text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

secItem: Item 1C


text: Our Vice President and Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Prior to his approximately 14 years overseeing and securing our information technology operations, our Vice President and Director of Information Technology held various roles during his approximately 9 years of tenure at USI New England, most recently overseeing and securing their information technology operations as Regional IT Manager. This experience is reinforced with regular cybersecurity training from industry leading organizations such as the SANS Institute and ISC2.


text: In an effort to protect our resources from cyber threats, we maintain a security program that includes multiple layers designed to prevent, mitigate, detect, defend against, and remediate these threats. These include, but are not limited to, continuous vulnerability assessment and remediation, annual penetration testing conducted by a third party, security and monitoring tools that are monitored by a 24x7 SOC (Security Operations Center) and Incident Response Planning. Additionally, all employees are required to take annual cyber security training that aligns with our risks and current cyber trends such as ransomware, BEC (business email compromise,) phishing, and social engineering.


text: Cybersecurity Risk Management and Strategy We rely on computer, information, network, and communication technology and related systems to operate our business and to protect confidential, restricted, and sensitive company, customer, and partner information. We have a multi-layered cybersecurity risk management program designed to identify risks related to the organization's digital and physical assets, review and assess existing security measures, and implement and manage solutions to mitigate cyber risks. These solutions are designed to protect our facilities, our systems, our partners, our customers, and our financial data in case we experience a cyber incident. Protection includes phishing detection, social engineering, executive targeting, brand impersonation, configuration mistakes, sensitive data leakage, leaked credentials, malicious attacks, third-party risks, vulnerabilities, insider threats (both intentional and unintentional), and password attacks. This type of ongoing vulnerability risk management is crucial as the organization and the external threat landscape evolves. This cybersecurity risk management program is incorporated as part of the Primoris Enterprise Risk Management Program.

companyName: Primoris Services Corp

ticker: PRIM


text: Our cybersecurity policies and processes are based on the controls within the National Institute of Standards and Technology ("NIST") Framework, and we engage a number of external parties to enhance our cybersecurity oversight. For example, every other year, a third-party consulting firm performs an assessment of our cyber program, measuring our program against the NIST controls with a Capability Maturity Model Integration overlay to determine the program's maturity. The assessment findings are disclosed to the Audit Committee of the Board of Directors and our cross-functional management Security Steering Committee ("SSC"). Any improvements resulting from the assessment are identified, along with action plans. We also use a third party to perform an annual Breach Assessment targeting our external and internal network environment to determine the strengths and any weaknesses within our cybersecurity processes. As part of the Breach Assessment, our Incident Response Plan is instigated and reviewed to ensure it remains current and effective for all situations. We also have multiple third-party managed Security Operations Centers ("SOC") in place; including a SOC for logging and monitoring of security events; a SOC for endpoint managed detection and response, including identity protection; a SOC for executive digital and brand protection; and a SOC for protection of network credentials.


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of vendors and other third-party service providers, we conduct continuous passive scanning of the Primoris network, as well as Primoris vendors' external perimeter, on a regular basis to assess any potential vulnerabilities and weaknesses.


text: We face certain ongoing risks from cybersecurity threats that, if realized, could materially affect us, including our business operations, results of operations or financial condition.


text: Cybersecurity Governance and Oversight The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and governance. We also maintain a cross-functional management Security Steering Committee ("SSC"), with members consisting of executive leadership, internal audit, and enterprise risk. The SSC meets quarterly and has a formal charter outlining its responsibility to provide oversite of our comprehensive cybersecurity program. The Audit Committee of the Board of Directors is briefed quarterly by the Chief Information Officer ("CIO") on the cybersecurity program, and both the Audit Committee and SSC are notified between such updates regarding significant new cybersecurity threats or incidents. The full Board of Directors also receives regular reports from the Audit Committee.


text: The CIO chairs the SSC and oversees Primoris' cybersecurity risk management program. The CIO is supported by the head of cybersecurity, who is a direct report to the CIO. The training and experience of the head of cybersecurity includes a Harvard MBA along with professional experiences involving Forensics and Investigation, NIST controls assessments and implementation, ISO 27001 assessments and implementation, Payment Card Industry Certification, and HITRUST implementation and certification. The head of cybersecurity and the security team are responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and work across the organization to assess and prepare Primoris to address cybersecurity risks. Our head of cybersecurity and the security team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to our Incident Response Plan.


