text: We also utilize third-party service providers as a normal part of our business operations. These third-party service providers may have access to our systems and/or sensitive information. To address cybersecurity risks arising from our third-party service providers, we assess and monitor risks relating to potential compromises of sensitive information at our third-party service providers and reevaluate these risks periodically. We categorize our third-party service providers by criticality, based on the criticality and sensitivity of our data each third-party service provider has access to, and, based on this, we employ a risk-based approach for review of the security measures implemented by our third-party service providers. In addition, we obtain periodic attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.


text: Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business. For example, we collect, store and transmit sensitive information including intellectual property, proprietary business information, including highly sensitive clinical trial data, and personal information in connection with our business operations. The secure maintenance of this information is critical to our operations and business strategy. If this information was subject to a cybersecurity attack or unauthorized access or use, it could have a material adverse effect on our business and could expose us to potential legal consequences, liabilities, mitigation costs, and damage to our reputation. Managing cybersecurity incidents would also divert management's attention and resources from regular business operations.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY

secItem: Item 1C


text: While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.


text: We have established a disclosure committee, which consists of our chief executive officer, chief financial officer, and senior leaders from finance, legal, accounting, corporate communications, and investor relations, including, but not limited to, our Chief Legal Officer, CIO, CISO, chief accounting officer, controller and Chief Corporate Communications Officer. The disclosure committee is actively involved in the review and approval of the Company's SEC filings and has responsibility for considering the materiality of information for such filings and, on a timely basis, determining the disclosure of that information. The CISO briefs the disclosure committee, as necessary, on cybersecurity related matters, which includes information regarding our detection, prevention, mitigation, and remediation of cybersecurity incidents and monitoring of previously evaluated cybersecurity incidents for subsequent changes that might impact conclusions on materiality, and this information is presented to the nominating and corporate governance committee, as appropriate.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's Enterprise Risk Management Program ("ERMP"), and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERMP and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a systematic, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents if they should occur.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: Risk Management and Strategy As one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity is delegated to the Audit and Compliance Committee of the Board, which oversees the Company's entire ERMP, reporting up to the full board on a periodic basis. The Company's Chief Information Officer ("CIO"), the Chief Compliance Officer and other members of management regularly report to the Audit and Compliance Committee, with cybersecurity representing a standing meeting agenda topic. • Collaborative Approach: The Company has implemented a systematic, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, 24x7 security monitoring, and other controls which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: • Incident Response and Recovery Planning: The Company has established and maintains systematic incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis. • Third-Party Risk Management: The Company maintains a systematic, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory cybersecurity training for all personnel as a means to equip the Company's workforce with effective tools to recognize, address and communicate potential or actual threats to the Company's cybersecurity systems. Moreover, these trainings also allow Company personnel to remain up-to-date with evolving information security policies, standards, processes and best practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company has also engaged third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results and findings of these exercises are reported to the Audit and Compliance Committee, who in turn updates the Board as appropriate. Management will then evaluate such findings and, with input from the Audit and Compliance Committee, take the appropriate steps to adjust the Company's cybersecurity policies, standards, processes and practices, as may be applicable, to strengthen or address any weaknesses, gaps or findings as the case may be.


text: The Board has delegated their oversight of cybersecurity to the Company's Audit and Compliance Committee which oversees the entire ERMP process. As detailed above, cybersecurity is a standing agenda topic for the Audit and Compliance Committee which receives regular presentations and reports from the Company's CIO on cybersecurity risks, detection protocols, disaster recovery readiness, the threat environment, recent developments in the cybersecurity space (including known incidents affecting the Company or key Company suppliers), evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. Under the current cybersecurity framework, the Audit and Compliance Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Audit and Compliance Committee will keep the full board informed, as may be appropriate, until any such threat has been addressed to their satisfaction. Additionally, cybersecurity is also a standing agenda topic for the Global Risk Committee, with periodic updates to the Executive Committee and Senior Leadership Team.


text: The CIO, in coordination with the Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Legal Officer, and Chief People Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The CIO has served in various leadership roles in information technology and information security for over 24 years, including serving as the vice president of information technology, with direct responsibility over the cyber security program, for a large publicly-traded company and as the chief information security officer of several large healthcare organizations. The CIO holds a Certified Information Systems Security Professional certification, an undergraduate degree in engineering, an MBA and a PhD in engineering.


text: The Board has delegated their oversight of cybersecurity to the Company's Audit and Compliance Committee which oversees the entire ERMP process. As detailed above, cybersecurity is a standing agenda topic for the Audit and Compliance Committee which receives regular presentations and reports from the Company's CIO on cybersecurity risks, detection protocols, disaster recovery readiness, the threat environment, recent developments in the cybersecurity space (including known incidents affecting the Company or key Company suppliers), evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. Under the current cybersecurity framework, the Audit and Compliance Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Audit and Compliance Committee will keep the full board informed, as may be appropriate, until any such threat has been addressed to their satisfaction. Additionally, cybersecurity is also a standing agenda topic for the Global Risk Committee, with periodic updates to the Executive Committee.


