text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Our board of directors oversees our risk management program, including the management of cybersecurity threats as part of its general oversight function. Our Audit Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program and receives reports from management concerning our cybersecurity risk management program.

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, finance, legal, human resources, among others. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our IT department have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware, software and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Our information security function, led by our Director of Information Technology, helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. Our Director of Information Technology helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, monitoring provided by a third-party security operations center, deploying manual and third-party service provider automated tools in certain environments, subscribing to reports and services that identify cybersecurity threats (and analyzing such reports), conducting scans of certain environments, evaluating our industry's risk profile and threats reported to us, conducting internal audits and threat assessments for certain threats, conducting vulnerability assessments using third-party tools to identify vulnerabilities, engaging third parties to conduct threat assessments, using external intelligence feeds and monitoring the dark web.


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data including, for example: incident response plans and policies; vulnerability management policy; disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls and data segregation for certain systems; access controls; physical security controls; asset management, tracking, and disposal; systems monitoring for certain systems; employee training; penetration testing of certain environments and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our Director of Information Technology works with management to help mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, forensic investigators and endpoint detection and response vendors.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may utilize various vendor management processes that may include reviews of security assessments or certifications and contractual measures.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties we rely on, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: We also have a Corporate Information Security Steering Committee ("CISSC"), which includes several members of senior management, including the Chief Financial Officer ("CFO") and General Counsel. The CISSC oversees corporate information security initiatives and the Company's responses to cybersecurity incidents, and reports to the board of directors on certain of the Company's corporate security programs and investments.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, Gio Hernandez, who has over 15 years of experience in information security. Mr. Hernandez reports to our CFO, Rodney Young, who has approximately 20 years of experience supervising the information technology function.


text: Mr. Hernandez is responsible for hiring appropriate personnel, helping to develop the Company's cybersecurity risk management strategy and communicating key priorities to relevant personnel. Mr. Hernandez is also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Mr. Young is responsible for approving cybersecurity-related budgets.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our CFO and Chief Executive Officer. Senior management through the CISSC works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal and financial data regarding our crew members and farmers, which we collectively refer to as "Information Systems and Data."

companyName: Vital Farms, Inc.

ticker: VITL


text: Our Information Technology department, under the leadership of our Vice President of Information Technology ("VP of IT") and with cross-functional internal and third-party support, helps identify, assess and manage the Company's cybersecurity threats and risks. The Information Technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the risk profile of the Company and its industry using various methods, including regular threat assessments (including through interaction with law enforcement), internal and external audits, threat environment scans and third-party threat assessments, vulnerability assessments, external intelligence feeds and third-party-conducted tabletop training exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a written incident response plan and incident response policy, business continuity plans, data encryption for certain data, implementation of certain security standards, network security and access controls, data segregation, asset tracking/disposal systems, penetration testing and required crew member training programs.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Information Technology department and third-party providers work with our senior leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior leadership team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our Board of Directors ("Audit Committee"), which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, penetration testing providers, dark web monitoring services, cybersecurity consultants, forensic investigators, training platforms and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, supply chain resources (including warehousing and cold storage) and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes, for example, completion of a cybersecurity questionnaire, internal reviews of vendor security programs and assessments, security assessment calls with vendor personnel and imposition of information security obligations in our vendor contracts. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the section titled "Risks Related to Information Technology and Intellectual Property."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible under its committee charter for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, with the oversight of our Chief Financial Officer. Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Our VP of IT, in consultation with our Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our VP of IT has nearly 25 years of relevant experience, including leadership roles in the information technology departments of public and private companies. Prior to joining the Company, he served as VP of IT for another public company in the consumer packaged goods industry.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our internal disclosure committee and our senior leadership team. Senior leadership team members work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan provides for reporting of certain cybersecurity incidents to the Audit Committee.


text: The Audit Committee receives regular reports from our Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, requires certain covered entities to report a covered incident to the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency ("CISA") within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: The SEC adopted a new rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies in 2023, which applies to all public companies subject to the reporting requirements of the Securities Exchange Act of 1934 and requires disclosure of material cybersecurity incidents in Current Reports on Form 8-K and periodic disclosure of cybersecurity risk management, strategy, and governance in annual reports in Annual Reports on Form 10-K.