text: Our employees are also an important part of protecting our digital and technical environment. A key area of the cybersecurity program is the education of employees regarding cybersecurity using security awareness training, security bulletins and phishing simulations to reinforce training on a quarterly basis. Security awareness training covers all network users. On an annual basis an Acceptable Use Policy ("AUP") is distributed to employees through our Learning Management System for understanding and acknowledgement. Additionally, all new employees are provided the AUP by Human Resources and receive initial security training upon being granted access to our network.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including, but not limited to, financial, operational, regulatory, reputational, and legal risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer and Chief Technology Officer are primarily responsible for this cybersecurity component. The Chief Technology Officer is responsible for the first line of defense and has assembled a capable team of professionals with expertise in cybersecurity. The Chief Information Security Officer is a key member of the Risk Management organization, reporting directly to the Chief Risk Management Officer and, as discussed below, provides updates to the Audit & Risk Committee of our Board of Directors.

companyName: National Bank Holdings Corp

ticker: NBHC


text: The Company's cybersecurity risk management program is designed to ensure the Company's data, information systems, networks and devices are appropriately protected from a variety of threats and that our third parties with access to the Company's data take similar precautions. Regular risk assessments are conducted to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity and value. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.


text: Layered security controls monitoring traffic to and within the Company that identify and block suspicious activity, with system configurations that align with industry best practices. Preventative and detective controls to identify adverse internal and external trends and analyze the Company's response mechanisms.


text: Annual network and penetration testing by reputable third-parties to evaluate the Company's suite of security controls and tools, and identify potential vulnerabilities. Regular cybersecurity and information security awareness training for associates, supplemented with recurring social engineering tests.


text: Recurring audit and oversight of all critical third-parties within the Company's digital ecosystem to identify risks and adverse trends. Our third-party risk management program is designed to ensure that our third-party providers meet our cybersecurity requirements. This includes conducting periodic risk assessments of our third-party providers requiring them to implement appropriate cybersecurity controls and monitoring third-party compliance with our cybersecurity requirements. Annual evaluation of the Company's cybersecurity insurance program, with coverage levels benchmarked against industry peers. Use of external subject matter experts to provide threat intelligence and updates on trends and emerging schemes.


text: Annual risk and self-assessments against established industry frameworks to ensure best practices are in place and the Company's risk assessment continues to evolve.


text: Annual testing from a business continuity perspective, including annual business impact analysis reviews, annual testing of all critical departments, systems and third-parties, and established back-up, replication, and restoration to help ensure continuity of operations.


text: Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company's business, financial condition, and results of operations. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cybersecurity breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: The Enterprise Technology group, in conjunction with the Enterprise Risk Management department, and most specifically within that group, the Chief Information Security Officer, are responsible for implementing and maintaining the Company's cybersecurity risk management program. The Enterprise Technology group includes cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Individuals within these departments are subject to professional education and certification requirements. As a governance and oversight function, the Enterprise Risk Management department measures and reports on the quality of information and cyber risk management across all functions of the Company. Cybersecurity risk is reported by both the Enterprise Risk Management and Enterprise Technology departments through monthly cybersecurity meetings with executive management and quarterly Enterprise Risk Management Committee meetings.


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's Risk Management program and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's Risk Management program, including oversight of cybersecurity risk and risk management, to the Audit & Risk Committee of the Board. The Audit & Risk Committee receives regular updates on the cybersecurity program, including cybersecurity risks and incidents through direct interaction with the Chief Technology Officer, the Chief Information Security Officer and the Chief Risk Management Officer. Additionally, the Board of Directors also receives periodic updates regarding cybersecurity risks and the cybersecurity program, as well as training at least annually on the Director's role in managing cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, at least annually and more frequently as necessary due to business changes or external changes, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: maintain a risk register and risk assessment process based on The National Institute of Standards and Technology ("NIST") Cybersecurity Framework; use various third-party software testing products and services designed to test and assess the security of our software; closely monitor emerging data protection laws and implement changes to our processes designed to comply with such laws; undertake an annual review of our policies and statements related to cybersecurity;


text: proactively inform our customers of substantive changes related to customer data handling through disclosures in our SOC 2 Type 2 report or other contractually mandated disclosures; conduct annual cybersecurity training for employees and contractors with access to PDF systems and sensitive data; conduct incident management training and practice for individuals with responsibilities responding to a cyber incident;


text: conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; use findings and root cause analysis of cybersecurity incidents to improve our cybersecurity processes and technologies;


text: maintain technologies designed to provide network and endpoint monitoring, regular vulnerability assessments, and annual penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident;


text: maintain an employee handbook, Code of Conduct, and Acceptable Use policy that makes clear the importance of cybersecurity and protection of PDF and customer intellectual property; and our incident response policy and plan specify the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage. We regularly exercise and update the plan after actual incident responses or simulated incident response scenarios.