text: The CIO, in coordination with the Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Legal Officer, and Chief People Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams, comprised of our cybersecurity experts, are deployed throughout the Company to identify and address cybersecurity threats and to respond to cybersecurity incidents. The CIO has served in various leadership roles in information technology and information security for over 24 years, including serving as the vice president of information technology, with direct responsibility over the cyber security program, for a large publicly-traded company and as the chief information security officer of several large healthcare organizations. The CIO holds a Certified Information Systems Security Professional certification, an undergraduate degree in engineering, an MBA and a PhD in engineering.


text: security risk is an area of increasing focus for our Board, particularly as an increasingly significant part of our operations rely on digital technologies. As a result, we have implemented a cyber security program to assess, identify, and manage risks from cyber security threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. This program has been integrated into the Company's overall risk management process.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Management and Strategy we follow IoT cybersecurity standards and regulations, our products and information systems are potentially subject to cyber risks of data leakage and operational damages. To protect our products and information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, annual cyber testing, internal auditing, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. Any reported vulnerability is analyzed and reported to the CISO.


text: of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.


text: Employment of a responsible disclosure policy, which includes a Bug Bounty Program designed to help identify and fix any potential flaws in the company's services or products.


text: employ processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, or customer, or otherwise implicating the third-party technology and systems we use. Such security measures include, without limitation: A security solution designed to safeguard customer data and systems. Security assessments of our major vendors. Risk assessments by an insurance company.


text: Implementation of endpoint detection and response (EDR) technology, as well as partial operational technology (OT) security measures on some of our factories, to protect our on-premises systems.


text: Board has delegated primary oversight of the Company's risks from cyber security threats to the Technology Committee. Our management team, including our Chief Information Security Officer (CISO), provides quarterly updates to our Technology Committee and annually to the full Board regarding our cyber security activities and other developments impacting our digital security. We have protocols by which certain cyber security incidents are escalated within the Company and, where appropriate, reported to the Board and Technology Committee in a timely manner.


text: management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security as a result of 26 years of experience in leading security teams, developing security strategies, and managing risk across various industries. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from a number of experienced information security officers responsible for various parts of the business and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.


text: Company's internal auditor and CISO are informed in the event of any significant cyber security incident and operate to comply with applicable laws regulations.


text: cyber security incident could materially affect our operations and production, including our ability to produce goods or provide services and our ability to timely and accurately produce financial reports. Further a cyber security incident could result in unauthorized access or disclosure of sensitive data, such as financial information, intellectual property, or customer, employee or supplier related data, including personally identifiable information. A material cyber incident could adversely affect our financial condition and results of operations, have as an adverse effect on our reputation and could result in legal actions against the Company. Please see the discussion under " Any unauthorized access to, disclosure, or theft of personal information we gather, store, or use could harm our reputation and subject us to claims or litigation." and "Third parties, our employees, or our vendors might gain unauthorized access to our network or seek to compromise our products and services" in Item 1A. Risk Factors for additional information.


text: risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, there can be no guarantee that we will not be the subject of future successful threats or incidents. The Company has not been subject to any information security breach penalties or settlement payments.


text: Cybersecurity Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.

companyName: Lifeward Ltd.

ticker: LFWD


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented an employee education and training program, which we provide on an annual basis, that is designed to raise awareness of cybersecurity threats. To support our cybersecurity risk management program, we leverage managed service providers and other third-party information technology and cybersecurity providers and consultants, including to perform regular system scans and threat intelligence analysis. Additionally, we require certain third-party providers and consultants to adhere to contractual requirements relating to privacy and cybersecurity standards.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Governance


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, in the event of a cybersecurity incident, incident response strategies from our Chief Financial Officer ("CFO"). The audit committee updates the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.


text: Our Chief Technology Officer ("CTO"), who reports directly to our Vice President of Finance and, ultimately, our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual currently serving in this position is a third-party consultant who maintains 20 years of experience advising similarly situated companies on information technology and cybersecurity risk management. Our CTO provides regular cybersecurity updates to our Vice President of Finance and Chief Financial Officer on matters relating to our cybersecurity program and cybersecurity risk management.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. Our IT policies, processes and practices are based on recognized frameworks established by our external IT service provider and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: As part of the above processes, we regularly engage consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. EDR System (Endpoint Detection & Response)


text: Two-factor authentication for email (Office 365) and cloud-stored information We protect our mail system against spam, phishing, spoofing, and malware using a (Mail Relay system). Additionally, we enforce a real-time threat notification mechanism and activate alerts and reports for failures in our backup system.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. We also describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are increasingly dependent on information technology systems, infrastructure and data, and our internal computer systems, or those of our collaborators, third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: Cyber security risk is an area of increasing focus for our Board, particularly as an increasingly significant part of our operations rely on digital technologies. As a result, we have implemented a cyber security program to assess, identify, and manage risks from cyber security threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. This program has been integrated into the Company's overall risk management process.