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations and many states have recently implemented or modified their data breach notification and data privacy requirements. The Company expects this trend of state-level cybersecurity regulatory activity to continue, and continues to monitor these developments.


text: In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank's systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors." See also the Company's disclosures regarding risk management, strategy, governance and incident disclosure under Item 1C.


text: Cybersecurity Risk Strategy and Management Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology ("NIST") cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business impact, threat context and vulnerability severity.


text: Business email compromise ("BEC") continues to be a top threat for cybersecurity risk leading to potential financial loss, data breach or further information systems compromise. Variants and combinations of BEC, including phishing, spear phishing, "adversary in the middle" attacks (i.e., attacks that allow interception of network communications) and, in particular, "zero-day" attacks (i.e., attacks that exploit a previously unknown vulnerability), present a financial, data loss and business continuity risk. The risk of these attacks exists within the Company, within our customer partners and within our vendor partners in the supply chain. BEC prevention is a top focus in our risk-based cyber-resiliency strategy. In addition to BEC, potential vulnerabilities could exist in business systems and associated infrastructure and are mitigated via protocol for managing update "patches"; this protocol is sometimes limited based on the era of legacy systems.


text: Superior engages cybersecurity partners and consultants to help strengthen its cyber-resiliency program. These engagements include but are not limited to incident response ("IR") planning and IR retainers, penetration testing, vulnerability assessments, IR plan testing, and advisement and awareness of latest threat vectors.


text: All of the Company's global suppliers must comply with its Supplier Code of Conduct ("SCOC"). The SCOC contains certain data security and notification requirements, and the Company explicitly maintains the right to monitor and audit compliance with the SCOC.


text: Cybersecurity Governance The Board of Directors maintains overall oversight of cybersecurity risk, and the Audit Committee provides direct oversight of the Company's activities to prevent, detect and respond to cybersecurity threats. The Chief Information Officer ("CIO") and a designated system security engineer are the primary responsible management parties to monitor, assess, and manage cybersecurity risk. Our CIO has led global IT organizations for over ten years with direct oversight responsibility for cybersecurity, the global IT landscape and its data integrity. Our security engineer is solely focused on monitoring, assessing, and managing Superior's cybersecurity breach prevention, detection and management, including the ongoing cybersecurity risk education of our employee base. Our security engineer's experience includes the design and implementation of IT security systems, tools, and processes, comprehensive security assessments, and the implementation of remediating action plans for detected weaknesses.


text: Risk is monitored and managed through a combination of vulnerability assessments, continuous monitoring, endpoint protection, incident response planning, security awareness training, regulatory compliance monitoring, and threat intelligence.


text: Utilizing the NIST cybersecurity framework, the CIO provides quarterly updates to the Audit Committee on cybersecurity risk management, including the Company's latest risk assessment, action plan status and metrics. The Audit Committee regularly briefs the full Board on these matters. In addition, the CIO provides an annual report to the Board on the Company's cybersecurity plan and key activities.


text: Management roles and responsibilities of Superior's cybersecurity incident management are defined within the Company's IR plan. The plan includes the formation of the Security Incident Response Team responsible for leading incident response. In the event of specific cybersecurity incidents, defined sub-teams are engaged, as necessary, to monitor the mitigation and remediation of cybersecurity incidents. These sub-teams are comprised of cross-functional experts including, but not limited to, legal, accounting, operational and IT leadership and relevant external counsel.


text: All incidents are prioritized and assessed for materiality. Cybersecurity incidents are reported to relevant stakeholders in accordance with the incident response plan. All notable cybersecurity incidents as well as the number of cybersecurity incidents are reported quarterly to the Board of Directors.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: Our cybersecurity risk management program is part of our overall enterprise risk management program and shares similar governance processes and reporting channels that apply across the enterprise risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management evaluation process for service providers, suppliers, and vendors with access to our information systems or data.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management is required to update the Committee, as necessary, regarding any material cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Financial and Business Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel who in turn manage our retained external cybersecurity consultants. Our management team's experience includes significant responsibility for developing and maintaining cybersecurity risk management programs and for managing cybersecurity risks prior to joining us.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal IT environment.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy and Disaster Recovery Plan (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy sets forth the role of the Information Security Committee in preparing, implementing, and maintaining incident response procedures in consultation with senior management of the Adviser and Administrator.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: Our Information Security Committee is responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. The Information Security Committee includes our Chief Financial Officer and Chief Compliance Officer. At times we may also engage assessors, consultants, or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of RGC who provide services to us pursuant to the Advisory Agreement and Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Committee as needed, but no less frequently than annually. On at least a quarterly basis, management and the Information Security Committee report to our Board of Directors on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks that are material to us.