text: We subscribe to several external independent monitoring services to score and assess our externally facing network and information services and we engage a third-party security firm at least annually to conduct external and web penetration testing exercises on our corporate network and our commercial SaaS service platform.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or to our systems. Third-party risks are included within our broader overall risk assessment and management process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers during vendor onboarding and during periodic reviews. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and regularly monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or independent information security assessments or certifications. Additionally, we have processes designed to monitor public and federal government database and other sources for evidence of known and/or exploited vulnerabilities in third-party services including those provided as SaaS and we take action to remediate or establish compensating controls if those systems are determined to be critical to our cybersecurity. We also maintain disaster recovery plans in place for all mission critical parts of the business, although we do not have a business continuity plan developed to account for all continuity risks.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "We are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incidents." and "Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. For more than 5 years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors, who views our focus in these areas as essential for the success of our company and the broader technology industry in which we operate. As described in the Audit Committee Charter of the Board of Directors, the Audit Committee is tasked with oversight of certain risk issues, including cybersecurity. The Audit Committee is comprised entirely of independent directors, two of whom have significant work experience related to information security issues or oversight. Management reports high severity security incidents to the Audit Committee after they are discovered. Additionally, management provides a summary four times per year of all security incidents to the Audit Committee. The full Board of Directors is also provided an annual assessment of our security program, our internal response preparedness, and assessments led by outside assessors and auditors.


text: Our Audit Committee is regularly involved in reviewing cybersecurity risk management. At least quarterly, the Vice President of Operations presents and reviews key security metrics with the Audit Committee including a review of cyber-security events, cybersecurity initiatives and new or developing cybersecurity risks relevant to the business. The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks. Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and data security processes and business policies impacting our overall cybersecurity risk.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Operations and a cross section of subject matter experts from Information Technology, Exensio Cloud Operations and Corporate Legal and team. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, data privacy risks and regulatory frameworks, developing cybersecurity strategy, implementing effective information and cybersecurity programs and experience in security controls testing and the planning and executing of independent cybersecurity assessments.


text: Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable. Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Data Security.


text: The Vice President of Operations and Executive Vice President of Products and Solutions are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above including the incident response.


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology ("IT") systems is important to our operations and business strategy. To this end, we have documented cybersecurity policies and standards and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we use processes and tools to conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. He, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us, and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks there is the potential for us to be adversely affected. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or breaches of data security could adversely affect our business."


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates from time to time from our management as appropriate on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 35 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 26 years of information technology experience with a focus on information technology forensics.


text: Network and information systems and other technologies play an important role in our business activities. We also obtain certain confidential, proprietary and personal information about our charterers, personnel, and vendors. To protect our data, we have employed cybersecurity protocols which are designed to work in tandem with internal controls to safeguard our information technology environment. Our information technology infrastructure is designed with commercial flexibility, data integrity, and safety in mind. We utilize a layered approach of systems and policies intended to provide a secure operating environment and promote business continuity. Our hardware and software systems are equipped with technology intended to offer access and intrusion protection, software and communications systems protections, and mitigate cybersecurity threats.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information maintained in them.


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: The Company also maintains a cyber liability insurance policy. See Item 1 – "Business – Insurance – Cyber Liability Insurance" in this report.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.


text: Risk Management and Strategy Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on a multidisciplinary team, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, and conducting threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation," for additional discussion about cybersecurity-related risks.


text: Our board of directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The audit committee of the board of directors oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The audit committee engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Our management, represented by our Chief Operating Officer, Catherine Hastings, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Ms. Hastings is an experienced risk management professional, having previously served as our Chief Financial Officer and Treasurer from 2017 until March 2023, and as Vice President, internal audit of BioMed Realty Trust, Inc. (formerly NYSE: BMR) until December 2016, having joined BioMed Realty in 2009. Ms. Hastings currently oversees key functions for our development, asset management, human resources and information technology functions, including cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2016, we have retained a third-party information technology specialist to develop and maintain our information technology infrastructure and network, who has extensive experience in the development of business processes, system infrastructure design and cybersecurity for large-scale, institutional real estate companies.