text: We design and assess our cybersecurity program based on the CIS Controls and NIST Cybersecurity Framework (CSF). These frameworks provide us with a common language and structure for identifying, assessing, and managing cybersecurity risks across our organization. We do not claim to comply with any technical standards, specifications, or requirements by using these frameworks. They are guides that help us to deal with the cybersecurity risks that are relevant to our business.


text: Our cybersecurity program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. To this end, we have implemented a cybersecurity program that includes the following elements: A Cybersecurity Manager responsible for developing and maintaining our administrative, technical, and physical cybersecurity controls. Risk assessments designed to identify material cybersecurity risks to our critical systems and information. A Security Operations Center (SOC) to monitor our critical infrastructure and execute immediate, human-led responses to confirmed threats. External technology and security providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity program.


text: Cybersecurity awareness training for employees and supplemental training for senior management and other personnel who access highly sensitive information A third-party risk management process and questionnaire for service providers and vendors who access sensitive information. A trained incident response team and written procedures to navigate the incident response lifecycle.


text: Based on the information that we have to date, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected, including our operations, business strategy, results of operations, or financial condition. and, as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy While we follow IoT cybersecurity standards and regulations, our products and information systems are potentially subject to cyber risks of data leakage and operational damages. To protect our products and information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, annual cyber testing, internal auditing, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. Any reported vulnerability is analyzed and reported to our Chief Information Security Officer ("CISO").


text: As part of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Maintenance of an ISO 27001 Information Security Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.


text: Third Party Cybersecurity Oversight We have implemented governance processes designed to monitor, evaluate, and mitigate security risks that may arise from a relationship with a third party vendor, partner, or customer. These security measures include: Vendor security assessments - Evaluating the cybersecurity protection that key vendors employ, prior to and during engagement. Insurance risk assessments - conducted by our insurance providers in order to evaluate cybersecurity related exposure. Operational Technology Security - Implementing security measures within some of our manufacturing facilities to enhance our cybersecurity protection. Secure customer data management - Solutions designed to safeguard customer data and critical systems.


text: We engaged a well-known external firm to audit our compliance with the European Union's NIS 2.0 Directive (the Directive on Security of Network and Information Systems). This audit is being conducted to confirm that our cybersecurity practices align with the latest regulatory requirements and best practices for managing the security of critical infrastructure and services. The Technology Committee receives periodic reports from management on our cybersecurity program and risks. In addition, management updates the Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Technology Committee reports to our Board regarding its risk management functions, including those related to cybersecurity.


text: Governance & Oversight The Board has delegated primary oversight of the Company's risks from cybersecurity threats to the Technology Committee. Our management team, including our CISO, provides quarterly updates to our Technology Committee and annually to the full Board regarding our cyber security activities and other developments impacting our digital security. We have protocols by which certain cyber security incidents are escalated within the Company and, where appropriate, reported to the Board and Technology Committee in a timely manner.


text: At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security as a result of 27 years of experience in leading security teams, developing security strategies, and managing risk across various industries. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from a number of experienced information security officers responsible for various parts of the business and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, from time to time we and our third-party vendors have experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors - Risks Related to Our Intellectual Property and Information Technology" in this Annual Report on Form 10-K.


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, in the event of a cybersecurity incident, incident response strategies from our Chief Financial Officer. The audit committee updates the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. We also describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are increasingly dependent on information technology systems, infrastructure and data, and our internal computer systems, or those of our collaborators, third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs." included as part of our risk factor disclosures at Item 1A of this Annual Report.


text: Our Audit Committee of the Board of Directors ("the Audit Committee"), is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: CYBERSECURITY RISK MANAGEMENT, GOVERNANCE AND RISK ASSESSMENT The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company has established a cybersecurity program (the "Program") that is designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: CYBERSECURITY RISK MANAGEMENT The Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and Payment Card Industry standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. The Program is aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness. The Company undergoes an annual Service Organization Controls ("SOC") Type 2 attestation report covering the performance of safeguards deployed to protect certain Company systems and applications. The Company maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: The Company has a designated Chief Information Security Officer (the "CISO"). The Program is implemented and managed by the Company's executive management under the leadership of the CISO. The Company contracts with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies. Additionally, the Company has retained a number of well-established and reputable cybersecurity consultants, including forensics experts, auditors, as well as outside cybersecurity legal counsel to assist with cybersecurity matters as needed from time to time.


text: The Company has a Computer Incident Response Team ("CIRT") which is responsible for monitoring, preventing, detecting, assisting with the investigation, and responding to cybersecurity threats. The Company has in place an Information Security Incident Response Plan ("IRP") Protocol which provides an operational framework to coordinate the response to any type of cybersecurity incident affecting the Company. The CIRT team informs the CISO of cybersecurity threats consistent with the IRP. The IRP also provides the process and oversight to manage cybersecurity incidents that may arise from a third-party service provider. In addition, the IRP addresses management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate.


