text: We, Kronos and CompX continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee ("CIDAC") which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.

companyName: VALHI INC /DE/

ticker: VHI

secItem: Item 1C


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer and CIO, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We, Kronos and CompX face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- "Risk Factors."


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats We rely on the cybersecurity strategy and policies implemented by Ares, the parent company of our Advisor. Ares' cybersecurity strategy prioritizes the detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Ares' enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Ares' cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Ares has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: Ares' cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Ares prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor or Ares. Ares' cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity threats, including those which may impact us, our Advisor or Ares, is integrated into Ares' Enterprise Risk Management program, which is overseen by the Ares Enterprise Risk Committee (the "Ares ERC"), as discussed below. In addition, Ares periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Ares cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training, including for all of the employees of Ares. Ares' cybersecurity training programs also include annual certification requirements for employees of Ares with respect to certain policies supporting the cybersecurity program including the Information Security and Electronic Communications policy, Data Protection policy and Privacy Policy. Ares undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Ares' and our critical third-party service providers and other partners. Ares also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, our Advisor or Ares, Ares has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Ares, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Ares' Chief Information Security Officer ("CISO"), and, as appropriate, escalation to the full Ares ERC and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Ares, as well as to the audit committee of our board of directors and to our full board of directors, if appropriate.


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Our General Business Operations and Our Corporate Structure—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by Ares' dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Ares' CISO, who has a Master's degree in Cybersecurity from Brown University and over 25 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Ares CISO reports cybersecurity updates to the Ares ERC. The Ares ERC is a committee that governs and oversees the Ares Enterprise Risk Program, including cybersecurity. The Ares ERC includes members of Ares' senior executive management, including its CEO, Co-Presidents, CFO, General Counsel, Global Chief Compliance Officer and Head of Enterprise Risk, who acts as chairperson of the Ares ERC. The Ares ERC, through regular consultation with the Ares internal cybersecurity team and representatives from our Advisor, assesses, discusses, and prioritizes Ares' approach to high-level risks, mitigating controls, and ongoing cybersecurity efforts.


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares' Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We operate through our subsidiaries and affiliate and receive services through our intercorporate services agreement (ISA) with Contran (see Note 16 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: NL INDUSTRIES INC

ticker: NL


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ( CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating business segments. Both our CIO and the director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership, and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: Risk management and strategy The Company has incorporated evaluation of cybersecurity threats into its overall risk management strategy. As such, Willdan has established a cybersecurity program designed to address applicable legal requirements. Through its internally dedicated cybersecurity team, combined with cybersecurity-specific technologies and external cybersecurity service professionals, the Company assesses, identifies, and manages material risks from cybersecurity threats to its critical computer networks, hardware and software, and data.

companyName: Willdan Group, Inc.

ticker: WLDN


text: The Company's cybersecurity team helps identify and assess risks from cybersecurity threats by monitoring and evaluating the Company's threat environment using various methods. Through the use of internal and external risk assessment audits of certain environments aimed at identifying potential areas of cybersecurity risk, external and internal monitoring alerts, and other external and internal tools (such as next generation endpoint security (EDR/XDR), SASE framework, next-gen firewalls, and external-party monitoring of endpoint and cloud security environments), the Company performs ongoing assessments of its cybersecurity risks that are designed to take into account the rapidly evolving cybersecurity threat landscape. Further, in conjunction with its ISO 27001 and SOC2 certifications, the Company undergoes annual external audits that include reviews of its cybersecurity risk assessment processes and policies.


text: In an attempt to manage and mitigate material risks from cybersecurity threats, the Company's cybersecurity risk management process includes certain preventive measures, detective controls, and incident response procedures, depending on the environment and systems. This includes implementing security controls in certain environments and systems, ongoing monitoring of certain environments and systems, adopting response protocols for security incidents, and maintaining cybersecurity insurance. The Company's cybersecurity risk management approach is periodically reviewed by management and certain external service professionals to assess whether any changes are needed to reflect changing threats.


text: In addition, assessment and management of material risks from cybersecurity threats are integrated into the Company's risk management strategy. For example, our cybersecurity team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation, impact our ability to operate, and other material adverse consequences.