text: Management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including reporting to the audit committee for certain cybersecurity incidents. Our management team also evaluates the potential impact of cybersecurity incidents to determine materiality. This evaluation considers factors such as the nature and scope of the incident, and its effects on operations, assets, or reputation. The audit committee holds quarterly meetings and receives periodic reports from management, including our Chief Operating Officer and third-party information technology expert, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.


text: We use various tools and methodologies, including third-party services, to assess, identify, and manage cybersecurity threats. For example, we utilize third-party services to monitor the security and integrity of our information systems and the other third-party information systems upon which we rely on an ongoing basis. We also engage a third-party cybersecurity auditor for regular penetration and vulnerability testing and assessment of our processes. Our information technology department oversees cybersecurity risk management and reports significant incidents to management. We consult with our advisors as appropriate, including on materiality analysis and disclosure matters, and management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Solid Power, Inc.

ticker: SLDP


text: The Board has delegated primary responsibility for oversight of our cybersecurity risk exposures to the Audit Committee, and the Audit Committee receives routine updates on cybersecurity matters from management. Our Chief Financial Officer, Mr. Paprzycki, oversees our information technology department and has helped to develop our information systems and processes. Our information technology department works closely with Mr. Paprzycki and other members of management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but we cannot guarantee that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information, see "Part I, Item A. Risk Factors—Risks Related to Legal and Regulatory Compliance—We may be adversely impacted by a disruption or failure of our information technology infrastructure, data security breach, or failure to comply with privacy laws."


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business are identified and addressed through a multi-faceted approach that consists of third-party assessments, testing of our information systems and information technology security. To defend against, detect and respond to cybersecurity incidents, we, among other things: have enabled regular monitoring of our environment by a combination of external partners and internal security tools, conduct employee trainings, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: uniQure N.V.

ticker: QURE


text: Consistent with our cybersecurity risk management policies and controls, we have prepared an incident response plan with several components, including: (i) engagement of a third party security operations center for regular vulnerability scanning and technical monitoring of our systems, (ii) detection and analysis of cybersecurity incidents that present risk of unauthorized access to company assets, including the escalation and triaging of incidents that present acute risks to our business, (iii) containment, eradication and data recovery, and (iv) post-incident analysis. Such incident responses are overseen by leaders from our information technology, finance, legal and compliance teams.


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response plan and related policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Our team of cybersecurity professionals then collaborate with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies. As part of the above processes, we regularly engage external consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and status on key information security initiatives.


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For a discussion of cybersecurity risks applicable to us, see Part I, Item 1A, Risk Factors, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs" in this Annual Report on Form 10-K.


text: Risk Management and Strategy Our Board of Directors and management team recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our cybersecurity risks are considered individually as part of our enterprise risk management program alongside other risks, and prioritized and discussed with our Board of Directors.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Our internal Security Operations Center ("SOC") has primary responsibility for assessing, identifying, and managing material risks associated with cybersecurity threats, and provides information security monitoring for both shoreside and shipboard information systems and applications. The SOC is a team comprised of cybersecurity professionals who are responsible for real-time incident response management for our IT infrastructure, which includes our websites, applications, databases, servers, network devices and components and workstations. They are trained and equipped to identify, contain, analyze and investigate any perceived security threats as well as assist internal users with any information security questions or reported issues, such as phishing/scam emails, information security concerns and security solution related access or performance issues.


text: As part of our cybersecurity program, team members are offered cybersecurity training and participate in awareness programs including phishing simulation exercises, regular cybersecurity newsletters and reminders and programming and events during cybersecurity awareness month.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our customer, prospect, supplier or employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We generally require that third-party service providers that access, host our data, or could otherwise introduce cybersecurity risk to us, enter into contracts that obligate them to manage their cybersecurity risks in certain ways and report any cybersecurity incidents to us.


text: We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry ("PCI") compliant where required. We also maintain incident response procedures and business continuity and contingency plans and periodically hire third parties to conduct vulnerability analyses. We also compare our processes to standards set by the National Institute of Standards and Technology ("NIST") and/or International Organization for Standardization ("ISO"), as appropriate.