text: The Company's cybersecurity policies and procedures are reviewed by the CISO and updated at least annually. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. The cybersecurity policies and procedures are communicated and enforced throughout the Company, as well as with the third-party service providers that have access to the Company's information systems or nonpublic information. Cybersecurity policies and procedures are also subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company requires employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises.


text: The CISO is responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO has the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The CISO's expertise includes decades of information technology and cybersecurity as a subject matter expert, including more than a decade of executive management experience as a CISO for Fortune 500 companies.


text: The Program is overseen by the Company's Board of Directors through its Audit Committee which, pursuant to its charter, assists the Board with oversight of Company privacy, data security, and cybersecurity matters and risks. The Audit Committee meets regularly with the Company's executive management, including the CISO and the Chief Information Officer, and receives updates on the status and overall effectiveness of the Program, changes to the Program, relevant information technology operations, any changes in material cybersecurity risks and any significant cybersecurity incidents consistent with the IRP. The Audit Committee also discusses with executive management the steps management has taken to monitor and mitigate privacy, data security, and cybersecurity risk exposures, the Company's information governance policies and programs, and major legislative and regulatory developments that could materially impact the Company's exposure regarding privacy, data security risk, and cybersecurity. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.


text: CYBERSECURITY RISK ASSESSMENT The CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company conducts regular risk assessments to identify, evaluate, and prioritize material cybersecurity risks to the Company, including its health plans and state contracts, shared services and IT operations, or business strategy. The risk assessments are informed by various sources of information, such as internal and external audits, vulnerability scans, penetration tests, threat intelligence, incident reports, industry benchmarks, and accepted industry practices. The risk assessments consider the potential impact and likelihood of various cybersecurity threats, such as ransomware, malware, social engineering, third-party incidents, supply chain attacks and insider threats, and contemplates the adequacy of controls to detect, prevent, respond, and recover to reduce the possibility of an adverse material cybersecurity event. The Company has in place processes to identify material risks from cybersecurity threats associated with its use of third-party service providers and as such, conducts assessments of such third-party service providers with respect to their cybersecurity programs and risks and requires third-party service providers to notify the Company if they experienced a cybersecurity incident. The Company hires experienced security professionals to conduct advanced and realistic cybersecurity attack simulations to verify its Program, and conducts regular cybersecurity tabletop exercises with executive management, which are coordinated by a third-party.


text: For a discussion of the Company's cybersecurity-related risks, see Item 1A of this Form 10-K under the heading "Risk Factors—If we or one of our significant vendors sustain a cyber-attack or suffer data privacy or security breaches that disrupt our information systems or operations, or result in the dissemination of sensitive personal or confidential information, we could suffer increased costs, exposure to significant liability, reputational harm, loss of business, and other serious negative consequences."


text: The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity, data classification and data protection are key components of our long-term strategy.

companyName: QXO, Inc.

ticker: QXO


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner. Our security operations team ("SOT"), which is comprised of internal security professionals and reports to the Chief Information Officer ("CIO") of SWK, has first line responsibility for our cybersecurity risk management processes as they relate to day-to-day operations. Our audit and compliance team ("ACT"), which is comprised of a team lead and the CIO, has second line responsibility and works in partnership with our executive leadership team ("ELT") and other internal teams to coordinate efforts, priorities and oversight. Our ACT assesses cybersecurity threats and risks based on probability and potential impact to key business systems and processes. Threats and risks that can cause major damage or service impact that the ACT considers high are incorporated into our overall risk management program. The ACT develops a mitigation plan for each identified high threat and risk and reports its progress with respect to mitigation of such threats and risks to the Technology Risk Management Committee, which is part of our ELT and consists of both management-level employees and members of the SilverSun board of directors; such high-level cybersecurity threats and risks are tracked as part of our overall risk management program.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity incident prevention and response systems and processes as our SOT deems necessary or appropriate. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity threats and risks, as well as to support associated mitigation plans when necessary. Our SOC Type 2 audit, completed in September 2023, attests to the effectiveness of our security and risk management controls. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities critical to our ongoing business operations, including those that perform cybersecurity services.


text: We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing including disaster recovery exercises.


text: We maintain a cross-functional cybersecurity incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant cybersecurity incident as well as mitigating any impact from such incidents on our business. Generally, when a cybersecurity incident or suspected cybersecurity incident is identified, the SOT would escalate the issue to the ACT for initial analysis and guidance. In the event of a significant cybersecurity incident, the ELT would typically be tasked with preparing an initial response. The ELT, with support from the ACT, would be responsible for determining whether a particular cybersecurity incident (alone or in combination with other factors) triggers any reporting or notification responsibilities under applicable law or regulation or pursuant to any contractual obligation.


text: The ACT, in consultation with the ELT and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent EGS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our cybersecurity program. The results of this assessment, which are reported to the board of directors, assist us in determining whether any further changes to our existing policies and practices are warranted.