text: Cyber Risk Management and Strategy As part of our enterprise risk management program, we have implemented and maintain policies and processes to identify and mitigate risks posed by cybersecurity threats. Our policies and processes are based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and we utilize technologies to help identify and manage potential cyber threats. We have also secured cyber-specific insurance coverage as part of our overall insurance portfolio.

companyName: Savara Inc

ticker: SVRA


text: We have engaged an independent, third-party services provider to assist in monitoring our information technology systems, as well as identifying, assessing, and mitigating the associated cyber risk. With that provider, we conduct periodic assessments of our information security program to evaluate the effectiveness of applicable security controls, which include penetration testing, vulnerability scanning, and red teaming. Our Chief Financial and Administrative Officer ("CF&AO") reviews the results of those assessments with our third-party provider to reasonably address any identified potential gaps. We also utilize a range of tools and services to help ensure material threats are prevented or the risks of such threats are mitigated, which include, network and endpoint monitoring, system patching, user and server backups, annual awareness training, and periodic vulnerability evaluation. Management reviews monthly monitoring reports and meets with our third-party provider on a regular basis to review activities and debrief on any key IT-related issues.


text: We have an employee education program that includes annual training designed to raise awareness of cybersecurity threats, and we require employees to review and acknowledge our IT Security Policy on an annual basis. Additionally, we have adopted an IT Incident Response Plan that outlines the procedures to be followed in response to a data breach, whether internal or through a third-party, that are designed to help contain, assess, and respond to the incident and mitigate potential harm.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse, or theft of information and other data, confidential information, or intellectual property. However, to date, these incidents have not had a material impact on our operations. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Risk Factors – Risks Related to Information Technology and Data Privacy.


text: Governance Related to Cybersecurity Risks The Audit Committee of our Board of Directors is responsible for the general oversight of risks related to data privacy and cybersecurity. The Audit Committee periodically reviews the Company's cybersecurity program with management, including (i) the adequacy of controls and security for the Company's information technology systems and (ii) the Company's response plan in the event of a security breach impacting those systems. Our CF&AO has primary responsibility for overseeing the day-to-day management of cybersecurity risks and has served in that role for three years. Our CF&AO oversees the policies and processes described above and provides the periodic management briefings to the Audit Committee, including any cybersecurity incidents and related responses. Further, at least annually, the Board of Directors receives updates of potential cybersecurity incidents, as well as the data privacy and compliance programs, and its members actively participate in discussions with management regarding cybersecurity risks.


text: Risks Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IGM Biosciences, Inc.


text: We conduct annual risk assessments and perform as needed updates to our risk register to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Information Technology (IT), who is also our Senior Vice President (SVP) of Group Operations and reports to our Chief Financial Officer (CFO), to manage the risk assessment and mitigation process.


text: Index to Financial Statements As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Legal, Human Resources and IT. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and company-wide communications.


text: We engage an experienced cybersecurity consultant as our Interim Information Security Advisor who coordinates our risk assessment processes with our Cybersecurity Steering Committee. We engage an experienced service provider as our 24x7 network and security operations center, to assist us to design and implement our cybersecurity policies and procedures, and to monitor and test our safeguards.


text: We assess the ability of our key third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: One of the key functions of the Audit Committee of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Audit Committee is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.