text: The Company engages third-party cybersecurity consultants and auditors who help the cybersecurity team in identifying, assessing, and managing material risks from cybersecurity threats, including by evaluating and enhancing the Company's cybersecurity posture. The Company also engages third-party service providers to perform a variety of functions throughout its business. The Company performs due diligence before engaging with certain third-party service providers designed to evaluate the service providers' cybersecurity practices, including their security policies, incident response capabilities, and data protection measures; including specific cybersecurity requirements in contracts with certain third-party service providers, such as regarding security standards, data protection, and incident reporting as applicable; and monitoring and auditing certain third-party service providers' cybersecurity practices and compliance with contractual obligations. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, the Company's vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the certain members of Company management, including those who are part of the Company's cybersecurity team. The Company's cybersecurity team is comprised of individuals with expertise in cybersecurity, information technology, risk management, and Company operations. Our cybersecurity team has decades-long experience in cybersecurity and holds industry-standard certifications including Certified Information Systems Security Professional ("CISSP"), and Certified Cloud Security Professional ("CCSP"), among others.


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Company's cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel (collectively, "Executive Management"). Executive Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board for certain cybersecurity incidents.


text: The Company's Board provides oversight of cybersecurity risk and regularly receives updates from the Company's cybersecurity team. These updates cover topics that include cybersecurity team member updates, cybersecurity infrastructure updates, improvement in cyber-security tools and technologies, cybersecurity framework compliance, cyber-risk hardware/software enhancement updates, cybersecurity threats and mitigation measures, and more. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We recognize the importance of maintaining the trust and confidence of our investors, patients, business partners, and employees. Our board of directors are actively involved in the oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the international organization for standardization. In general, we seek to address cybersecurity risks through a comprehensive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Collaborative Approach We have implemented a comprehensive cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning We have established and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers, and other external users of our systems, as well as the systems of third-parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness We provide regular mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools and education to address cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices.


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third-parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.


text: On an annual basis, the board of directors discuss our approach to cybersecurity risk management with management which includes our Chief Information Officer ("CIO"). Our CIO has overall operational responsibility for our cybersecurity risk management. To facilitate the success of our cybersecurity risk management program, we have an Infrastructure, Operations & Security Team ("IOS Team") that is tasked with the responsibility to design, implement, and manage systems, processes, and policies to defend against cybersecurity threats and to respond to cybersecurity incidents. Working collaboratively across our Company, the IOS Team implements and maintains a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") maintains structured processes to proactively assess, identify, manage, and mitigate material risks from cybersecurity threats. The Company's business remains dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations and is subject to periodic updates, reviews, and independent assessments.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The program is aligned with the NIST CSF 2.0 framework, providing a structured approach to identify, protect against, detect, respond to, and recover from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. In addition, the Investment Adviser actively monitors the current threat landscape to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company, in coordination with the Investment Adviser's risk management, legal, information technology, and compliance teams, conducts ongoing due diligence on third-party service providers (including contractual provisions and regular compliance attestations) to ensure they meet requisite cybersecurity standards. For critical vendors, the Company requires SOC 2 Type II reports or similar independent cybersecurity assessments. In lieu of these reports, vendors may provide compensating materials demonstrating the structure and management of their cybersecurity programs.


text: Board Oversight of Cybersecurity Risks The board of directors of the Company (the " Board ") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Information Security Officer ("CISO") of the Investment Adviser and Chief Compliance Officer ("CCO") of the Company regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.


text: The full Board is collectively responsible for oversight of cybersecurity matters and is updated at every Board meeting. In these updates, the Company's management and the Investment Adviser's CISO provide reports on key metrics such as vulnerability scan results, third-party risk assessments, and incident response readiness. The Board also ensures its members receive periodic training or engage external advisors with cybersecurity expertise to strengthen oversight capabilities.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the CISO of the Investment Adviser, manages the Company's cybersecurity program, under the supervision of the Company's Chief Executive Officer. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Investment Adviser's CISO has 23 years of experience actively managing cybersecurity and information security programs for financial services companies with complex and evolving information systems. The Company's CCO has been responsible for this oversight function as CCO of the Company for 10 years and has worked in the financial services industry for over 20 years, during which time the CCO of the Company has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company, in coordination with the Investment Adviser, actively monitors cybersecurity incident prevention, detection, mitigation, and remediation efforts. The CCO of the Company and the CISO of the Investment Adviser jointly lead the incident response process and escalate incidents to the Board in accordance with established escalation protocols, typically within 48 hours after determining that a cybersecurity incident reaches materiality thresholds requiring Board notification.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, including how such risks may materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. Management of the Company uses both internal and external inputs—such as threat intelligence feeds, penetration test reports, and third-party cybersecurity assessments—to update these risk evaluations. During the reporting period, the Company had not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Although there have been no identified material incidents to date, Management of the Company periodically reviews even non-material incidents and near misses to evaluate risk trends and improve response processes. In the event a cybersecurity incident is deemed potentially material, the Company's incident response plan requires immediate notification to the CCO of the Company, CISO of the Investment Adviser, and the Board, followed by regular status updates until resolution.