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their cybersecurity fitness against our risk posture and request changes as we deem necessary.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the headings "Risks Relating to our Business - If there are events or circumstances affecting the reliability or security of the internet, access to our website and/or the ability to safeguard confidential information could be impaired causing a negative effect on the financial results of our business operations" and "Risks Relating to our Business - Computer Malware, Viruses, Hacking, Phishing Attacks and Spamming Could Harm Our Business and Results of Operations" in this Form 10-K.


text: Board Oversight. Currently, our board of directors oversees our risk management program, including with respect to material cybersecurity threats and associated risk exposures. The ACT reports to the board of directors semiannually on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cybersecurity threats and the status of initiatives intended to bolster our cyber security systems and the cyber readiness of our personnel.


text: Our board of directors oversees our risk management process, including as it pertains to material risks from cybersecurity threats, directly and through its committees. Board of directors' meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the CIO on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. The board of directors plans, however, to delegate to its Audit Committee in the near future specific responsibility for overseeing our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe, including specific responsibility for overseeing material cybersecurity risk exposures. Specifically, the Audit Committee will be responsible for establishing risk tolerance guidelines around our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations related to the protection or privacy of our critical systems and data, and will take over the board of directors' functions in this regard as described above. The board of directors will continue to meet, at least annually, with members of our ACT to review and discuss our cybersecurity program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the board of directors and its committees.


text: Management ' s Role. Our ELT team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The ACT oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ACT also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk registrar and oversees the security awareness program.


text: Our ACT reports to our CIO. Our CIO reports to our CTO who in turn, reports to our CEO who, in turn, reports to our Board of Directors. Our CIO has 30 years of experience in leading global security functions and strategies. Collectively, the other members of our ACT and SOT relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ACT and SOT.


text: JAKKS has implemented cybersecurity policies, processes and procedures to aid in the identification, protection, detection of cyber related issues, and the response to and recovery from cybersecurity breaches. A summary of the principal activities JAKKS has undertaken to strengthen its cybersecurity posture and mitigate its cybersecurity risks:

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: A subcommittee of the Board of Directors has been established to oversee and manage the company's risk, response, and recovery policies, processes, and procedures related to, and stemming from, cyber-related issues; Purchased cybersecurity risk insurance to protect against potential losses arising from a cybersecurity incident; Implementation of quarterly vulnerability and penetration tests to identify, and if necessary, remediate, any potential risk to the organization;


text: Engaged two (2) third-party service providers to monitor JAKKS systems for anomalous activity (24 hours a day, 365 days a year); Conduct disaster recovery exercise on a yearly basis;


text: Implemented a revised and updated phishing email training program; and Retained a consultant to act as the Company's Virtual Chief Information Security Officer (VCISO), who has more than 20 years of experience in various cybersecurity roles (e.g., managing information security, developing cybersecurity strategies, implementing cybersecurity and incident response programs, etc.) to oversee the implementation and performance of the Company's cybersecurity program.


text: As part of our cybersecurity program, the Company's VCISO, Senior Vice President of Operations and Vice President of Information Technology, collectively referred to as our "Cybersecurity Team," reviews our cybersecurity posture, identifies areas in need of improvement, and helps foster a culture of compliance (including training of all employees). Our Vice President of Information Technology has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity program. The Company's program also includes activities to respond to and recover from cybersecurity incidents, including processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our Cybersecurity Team assesses cybersecurity risks, including those related to our supply chain and third-party service providers that have access to our systems or facilities where JAKKS' data is stored. The team assesses how cybersecurity risks affect or are reasonably likely to materially affect the Company, including our operations or financial position. Our Cybersecurity Team is responsible for the Company's risk assessment, risk management, disaster recovery, and auditing of JAKKS overall cybersecurity program. The Cybersecurity Team meets with the Cybersecurity Subcommittee of the Board of Directors to discuss, identify, and address cybersecurity risks and review updates to our risk management program to ensure cybersecurity risks to the organization are mitigated. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors beginning on page 22 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.


text: In December 2022, the Company learned of a cybersecurity threat to its information technology system ("IT System"), and that certain data, including personal data of employees, had been extracted from the Company's IT System. Upon learning of the cybersecurity threat, the Company launched an investigation and undertook prompt action, including employing containment protocols to mitigate the impact of the threat, engaging third-party information technology cyber security and forensics experts and special legal counsel, and utilizing additional security measures to help safeguard the integrity of its IT System's infrastructure and the data contained therein. The Company has not identified any material damage suffered from the incident.


text: Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: We utilize Information Technology Associates ("ITA"), an outsourced IT provider which has been designated with oversight responsibility for our cybersecurity risks. ITA possesses a deep understanding of our information technology systems, including methods to manage and monitor cybersecurity risks. It also provides active monitoring and risk assessments of cybersecurity threats and communicates such threats to our Company. Low risk threats are communicated to our systems analysts, and high risk threats are first communicated to Bill Bennett (our CEO and director), Brady Smallwood (our COO and director), and Gary Schubert, our CFO, and are then discussed with our board of directors.