text: The Technology, Environmental, Safety and Security ("TESS") Committee of our Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.


text: Our Chief Information Security Officer is responsible for our overall data security and cybersecurity risk reduction efforts, including information security compliance, training and awareness and application, network and system security. Our Chief Information Security Officer has 25 years of prior experience in the fields of information systems, cybersecurity, risk management, and infrastructure management. Our Chief Information Security Officer holds master's and bachelor's degrees in both Computer Information Systems and Business Administration and the following certifications: Certified Internal Controls Auditor (CICA), Payment Card Industry Professional (PCIP), Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC).


text: We discuss risks related to cybersecurity threats under the heading "Breaches in data security or other disturbances to our information systems and other networks or our actual or perceived failure to comply with requirements regarding data privacy and protection could impair our operations, subject us to significant fines, penalties and damages, and have a material adverse impact on our business, financial condition and results of operations" included as part of our risk factor disclosures in Item 1A of this Annual Report, which disclosures are incorporated by reference herein. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition and any expenses we have incurred from cybersecurity incidents were immaterial.


text: The Technology, Environmental, Safety and Security ("TESS") Committee of NCLH's Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.

companyName: NCL CORP Ltd.


text: Risks from Cybersecurity Threats. Information relating to risks from cybersecurity threats is included in this report in Item 1A under the caption " Cybersecurity breaches or a failure in our e-commerce operations and could disrupt our business."

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: We manage and oversee a cybersecurity risk program designed to evaluate potential threats, vulnerabilities, and the potential impact on our operations, data, and stakeholders. This program undergoes regular reviews and updates to address emerging risks. Our process for addressing risk aligns with industry standards as outlined in the NIST Cybersecurity Framework, NIST Risk Management Framework, and CIS Top 18 Security Controls.


text: Identify We establish an understanding of our critical operational assets and those that could be attractive to potential threat actors. We consider any cyber activity that could diminish an asset's value, hinder our ability to use or access the asset, or covertly allow a threat actor to gain access to an asset as a potential risk.


text: Assess We evaluate the exposure of our assets to identified cyber risks and the potential impacts on our operations or reputation if we were unable to access or utilize an asset or realize its value, or if a threat actor gained access to an asset or its value. We also assess the potential materiality of these risks based on their potential impact on our operations or reputation.


text: Manage We apply a multi-layered defense strategy to maintain our ability to access or utilize an asset or its value and prevent threat actors from gaining or increasing their access to an asset or its value. We prioritize our defensive mechanisms, including administrative, procedural, and technical controls, based on their cost-effectiveness and their ability to reduce risk.


text: Periodically, we engage consultants and other third parties to assist in the continued improvement of our cybersecurity program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address vulnerabilities. Examples of these engagements include penetration testing, risk assessments, and cybersecurity control audits.


text: We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate and continually monitor risks.


text: We undertake proactive activities to prevent, detect, and minimize the impact of cybersecurity incidents. We maintain an incident response plan to respond to breaches and minimize disruption to our operations swiftly. The incident response process is consistently tested and reviewed through simulated incidents. To bolster the incident response process, we have business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident. Previous cybersecurity incidents guide continuous improvements in our governance, policies, procedures, and technology. We use these lessons to strengthen our cybersecurity defenses.


text: Cybersecurity threats and risks, to include any previous cybersecurity incidents, have not materially affected, or are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of certain customer and employee data, it is possible that we could be susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events.


text: We are committed to the ongoing identification and management of cybersecurity risks as part of our business strategy, financial planning, and capital allocation. We strive to incorporate cybersecurity considerations into all aspects of our operations. As the cybersecurity landscape evolves, so does our strategy to identify and mitigate these risks. We continuously work towards enhancing our processes to ensure an effective cybersecurity posture. Board of Directors and Management Governance.


text: Board of Directors Oversight. We recognize the critical importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.


text: Company management maintains primary responsibility for the risk management of the Company, including cybersecurity risks. The Board's Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee Charter provides that the Committee is responsible for reviewing management's assessment of the Company's information technology process framework and practices and the controls implemented to monitor and mitigate information technology risks. In addition, as part of the Audit Committee's quarterly meetings and as provided for in its Charter, the Committee receives reports and briefings from the Company's Chief Information Officer (CIO), Director of Cybersecurity, and management's cybersecurity team. Those reports and briefings include management's review of emerging cybersecurity developments and threats, the Company's risk relating to cybersecurity, and the Company's strategy to mitigate data protection and cybersecurity risks. The Audit Committee has the authority to obtain advice and input from external cybersecurity resources to assist in its oversight functions.