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence tools.


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology, employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act, the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool. Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.


text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the ERM and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's Risk Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The Risk Committee is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's Information Technology ("IT") Steering Committee in conjunction with the Bank's Project Management Office oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.


text: The Risk Committee provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the Risk Committee at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Risk Committee. Cybersecurity metrics are reported to both management level committees and the ERM Committee and Risk Committee on a quarterly basis.


text: The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: We continually monitor and evaluate the evolving cybersecurity landscape and the potential impact of cybersecurity incidents on our business. We may incur additional costs to enhance our cybersecurity processes and controls, to comply with new or changing laws, regulations, or contractual obligations, or to respond to or recover from cybersecurity incidents. We may also experience reputational harm or loss of customer confidence or trust as a result of cybersecurity incidents. Any of these factors could have a material adverse effect on our business, financial condition, results of operations, and reputation.


text: Despite our efforts to enhance our cybersecurity posture, we cannot guarantee that our processes and controls will be sufficient to prevent or mitigate all cybersecurity risks and threats that we face. We may experience cybersecurity incidents that result in unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; disruption or degradation of our operations; loss of customers or business opportunities; regulatory investigations or enforcement actions; litigation or liability; reputational damage; or increased costs.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with Enterprise Risk Management, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT Steering Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches; Ensuring that changes to security configurations are documented, approved, and tested; Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks;


text: Conducting subsequent penetration testing and vulnerability assessments, as warranted; and Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis, which may identify additional risks or require additional costs to remediate.


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information.


text: In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO reports to the Board of Directors, directly or through the ERM Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO is responsible for implementing and maintaining the IRP, which includes:


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents; Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents;


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures; Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP;


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures and Report up to the Executive Incident Response Committee, as needed.


text: Governance Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Director of Information Technology on the status of our cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: 908 Devices Inc.

ticker: MASS


text: Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 20 years of information technology experience and 11 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process, supported by security testing, that is designed to address the treatment of identified security risks based on severity.


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.


text: We have implemented a process to periodically conduct security awareness training for employees and simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.


text: Our Director of Information Technology and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use various internal and external processes and technologies, including third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We have adopted an incident response plan to guide us in responding to cybersecurity incidents and maintain processes to inform and update executive management and the audit committee about security incidents that may pose a significant risk for our business, as applicable.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature, including information regarding our product architecture, software, algorithms, and applications ("Information Systems and Data").

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Our information security function is supported by members of our legal team and a third party service provider, which helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting vulnerability assessments to identify vulnerabilities; and analyzing external threat intelligence feeds.


text: Depending on the environment, product, or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: performing risk analyses, establishing an incident response policy, having vulnerability management processes, and implementing certain security certificates for certain functions of our business; encrypting certain data, using network security controls; segregating data; maintaining access and physical security controls; managing, tracking, and disposing of assets; and monitoring our systems. In addition, we may refer to and perform assessments against the Center for Internet Security's Critical Security Controls to help inform our cybersecurity program, as well as perform assessments such as penetration tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) our information security function works with management, including our Chief Technology Officer ("CTO"), to prioritize our risk management processes and mitigate cybersecurity threats that could more likely lead to a material impact to our business; (3) our senior management/committee evaluates material risks from cybersecurity threats against our overall business objectives and on a quarterly basis reports to the cybersecurity subcommittee of the audit committee of the board of directors, with the cybersecurity subcommittee reporting to the audit committee of the board of directors, which oversees our cybersecurity risk as part of our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; and cybersecurity software and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers and public cloud providers, as well as various third-party suppliers that support our manufacturing and development processes. We use certain vendor management processes to manage cybersecurity risks associated with our use of these providers, which includes reviewing the written information security programs of certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. This can extend to contingent workers as well, who are required to complete background investigations and agree to adhere to policies, including for privacy and cybersecurity.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee, and specifically the subcommittee for cybersecurity, is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our legal team along with third-party service providers in coordination with the CTO. The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for potential cybersecurity incidents, approving technical cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our CTO has over 20 years of experience in engineering and information technology management at various organizations. Our CTO collaborates regularly with our third-party service provider who provides a fractional Chief Information Security Officer, who has extensive experience in cybersecurity and a certification as a CISSP.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances in accordance with the incident response policy, including the CTO, CFO, CEO, and others. Our information security function, together with our CTO, works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the cybersecurity subcommittee of the board of directors' audit committee for certain cybersecurity incidents in accordance with the incident response plan. The cybersecurity subcommittee receives periodic reports from the CTO, which reflect input from the third-party service provider, concerning the Company's risk profile, including significant cybersecurity threats and risk and the processes the Company has implemented to address them. The cybersecurity subcommittee also has access to various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Threats As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we have in the past and also anticipate in the future we will be subject to cybersecurity incidents. We have in place insurance coverage designed to provide coverage in connection with cybersecurity incidents, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; loss of intellectual property or other confidential business information; and other adverse consequences, which may adversely affect our business.