text: We conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance. Additionally, we require our associates to complete cybersecurity awareness training provided by NINJIO.


text: Like many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our emails. However, we do maintain a standalone server for our main enterprise resource planning (ERP) program (Great Plains), and we maintain two servers dedicated to processing orders for Artisan Specialty Foods and Food Innovations, Inc. We also maintain a file server that currently houses approximately one terabyte of data. Each of our servers is protected by firewall and two-factor-authentication. Additionally, we take multiple snapshots of our servers several times throughout the day and store encrypted backups of our data both locally and in a cloud server to mitigate loss in the event of any malicious attacks on these resources. In the normal course of our relationships with the providers of our services not controlled in-house, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems, as overseen by our Board, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct risk assessments of certain third-party providers before engagement and have established monitoring procedures in an effort to assess and mitigate potential data security exposures originating from third parties. We from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: RYVYL Inc.

ticker: RVYL


text: Board of Directors The audit committee of our Board oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, at least once per quarter, our management team reports on cybersecurity matters, including material risks and threats, to the audit committee, and the audit committee provides updates to the Board at regular Board meetings. Our management team also provides updates annually or more frequently as appropriate to the Board.


text: Under the oversight of the audit committee of the Board, and as directed by our Chief Executive Officer ("CEO") and Chief Operating Officer ("COO"), the Head of IT is primarily responsible for the assessment and management of material cybersecurity risks and the Company's annual security audits to meet the payment industry expectations. Our management team holds a regular cybersecurity and business continuity reviews to evaluate data security exposures, control effectiveness and necessary remediation actions. The Head of IT is also supported by a third-party IT consulting services provider who helps oversee our IT systems and provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents.


text: Our Head of IT oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our Head of IT also coordinates with our legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our management team is informed about the effectiveness of the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.


text: Our audit committee is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. Our Head of IT, or a delegate, informs the COO of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The COO is also primarily responsible for advising our CEO and Chief Financial Officer regarding cybersecurity disclosures in public filings. The COO also notifies the audit committee chair of any material cybersecurity incidents.


text: As of the date of this Report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor included in the section entitled "Item 1A. Risk Factors" in this Report.


text: Cybersecurity Risk Management Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors, of this Form 10-K.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: The Company maintains a formal Information Security Program that includes risk assessments regularly conducted by internal resources as well as third-party experts. These assessments are used to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. Our program leverages industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of our information assets and systems.


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Executive Officer. The CISO has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, counterparts at third-party vendors and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 20 years of experience in the fields of information technology and cybersecurity and maintains multiple professional cybersecurity certifications.


text: Incident Monitoring and Response. We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events.


text: Threat and Vulnerability Management. We maintain a threat and vulnerability management program that leverages multiple data sources to proactively identify, assess, and mitigate changing cybersecurity risks. This program incorporates vulnerability scanning and threat intelligence capabilities, which are in place to help safeguard information assets. We also share and receive threat intelligence with government agencies, the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and cybersecurity vendors and leaders in the cybersecurity industry.


text: Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes.


text: Third-Party Risk Management. We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments.


text: Security Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats. This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.


text: While we maintain teams that specialize in cybersecurity and information technology, we also leverage third-party experts to provide objective feedback on our program and posture. These are accomplished via penetration tests, security posture assessments, and technology consulting. These independent evaluations help validate existing controls, identify potential focus areas, and aid in securely deploying technology in an increasingly complex environment.


text: Our Information Security Program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, the Bankers Electronic Crimes Taskforce Ransomware Self-Assessment Tool, and the Gramm-Leach-Bliley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Office of the Comptroller of the Currency to review our cybersecurity program and discuss the changing threat landscape.


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association, and the Texas Bankers Association. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget, and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities.


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies at least annually. Additionally, the Technology Committee of our board of directors reviews our cyber security risk profile on at least an annual basis.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Pioneer Green Farms, Inc.


text: We intend to leverage the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we will develop a formal, documented process to assess the data protection practices of certain third-party vendors that may handle sensitive information on our behalf.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management may provide periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements. To continually enhance the effectiveness of the practice, we regularly assess the program's measures, contractual obligations, and compliance with industry standards. Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: We have previously experienced actual or attempted cyber-attacks on our information systems or networks; however, none of these incidents had a material impact on our operations or financial condition. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors on page 13.


text: The board of directors oversees the Company's practice for assessing, identifying and managing material risks from cybersecurity threats. The Audit Committee, consisting of all of the board's independent directors with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.


text: The Company's Chief Information Officer leads the overall cybersecurity strategy and risk management program. This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team. Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning. The IT department executes daily security tasks such as vulnerability scanning, threat detection, and incident response. The Chief Information Officer and IT security team provide regular reports to senior management on the Company's cybersecurity posture, identified vulnerabilities, and ongoing incident management activities. Management provides the Audit Committee with quarterly updates on the Company's cybersecurity practices.


text: Governance Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management provides periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.