text: Our SVP of Group Operations and our Cybersecurity Steering Committee, which includes our Chief Medical Officer, SVP-Corporate Controller, Executive Vice President of Process Development and Manufacturing, SVP of Preclinical Sciences, and our SVP of Legal Affairs, are primarily responsible for assessing and managing our material risks from cybersecurity threats. As part of our risk identification, assessment, and mitigation activities, we leverage the experience of our external cybersecurity advisor/consultant (CISSP, CISA, CISM, CRISC, QSA) who has extensive cybersecurity expertise across various industries. Our SVP of Group Operations, who manages our cybersecurity program, has over 25 years of experience in the Life-Sciences IT space, with over 8 years in IT security and cybersecurity functions.


text: Our SVP of Group Operations, in collaboration with our Cybersecurity Steering Committee, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our SVP of Group Operations is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through oversight of the external consultant and the IT department, which includes oversight of a combination of automated technologies and manual responses to detect, respond and recover from any cybersecurity incident, as well as oversight of the 24x7 network and security operations center. Our SVP of Group Operations is responsible for informing our executive leadership and our Audit Committee about confirmed cybersecurity incidents, and for providing regular updates to senior executive management, including our CFO, concerning our IT and cybersecurity posture.


text: Our SVP of Group Operations provides quarterly briefings to the audit committee and our executive management regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Management of Cybersecurity Risks and Cybersecurity Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: Our cybersecurity program shares common methodologies, reporting channels and governance processes as the risk management programs of other departments within our company, including the legal, compliance, strategic, operational, and financial departments.


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • ad hoc internal review of the cybersecurity practices of service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third party research institution collaborators, CROs, CDMOs, or other contractors or consultants, may fail or suffer cyberattacks or security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity program.


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Director of Infrastructure and Cybersecurity, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Director of Infrastructure and Cybersecurity, Senior Vice President of Business Technology, and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes demonstrated expertise in cybersecurity, life sciences, and security industry certifications such as CISM and CISSP.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make proactive and strategic investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are imbedded into our overall risk management governance and are reviewed at least annually by the Audit Committee of our Board of Directors.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Risk Management and Strategy We've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have engaged consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our information security policy is based on recognized industry standards and cover areas such as risk management, data backup, and data recovery. We engage consultants and IT managed service providers (IT MSP), to help us design and implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities and responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee. We conduct cybersecurity penetration testing as warranted to identify and remediate cybersecurity gaps.


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our current IT consultants and IT MSP, who report to our interim Chief Financial Officer, to manage the risk assessment and mitigation process. Our interim Chief Financial Officer has served in various capacities in enterprise risk management and cybersecurity over five years, including serving as our Data Security Coordinator for the past two years, during which he has overseen our risk management process.


text: We evaluate each third-party service provider to verify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect the Company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.


text: Our interim Chief Financial Officer periodically meets with our IT consultants and IT MSP about the Company's ongoing compliance and risk management and provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, to date, we are not aware of any cybersecurity threats that have materially affected our business. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important function of our enterprise risk management program. Material cybersecurity risks from cybersecurity threats are managed across Medallion Financial Corp., the Bank, Medallion Capital, and third-party vendors and monitoring such risks and threats involves coordination between us as the parent company and our two main operating subsidiaries. We continue to integrate our cybersecurity programs into our enterprise risk management program, which is led by various senior representatives of the Company and overseen by the Audit Committee of the Company's Board of Directors.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: Medallion Financial Corp., the Bank and Medallion Capital are each responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been guided by the National Institute of Standards and Technology Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable, and seek to protect each entity against cybersecurity risks and provide a foundation to respond promptly to cybersecurity events. Each entity maintains technical and organizational safeguards, including, among other things, employee testing and training, incident response programs and tabletop exercises, evaluations and assessments by third parties, vulnerability scanning, vendor management, cybersecurity insurance, and business continuity mechanisms for the protection of Company assets. Our programs also assess and manage third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third-party service providers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, and we currently do not expect that risks from cybersecurity threats are reasonably likely to materially affect us, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is responsible for overseeing the Company's enterprise risk management program, including overseeing the adequacy of protection of the Company's technology, including physical security, patent and trademark program, proprietary information, and information security. The Audit Committee receives quarterly reports from our Information Security Director and third parties on cybersecurity matters. In addition, the Audit Committee receives quarterly reports addressing cybersecurity as part of our enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. These reports include, among other things, existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents, if any, and the status of key information security initiatives. Our Audit Committee members also engage in ad hoc conversations with management on cybersecurity-related news and events, and discuss any updates, as needed, to our cybersecurity risk management and strategy programs.