text: Risk Management and Strategy We identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and conducting risk assessments.

companyName: Cryoport, Inc.

ticker: CYRX


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.


text: We also engage third parties to assist with cybersecurity risk assessments, incident detection and response, vulnerability management, systems monitoring, and employee training.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect Cryoport, including our business strategy, results of operations, or financial condition. Refer to "Part I, Item 1A—Risk Factors—Risks Related to Our Technology and Intellectual Property—Cyberattacks, data incidents and breaches in the security of our information systems and networks and of the electronic and confidential information in our possession could materially adversely impact our business, financial condition and results of operations, in addition to our reputation and relationships with our employees, customers, suppliers and business partners" in this Form 10-K for additional discussion about cybersecurity-related risks.


text: Our board of directors holds oversight responsibility over Cryoport's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its audit committee. Our audit committee oversees the management of Cryoport's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds quarterly meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.


text: Within management, our Chief Information Security Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Our Chief Information Security Officer is supported by the Chief Information Officer or Information Technology Director, as applicable, of our business units with respect to the assessment and management of our material risks from cybersecurity risks on a day-to-day basis. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.


text: Risk Management and Strategy Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Operating Officer and who reports regularly to our Board's Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Company's Information Security Program encompasses the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.


text: Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.


text: Oversight of Third-party Risk The Company's Third-Party Relationship Risk Management ("TPRM") Policy governs of all aspects of third-party risk management. The Board has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to the Audit Committee and management regarding the Company's strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews the TPRM Policy on at least an annual basis and ensures that appropriate implementation procedures and practices have been established by management. The Chief Risk Officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. The Chief Risk Officer periodically provides reports to the Audit Committee on third-party risk management activities. The Company's Internal Audit department determines the frequency and scope of independent third-party audits of the TPRM program and its effectiveness.


text: The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.


text: The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective, receives regular reports from the Chief Information Security Officer and other third party advisors, to assure the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.


text: Management's Role in Managing Risk The Chief Information Security Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. He reports quarterly to the Audit Committee on a range of topics, including: Current cybersecurity landscape and risks; Status of ongoing cybersecurity incidents, threats and strategies; Cybersecurity incident reporting and post-incident reviews; and Compliance with regulatory requirements and evolving industry trends.


text: The Chief Information Security Officer reports to the Chief Operating Officer, has a dotted line to the Audit Committee and the Chief Information Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Company's Internal Audit department, and IT department in order to stay informed on all aspects of cybersecurity risk affecting the Company.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer, who has more than 20 years of cybersecurity experience working with large financial institutions and actively maintains multiple information security certifications. Additionally, our Chief Information Security Officer oversees our cybersecurity incident disclosure and communications. Our Chief Risk Officer separately chairs our Risk Management Steering Committee. Our Chief Risk Officer has served in her position since 2014 and is an accomplished banking professional with more than 40 years of experience in compliance and risk management.


text: Monitoring Cybersecurity Incidents The Company monitors cybersecurity events using multiple methods. The Company's 24/7 Security Operations Center ("SOC") has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active "threat hunts," searching for potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors to the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.


text: Reporting to Board of Directors The Chief Information Security Officer, in his capacity as such, regularly reports to management and the Audit Committee on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts and internal threat intelligence team. A team of dedicated privacy, safety, and security professionals oversees cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership of this team includes professionals with deep cybersecurity expertise, including our Chief Information Security Officer. Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: DarioHealth Corp.