companyName: Cannaisseur Group Inc.

ticker: TCRG


text: Risk Management and Strategy We recognize the importance of maintaining the trust and confidence of our customers, business partners, and employees, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our approach to cybersecurity risk management is aligned with our risk profile and business, and includes efforts towards meeting the standards for an organization of our size and type in conjunction with the National Institute of Standards and Technology. We also utilize a third-party IT vendor to manage the technological security and efficacy of our systems, including a Virtual Chief Information Officer, a Virtual Chief Information Security Officer, and other IT specialists who manage our IT and cybersecurity needs.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Our cybersecurity risk management is designed to employ technology and security practices across our operations and business functions, including vulnerability assessments, detecting and responding to cyber security incidents, cybersecurity crisis preparedness and incident response resources, vulnerability scans and IT security risk assessments, and progressive investments in cybersecurity infrastructure and technology designed to reduce cybersecurity risks. Notable aspects of our cybersecurity risk management include: efforts towards adoption of the National Institute of Standards and Technology (NIST), Cybersecurity Framework; periodic IT risk assessments conducted by an external cybersecurity consultant; enterprise-wide security and privacy measures; IT security, cybercrime, privacy, and HIPAA security training provided to employees and independent contractors; periodic social engineering and phishing testing for employees; encrypted and air-gapped data backups; periodic dark web monitoring and vulnerability scans; and periodic review of disaster preparedness, incident response, and business continuity plans.


text: We intend to continue to leverage the support of third-party information technology and security providers, including to perform risk assessments designed to identify, assess, and manage cybersecurity risks. We assess on an ad hoc basis the data protection practices of certain of our third-party vendors who handle our data, which assessments include the assessment of vendor data protection policies, disclosure of changes to data protection policies or practices, maintenance of cyber liability insurance, and provision of certifications, assessments, or other documentation as deemed relevant.


text: As of the date of this annual report, we maintain cyber liability insurance that provides cyber incident response coverage. However, costs, damages, and remediation associated with cybersecurity incidents may not be adequately insured under our insurance policy and may be subject to applicable deductibles, to the extent that they are covered. See also " We could lose cyber liability insurance coverage and be subject to uninsured liabilities " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to our cyber liability insurance.


text: As previously disclosed, in fiscal 2023, Fortra, LLC, the third-party vendor that provides the GoAnywhere managed file transfer as a service system (MFTaaS), experienced a data security incident that affected many of Fortra's customers, including us. We use GoAnywhere as a means by which our customers electronically share certain data regarding their employees and other third parties with us. Our understanding is that this activity was the result of the threat actor's exploit of a zero-day vulnerability in Fortra's systems. Based on the information we have obtained from Fortra and our own diligence, we understand that this activity only affected Fortra's systems, and did not involve unauthorized access to our information systems. However, the threat actor in this incident accessed certain of our customers' employees' and other third parties' data and such data included protected health information, as defined by the Health Insurance Portability and Accountability Act, and personally identifiable information. We have engaged outside experts to assist in investigating and responding to this incident and have provided the required notifications to the data owners, and where appropriate, to the individuals affected by the incident and to various State Attorneys General.


text: As of the date of this annual report, this incident has not had a materially adverse impact on our results of operations. Though our response has not included material changes to our cyber risk management, strategy, or governance, we have taken or plan to take additional cybersecurity measures to continue to advance our cybersecurity policies, practices, and technology. We have incurred expenses, and may incur in the future expenses and losses, related to this incident. See also the risks included below the heading " Cybersecurity, Information Technology and Outsourced Services Related Risks " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to cybersecurity.


text: Our entire board of directors is responsible for the strategic leadership and direction of our cybersecurity program and has oversight over cybersecurity risks. Our management may provide periodic presentations to the board on our cybersecurity program, including updates on cybersecurity risks, strategy and incident management, as applicable. Our cybersecurity risk management is also administrated at a management level through a multi-disciplinary Technology Business Review Committee comprised of members of our operational and organizational management, as well as our outsourced Virtual Chief Information Officer. The Technology Business Review Committee is tasked with identifying and monitoring what we believe to be the key technology risks currently facing the Company, including cybersecurity risks. The committee meets on at least a quarterly basis and on an as-needed basis to address risks, regulatory requirements, potential threats, vulnerabilities, available mitigation strategies and technologies, operational imperatives and changes, and progress updates on relevant projects related to our IT and cybersecurity.


text: In addition, we undergo an annual IT risk assessment reviewed by a third-party IT vendor, with significant or actionable findings reported to the Technology Business Review Committee. The annual IT risk assessment identifies our risk status on various IT security metrics and prioritizes remediation, external vulnerability scan results, patching reports, dark web status, and personnel IT security training reports. This annual third-party review helps further monitor and inform our Technology Business Review Committee's work and our cybersecurity risk management and strategy.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Vado Corp.