text: Medallion Financial Corp. employs a Director of Information Security, and our main operating subsidiaries have similar functions and/or roles conducted by various individuals. Such information security leadership are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in information security and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and third-party vendors about, and monitor, the prevention, detection, mitigation and remediation efforts relating to any cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated from information security leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our Information Security Director and third parties as well as part of our enterprise risk management program.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage our risk assessment and mitigation processes, including our Vice President of Operations (VPO), who serves as our acting Chief Information Security Officer (CISO), as well as external information technology consultants who help manage our information technology systems and our information security.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology consultants. Employees at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage our information technology consultants, including dedicated on-site consultants as well as other third parties, in connection with our risk assessment processes. These partners assist us to help design, implement, monitor, and test our cybersecurity policies and procedures. We also require key third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors, which is responsible for monitoring and assessing strategic risk exposure, has delegated primary oversight responsibility for cybersecurity to our audit committee.


text: Our VPO and acting CISO, who reports to our President, is responsible for the day-to-day management of our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, with the assistance of and informed by our consultants. Our VPO and acting CISO, who has many years of senior management and operational oversight at emerging technology companies, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the day-to-day management of our information technology consultants, which includes engaging with information provided by the consultants, automated monitoring and detection systems, and other tools and processes defined by our cybersecurity policies.


text: Our VPO and acting CISO provides periodic briefings to our executive officers regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our VPO and acting CISO also provides periodic briefings to the board of directors, including the audit committee, on cybersecurity risks and activities.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cybersecurity threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity program component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Risk Committee of our board of directors.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: The program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF framework provides the basis to evaluate our program for completeness and helps to ensure that the various components of the program are at a level that reduces cybersecurity risk to levels within the Company's risk appetite, taking into account the current threat and regulatory environment. Key components of the cybersecurity program include: • A risk assessment process that identifies and prioritizes cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • An incident response plan that outlines establishes a structured approach for the Company's response to a cybersecurity incident. The incident response plan is coordinated through the CISO and key members of management are embedded into the plan by its design. The plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. • A training program that educates employees about cybersecurity risks and how to identify and escalate cybersecurity events. • A third-party risk management program designed to ensure that our key vendors meet our expectations on cybersecurity. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Company engages reputable third parties to conduct various risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe, and we may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on the Company. However, as of the date of this Form 10-K, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Board of Directors Oversight The Risk Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Risk Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews quarterly reports regarding the information security program and technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.


text: Management Oversight Our CISO is accountable for managing our enterprise information security department and overseeing our information security program. The CISO reports directly to the Chief Risk Officer. The CISO's responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The CISO has over 20 years of experience in cybersecurity across the U.S Government, Department of Defense contracting, and financial services industry. Prior to joining the Company, the CISO served as the Deputy CISO for a major domestic financial services institution. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to senior leadership and the Risk Committee and/or the Board in a timely manner.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.

companyName: MERRIMACK PHARMACEUTICALS INC


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers and hosting companies. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Significant disruptions of information technology systems or security breaches could adversely affect our business." Our board of directors addresses our cybersecurity risk management as part of its general oversight function.


text: Certain members of our management team are responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Commencing in 2024, our Nominating and Corporate Governance Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.


text: Risk Management and Strategy We regularly assess risks from information security threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information security policies, processes, and practices. To protect our information systems from threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information, and have adopted policies, management oversight, accountability structures and technology processes designed to safeguard this information. All our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the Silvercrest data and systems to which they have access. These trainings also remind employees how to report any potential privacy or data security issues.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of Silvercrest assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive Silvercrest data. We have implemented and maintain a written proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures to follow in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, and client data in the event of an emergency or natural disaster.


text: We work with third-party service providers that proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.


text: As of the date of this Annual Report on Form 10-K, information security threats have not materially affected and we believe are not reasonably likely to materially affect Silvercrest, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Operational risks, including the threat of cyber-attacks, may disrupt our business, breach our clients' security, result in losses or limit our growth" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on Silvercrest.