ticker: DRIO


text: As part of our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We also conduct annual risk-based penetration testing and provide cybersecurity training for applicable employees. Where appropriate, we engage external advisors and consultants to assist with various aspects of our cybersecurity program and processes.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, our cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with our use of third-party service providers. Based on their risk profiles, we contractually require certain third parties with access to our information systems or data to maintain cybersecurity programs and to report actual or suspected security incidents to us. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors based on their criticality and risk profile, who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber incident. This plan is reviewed at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity risks and incidents, such as a breach of the Company's privacy or information security systems, or those of our vendors or other third parties, could compromise our information and expose us to liability, which would cause our business and reputation to suffer." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile. Our SVP of Technology, who reports directly to the Chief Financial Officer and has over 25 years of experience managing information technology and cybersecurity matters, is primarily responsible for leading the assessment and management of cybersecurity risks and reports periodically to the Audit Committee on cybersecurity strategy and risks. Our SVP of Technology stays informed about and monitors the prevention, detection, mitigation and remediation of security incidents through various channels, including but not limited to briefings from the operational team members, threat intelligence sources, and alerts from security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy AerSale has developed and implemented a comprehensive cybersecurity risk management program for identifying, assessing, and managing material risks to protect the confidentiality, integrity and availability of critical systems and information relevant to our business. Our program utilizes a risk-based approach and is designed based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), and shares common methodologies, reporting channels, and governance processes that apply across all areas of our enterprise risk management, including legal, compliance, operational, and financial risks.

companyName: AerSale Corp

ticker: ASLE


text: AerSale's comprehensive cybersecurity risk management program includes, among others: a security awareness training agenda with topics relating to phishing, spams, viruses, insider threats, suspicious activity and procedures to escalate them, as well as other safety concerns. Certain training programs are employee targeted based on their individual job responsibilities and on the potential risks associated with such roles.


text: internal and external assessments, including audits and response simulations, to examine cybersecurity vulnerabilities and potential attack vectors to company systems, as well as evaluating the impact of these vulnerabilities in our operational and financial posture. processes to identify and manage risks related to critical third-party technology providers. a cybersecurity incident response plan that includes procedures for responding to cybersecurity threats or incidents.


text: when appropriate, use of external subject matter specialists, including assessors, consultants, auditors or other third parties, to provide incident response services and to conduct independent assessments of internal response readiness. engagement in security practices that include physical, administrative and technical safeguards of systems and hardware.


text: We are not aware of any risks from cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to AerSale's Business and Industry—Our business could be negatively affected by cyber or other security threats or other disruptions" in Part 1, Item 1A "Risk Factors" in this Annual Report.


text: Cybersecurity Governance Our Board of Directors has overall responsibility for risk oversight, and has delegated the responsibility of cybersecurity and other information technology related risks to the Audit Committee of the Board of Directors, which oversees the implementation and continuous improvement of our comprehensive cybersecurity risk management program and compliance with disclosure requirements. The Audit Committee is provided with information, results of internal and external assessments, and updates on cybersecurity initiatives at Audit Committee meetings from our Chief Information Officer, and is responsible for reporting any findings and recommendations to the Board of Directors for consideration. Our team of cybersecurity professionals is led by our Chief Information Officer, a seasoned technology executive with over 20 years of experience in the cybersecurity field, a strong focus on systems and security, and a proven track record of leading cyber experts to protect organization from evolving threats. The cybersecurity team has the primary responsibility for AerSale's comprehensive cybersecurity risk management program, and supervises internal personnel as well as external cybersecurity consultants. Our processes are designed to prevent and monitor cybersecurity incidents, allowing us to timely detect and respond to incidents through our cybersecurity response plan, which includes materiality evaluations based on the size and scope of the incident. This evaluation is documented in an incident report that is shared with the Chief Information Officer, Chief Financial Officer and Audit Committee to effectively manage resources to reduce risk and prevent future incidents.


text: Cybersecurity threats pose a risk to the Company as crimes committed through or involving the internet. Examples of those threats are malware, phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into internal systems or the systems of third-party vendors that could adversely impact operations or damage reputations.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: We utilize third party service providers to support and facilitate business and operational activities to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Vendor Risk Management ("VRM") framework, which provides the tools and practices utilized in the oversight of third-party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values. For the 2024 period, there were no material incidents affecting the VRM framework or controls.


text: We have developed cybersecurity and data privacy programs designed to enable and safeguard the confidentiality, integrity and availability of our information systems and data by providing proactive security expertise and risk assessments, creating and maintaining a resilient and secure environment, and fostering a culture of security awareness and compliance throughout our organization. We maintain a robust Information Security Program that sets forth our commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing of, and protecting sensitive information, including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA).