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from our employees, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment, which also includes findings from our automated vulnerability scanning tools, are used to regularly update our security protocols, develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment. These updates and initiatives are then reported to our Board and members of management. While there is no documented process for cataloging all digital assets and data, all information is backed up and saved automatically in our Google Suite.


text: Incident Response and Recovery Planning: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident.


text: Third Party Risk Management: We have implemented a third party risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third party collaborators. Such collaborators are subject to security risk assessments at the time of onboarding and contract renewal, based on established cybersecurity standards that both parties review to ensure an industry-standard level of security is achieved. However, there is no periodic review process in place for assessing vendor compliance with our cybersecurity standards. We use a variety of inputs in such risk assessments, including information supplied by collaborators in response to detailed questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party collaborators, as appropriate.


text: Education and Awareness: Our policies encourage each of our employees to contribute to our data security efforts. We provide comprehensive training resources, ensuring that each team member is equipped with the knowledge to protect our organization against cyber threats. However, the completion and understanding of this training is not mandatory for all employees. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. In this regard, the Company has implemented policies and procedures for all employees including: (i) information security/cybersecurity policies, which are internally available for all employees, (ii) information security/cybersecurity awareness training; (iii) a clear escalation process which employees can follow in the event an employee notices something suspicious; and (iv) ensuring that information security/cybersecurity is part of the employee performance evaluation and/or disciplinary process.


text: Cybersecurity Risk Management and Strategy The Company does not have its own cybersecurity policy but relies on the policies and procedures of its Contract Research Organizations (CROs) and Software as a Service (SaaS) contractors that handle its data and software. We are committed to protecting the confidentiality, integrity, and availability of our information assets and complying with applicable laws and regulations regarding cybersecurity.

companyName: Mitesco, Inc.

ticker: MITI


text: Cybersecurity Risks and Incidents The Company faces various cybersecurity risks and threats that could potentially affect its operations, reputation, financial condition, and competitive position. These risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our data, systems, or networks; denial of service attacks; malware infections; phishing or social engineering attacks; ransomware attacks; loss or theft of devices or media containing our data; human error or negligence; natural disasters; power outages; or sabotage. Our data and systems may also be subject to cybersecurity breaches or incidents at its CROs, vendors, partners, or other third parties that we interact with or rely on.


text: We have not experienced any material cybersecurity breaches or incidents to date, but we cannot guarantee that we will not suffer any such breaches or incidents in the future. We may not be able to detect, prevent, or respond to all cybersecurity risks and threats in a timely or effective manner. We may also incur significant costs and liabilities as a result of any cybersecurity breaches or incidents, such as legal claims, regulatory fines, remediation expenses, reputational damage, loss of business opportunities, or competitive disadvantage. We may also face litigation, investigations, or enforcement actions by governmental authorities, customers, shareholders, or other parties arising from any cybersecurity breaches or incidents.


text: Cybersecurity Policies and Procedures The Company does not have its own cybersecurity policy, but it contracts with CROs that handle all of its data and software. Our CRO's data systems are 21 CFR 11 (Part 11) compliant, which means that they have implemented controls to ensure the reliability and integrity of electronic records and signatures. Our CRO also runs industry standard antivirus and antimalware software on their networks and have written procedures for cybersecurity management, incident response, backup and recovery, and employee training. We have reviewed the cybersecurity policies and procedures of our CRO and require them to report any cybersecurity breaches or incidents that may affect our data or systems.


text: All of the software that we use is Commercial Off the Shelf Software (COTS) and Microsoft, Dropbox, and Google cloud services. We do not develop, modify, or customize any software for our own use. We rely on the cybersecurity measures and practices of our software and cloud service providers and update our software and systems regularly to address any known vulnerabilities or issues. We also limit the access and use of our software and cloud services to authorized personnel and encourage them to use strong passwords and multifactor authentication. We do not store any sensitive or confidential data on our own devices or media, but use password-protected cloud storage.


text: Cybersecurity Oversight and Governance The Company's management is responsible for overseeing and managing our cybersecurity risks and activities as part of its overall risk assessment portfolio. Our management regularly evaluates and reviews the Company's cybersecurity posture and performance and reports to the board of directors on any material cybersecurity matters or developments. Our management also coordinates with our CROs, vendors, partners, and other third parties to ensure that they comply with our cybersecurity expectations and requirements and to address any cybersecurity issues or concerns that may arise.


text: The Company's board of directors is responsible for overseeing and approving our cybersecurity strategy and policies. Our board of directors receives updates from management on the Company's cybersecurity status and initiatives and provides guidance and feedback on the cybersecurity goals and objectives. Our board of directors also monitors the Company's cybersecurity risks and exposures and ensures that the company has adequate cybersecurity resources and capabilities to protect its data and systems.


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assessed our cybersecurity risk based on the Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: Risk assessments are designed to help identify material cybersecurity risks to our critical systems and information.


text: A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents.


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. Cybersecurity awareness training of our employees, including our incident response personnel. A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Company's Chief Executive Officer and Chief Financial Officer, whom oversee management's implementation of our cybersecurity risk management program and incident response plans.