text: We have implemented and maintain a formal information security program, designed to develop, and maintain privacy and data security practices to protect Silvercrest assets and sensitive third-party information, including personal information. This program is governed by employees comprised of members of senior management, including our Chief Information Security Officer ("CISO"), who meet regularly and provide reports to the Board of Directors at least annually. The CISO oversees communications with the Board of Directors regarding material cybersecurity incidents and provides the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to Silvercrest's information security practices and procedures.


text: We take a risk-based approach to information security and have implemented policies throughout our operations that are designed to address threats and our response to actual or suspected incidents. In particular, the CISO is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If an information security incident occurs, Silvercrest will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate and assess the materiality of the nature, scope and timing of a given incident and whether public disclosure is required.


text: The CISO is responsible for leading the assessment and management of cybersecurity risks. The CISO provides reports to the Board of Directors as part of the updates discussed above and regularly communicates with other members of senior management regarding information security risks.


text: Risk Management and Strategy We have established a cybersecurity committee to oversee the implementation of policies and processes that are designed to protect against and respond to cybersecurity threats. Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained. These policies and procedures and the resulting safeguards are designed and evaluated in light of yearly risk assessments, which are based on guidance obtained from a recognized national standards organization. We have implemented access controls, firewalls and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes safeguard our information systems. We maintain an incident response plan and business continuity and disaster recovery plans designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when they are hired and periodically thereafter.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: We use third-party security firms in different capacities to provide or operate some of our safeguards and technology systems. For example, we use third party consultants to conduct assessments, such as vulnerability scans and penetration testing.


text: Our cybersecurity policies and processes also include risk-based measures and evaluations of risk related to third parties and, where appropriate, we require third parties to implement and maintain appropriate security measures, consistent with all applicable laws, and to promptly report any suspected breach of its security measures that may affect our company.


text: Our cybersecurity risk management and strategy processes are led by a team of senior level management, including our Chief Financial Officer, Vice President of Finance, Senior Vice President of Legal and General Counsel and Vice President of Quality. These individuals collectively have significant prior work experience in various roles involving managing information security and implementing effective information and cybersecurity programs. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As of the date of this Annual Report on Form 10-K, risks from cybersecurity threats, including from any previous incidents, have not materially affected our business, including our business strategy, results of operations, or financial condition. See Item 1A - "Risk Factors" for additional information regarding cyber threats and related risks to our business.


text: Our board of directors addresses the Company's risk management and strategy, including the management of cybersecurity threats, as part of its general oversight function, and our management is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.


text: At least quarterly, the Audit Committee receives a presentation from management members of our cybersecurity committee concerning our cybersecurity threat risk management and strategy processes, which is designed to cover such topics as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks and/or incidents, as well as the steps management has taken to respond to such risks and/or incidents.


text: Our cybersecurity risk management program includes: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Oncternal Therapeutics, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer cyberattacks or other security breaches, which could have a material adverse effect on our business, results of operation, and financial condition, and result in a material disruption of our product development programs."


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of IT or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer, General Counsel, and Head of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel. Our management team's experience includes a Head of IT with over 30 years' experience leading the IT and cybersecurity functions for companies similar to ours.


text: Our management team supervises efforts to identify, protect, detect, respond and recover cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have certain processes and policies in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program, and are integrated into our overall risk management program.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: We have an Information Technology Policy that sets parameters for the use, privacy, security, retention, and disposal of our information and other assets. We also have an Incident Response Policy which sets forth the steps for assessment, containment, and disclosure of cybersecurity threats. These policies were prepared using relevant guidance and technology standards and are reviewed periodically.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity risk program and have assessed it against the National Institute of Standards and Technology ("NIST") cybersecurity framework. In addition, we consider the internal risk oversight programs of third-party service providers with whom we engage in order to help protect us from any related cybersecurity vulnerabilities.


text: Under our cybersecurity risk program, we provide all of our employees with periodic cybersecurity training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.


