenses related to cybersecurity incidents. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company depends on its information systems to run its business and any significant breach of or disruption to those systems could materially disrupt the Company's business" and "If the Company were to experience a significant privacy breach, it could be subject to costly government enforcement actions and private litigation and suffer significant negative publicity which could materially and adversely affect the Company's results of operations," which are incorporated by reference into this Item 1C.


text: The Audit Committee of the Board of Directors has assumed responsibility for the oversight of management's strategies and processes for addressing risks from cybersecurity threats. The Audit Committee or the full Board receives quarterly updates regarding cybersecurity and data privacy matters from senior management, including leaders from the Information Technology and Legal teams. This generally includes briefings regarding existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), a cybersecurity maturity scorecard, status of key information security initiatives, and significant developments in data privacy regulations.


text: The Company's cybersecurity risk management and strategy processes are overseen by leaders from the Information Technology team (specifically, the Company's chief technology officer, its chief information officer, and its senior manager for cybersecurity) who collectively have over 75 years of prior work experience in various information technology roles, including security, auditing, compliance, systems and programming, and whose credentials have included Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Security Professional certifications. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of the Company's incident response plan. Potentially significant cybersecurity incidents are reported to the Breach Response Team. If the Breach Response Team deems the incident material, it will promptly notify the Audit Committee or the full Board of Directors. The Audit Committee or Board receives updates regarding other incidents during management's regular quarterly cybersecurity updates. In addition, the Company's Internal Audit function, whose leader possesses a Certified Information System Auditor (CISA) certification, reviews certain cybersecurity controls in connection with its information technology audit procedures.


text: Our processes for assessing, identifying and managing material risks from cybersecurity threats are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which governs our cybersecurity oversight and management structure as well as our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: Board of Directors Oversight The Risk Committee of our board of directors is responsible for the oversight of our Cyber Risk Program. The Chief Legal Officer provides quarterly updates to the Risk committee regarding the status, findings and developments within the Cyber Risk Program. In addition, the Risk Committee receives updates and presentations from the Senior Vice President, Information Security and Compliance (SVP) at each Risk Committee meeting that cover, among other things, our cyber incidents and responses, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs. The Risk Committee then reports to the full board of directors at each regular meeting of the board of directors. Additionally, at least one member of our board of directors possesses cybersecurity risk oversight experience, which contributes to the board's ability to understand and evaluate cybersecurity-related matters.