text: The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable and resilient technology infrastructure, fostering a culture of technology risk awareness and continuously improving its technology risk management practices. Our process for monitoring and mitigating cybersecurity risk is designed in conjunction with our overall Risk Management Policy and Information Security Program. One of the key aspects of these programs are various risk assessments that are used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program. Annually, we engage a third party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements as well as a full-scope independent audit of IT and Information Security processes.


text: All of our employees also have a responsibility to protect the privacy of Company and Bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture. Additionally, the Company carries out regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.


text: The management of cybersecurity risks is ultimately the responsibility of Company management and is governed by the Board. They devote significant time and attention to the oversight of cybersecurity and information security risks. The Board through its BRC reviews monthly information technology and Information Security and Vendor Management reports that highlight key areas of focus and risk. The Board also reviews and approves the Information Security Program, the central program outlining cyber-security processes and controls annually and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends and best practices.


text: We are subject to extensive federal and state regulation of customer privacy and the security of financial information. Our federal regulator, the FDIC, is part of the Federal Financial Institutions Examination Council (FFIEC), which publishes extensive guidelines and examination procedures that are used to review the security of financial institutions.


text: To date, we have not experienced a cybersecurity incident or data breach that has materially affected us or our business strategy, results of operations, or financial condition.


text: The Company maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: The Bank's Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recover strategies to help mitigate the impact of a cybersecurity incident across all business lines.


text: Management Role and Board Oversight The cybersecurity programs are supervised by the Bank's Chief Information Security Officer (" CISO ") reporting to the Chief Risk Officer ("CRO") and dotted line to the Chief Information Officer. The Chief Risk Officer has reporting responsibility to the Board's Risk and Compliance Committee while the Chief Information Officer has reporting responsibility to the Board's Information Technology Committee. The Risk and Compliance Committee consists of eight directors, seven of whom are independent, while the Information Technology Committee consists of three directors, two of whom are independent and members of the Risk and Compliance Committee. The Company Board includes members who have expertise in cybersecurity, fraud, and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO who has a Ph. D. in Information Technology with a concentration in Information Assurance and experience in the information technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's knowledge and experience in the cybersecurity field are key to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards and disaster recovery, business continuity, and incident response efforts. Additionally, the Bank's CRO who leads the management risk function, has extensive experience in risk management.


text: The cybersecurity programs include a cross-function team of trained internal and external information security professionals, all of whom are required to maintain industry accredited certifications. We have an Incident Response Team chaired by our Chief Operating Officer that is comprised of executive management and designated managers, including the CISO. The purpose of our incident response plan is to manage incidents, including information security incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, notify customers, as required by law, comply with regulatory requirement and any third-party obligations.


text: The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Risk Management Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, and risk reporting. The CISO and CRO also provide a monthly overview of the cybersecurity landscape to the Board of Directors.


text: Managing Material Risks and Integrated Overall Risk Management The Company maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.


text: Cybersecurity Threats To assess and manage cybersecurity threats, the Company maintains an Incident Response Team comprised of members from the major business areas in the Company to ensure appropriate subject matter specialists are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Company's business strategy, results of operations or financial condition by following implemented processes. The Company has not identified any cybersecurity threats that have materially affected operations or financial position.


text: Oversee Third-Party Risk The Company has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Company's vendor management program requires initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.


text: Cybersecurity Risks Management and the Board of Directors acknowledge that technology systems, managed both by the Company and third-party service providers, are critical to business operations and therefore require appropriate risk management.


text: Engagement with Third Parties on Risk Management Cybersecurity is an integral part of the risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Our internal audit function actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. Our external audit results are reviewed and reported in our annual filing and to the Board Audit Committee. Additionally, the Company and the Bank are regulated entities and undergo regulatory reviews to ensure the Company and the Bank are in compliance will all appropriate standards.


text: Cybersecurity Risk Management and Oversight We have processes for assessing, identifying, and managing cybersecurity risks, integrated into our overall risk management program and information technology function. These processes are designed to:

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Protect our information assets and operations from internal and external cyber threats, Safeguard employee, vendor, and collaborator information from unauthorized access or attack, and Secure our networks and systems.


text: Response plans for cyber incidents, Regular system testing and incident simulations, and Routine reviews of policies and procedures to identify risks and enhance practices.


text: To strengthen our cybersecurity risk management practices and oversight, we engage external consultants with expertise in information security, incident response, and governance. Additionally, we evaluate the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.