text: Although we are subject to cybersecurity risks, to date, none have materially affected our company, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity risk program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our company. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Our board of directors oversees our risk management process directly and through its committees. The audit committee of our board of directors has the power and responsibility to coordinate our board's oversight over our risk management procedures and to discuss with our management our policies with respect to risk assessment and risk management. Our board of directors has delegated to its audit committee oversight authority of our information security (including cybersecurity) risk management.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Poseida Therapeutics, Inc.


text: Our Enterprise Risk Management Committee, together with the company's security and legal teams as well as third party service providers, help identify, assess and manage the Company's cybersecurity threats and risks. Additionally, the Enterprise Risk Management Committee, the security team, the legal teams and the Company's third party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting assessments of controls, conducting threat and vulnerability assessments, and engaging in simulated penetration testing and tabletop incident response exercises organized by third-party specialists.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining incident response plans and policies, conducting periodic risk assessments, implementing security standards and certifications, encrypting data, maintaining network security controls, segregating data, maintaining physical security controls, system and data monitoring tools, periodic employee security training and simulation testing, penetration testing, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Our cybersecurity risk management framework is based on the National Institute of Standards and Technology's Guide for Conducting Risk Assessments. For example, cybersecurity risks are assessed upon pre-defined matrices of probability and potential impact. Such risks are then recorded within an enterprise risk register along with risk treatment plans for approval from the Enterprise Risk Management Committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, including legal counsel, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under General Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; a material disruption of our product candidates' development programs; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Vice President of IT, Director of IT Operations, and General Counsel.


text: Our Vice President of IT and Director of IT Operations are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes and policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our Security team and General Counsel work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes and policy include reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from the Enterprise Risk Management Committee and the Vice President of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: GlobalX's Audit Committee, comprising board members and senior management from various departments including IT, operations, legal, risk management, and others, diligently engage in regular cybersecurity risk assessments. These comprehensive assessments are designed to proactively identify potential threats, vulnerabilities, and risks that could impact the integrity and security of the company's airline systems, data infrastructure, and operational continuity. Evaluations span critical areas such as safeguarding flight systems, protecting passenger data, and mitigating operational disruptions.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Moreover, the GlobalX Audit Committee remains committed to providing timely updates and detailed reports, offering insights into the airline's cybersecurity posture, ongoing initiatives, prevalent incident trends, and active remediation efforts. These reports are meticulously crafted, incorporating key metrics, performance indicators, and actionable recommendations aimed at continual enhancement.


text: The committee vested with cybersecurity oversight consistently conducts periodic reviews of GlobalX's cybersecurity policies, procedures, and controls. These reviews are pivotal in ensuring the ongoing effectiveness of the company's cybersecurity framework and its alignment with emerging threats and evolving industry best practices. Regular updates are meticulously implemented to fortify the company's cybersecurity resilience in response to emerging risks and evolving regulatory requirements.


text: As of December 31, 2022, and 2023, GlobalX remains proud to report that it has not encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include various security controls, enforcement of company policies, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and other industry-recognized standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.

companyName: Daseke, Inc.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology (IT) environment; • a security team, led by our Senior Vice President that oversees IT (our SVP IT), principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - The Company is dependent on computer and communications systems, and a systems failure, cyber-attack or data breach could cause a significant disruption to its business and cause financial losses."


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee, which reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our SVP IT provides periodic presentations to the Audit Committee on cybersecurity risks. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. Three of the members of our Audit Committee have significant expertise in various aspects of cybersecurity programs.


text: Our SVP IT, in coordination with the Company's executive team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the SVP IT oversees the monitoring, prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the Board when appropriate. Our SVP IT has twenty years of experience in the IT field, including managing risks arising from cybersecurity threats. The SVP IT is supported by a staff of IT professionals. Also supporting our SVP IT in assessing and managing the Company's material risks from cybersecurity threats are the Company's COO, CFO, and General Counsel, each of whom have over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Company's Board of Directors (the "Board") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of its systems and the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect Company systems and sensitive data. This defense model is composed of a variety of different components including administrative, technical controls and safeguards. These various components are centrally managed and monitored creating a multi-layered, interlocking, cybersecurity defense system. We believe this defense system is dynamic and designed to adjust to protect against the latest cyber threats and attack vectors.