text: Management's Role. Our management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, evaluating, and mitigating these risks.


text: Responsibility for Cybersecurity Risks. Our CIO has developed expertise in cybersecurity, compliance, enterprise architecture and design, data analytics, digital transformation, and customer service through years of experience in the information technology space. Our Director of Cybersecurity is designated as the senior executive responsible for cybersecurity and reports directly to our CIO. He has a comprehensive information technology background with 30 years of information technology experience, to include 10 years of systems architecture and design, 12 years of management, and 14 years of service in managing, or assisting in managing, cybersecurity related risks.


text: To support the CIO and Director of Cybersecurity in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 85 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.


text: Additionally, the cybersecurity management team regularly consults with additional resources, to include attorneys, accountants, human resources personnel, and other information technology specialists, to determine materiality for cybersecurity related risks and incidents. There is an established Incident Response Plan that clearly identifies escalation measures based on the impact to our organization.


text: Processes for Monitoring and Mitigating Risks and Incidents. We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include: Continuous monitoring of network traffic and systems for signs of potential threats. Regular vulnerability assessments and penetration testing to identify and address weaknesses. Implementation of cybersecurity measures, such as firewalls, intrusion detection systems, and data encryption. Employee training and awareness programs to educate staff about cybersecurity best practices. Incident response plans to ensure swift and effective responses to cybersecurity incidents. Software and Vendor Risk Assessments. Vulnerability management solution to prioritize patches based on risk. Privileged account management solutions for administrative access.


text: These processes are designed to prevent cybersecurity incidents, but also allows our organization to quickly detect and respond to incidents if they do occur. They are regularly reviewed and updated to adapt to evolving cybersecurity threats.


text: If any incidents occur, we have a comprehensive Incident Response Plan in place. The Plan includes materiality qualifiers based on the size and scope of the incident. Furthermore, there is an escalation matrix that identifies who is directly involved with managing the incident based on the severity. An Incident Report is compiled for all incidents, regardless of materiality. Management reviews the incident reports and ensures all incidents are mitigated and remediated effectively. These reports are shared with the CIO, CFO, and Audit Committee so they can effectively manage resources to reduce risk and prevent future incidents.


text: Reporting to the Board. As noted above, our CIO, Director of Cybersecurity, and cybersecurity team provide quarterly updates and reports to our Audit Committee on cybersecurity risks as well as a review of the processes described above. Our management personnel are also required to provide more frequent updates to the Audit Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function. These processes are designed to help protect our information assets and operations from internal and external cyber threats, protect employee, vendor, and collaborator information from unauthorized access or attack, and secure our networks and systems. They include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our cybersecurity risk management practices. We engage certain external parties, including consultants with expertise in information security, cybersecurity incident response, and governance, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party information technology service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Our Board of Directors does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Our Audit Committee provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives updates from management twice a year regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President of Information Technology leads operational oversight of company-wide cybersecurity strategy, policy, standards, and processes, and works across the relevant departments to assess and help prepare us to address cybersecurity risks. Additionally, our Vice President of Information Technology participates in management's semi-annual updates to the Audit Committee. In the event of a cybersecurity incident, our Vice President of Information Technology works with our information technology department and appropriate representatives of other affected departments to assess and respond to the incident, and to determine whether internal and external reporting of the incident is merited under the circumstances. Our Vice President of Information Technology has more than 15 years of experience managing cybersecurity, including service as the Chief Information Security Officer for a multi-national company in the specialty materials industry. He has experience with compliance programs for cybersecurity-related regulations and standards such as the European Union's General Data Protection Regulation, The Payment Card Industry Data Security Standard (PCI-DSS), and the U.S. Food and Drug Administration's regulations on electronic records and electronic signatures. He has also participated in Gartner cybersecurity programs and conferences and received training in the identification and prevention of cyber threats such as spam, phishing, spear-phishing, malware, and social engineering.


text: In an effort to deter and detect cyber threats, we annually provide all of our personnel, including full-time and part-time employees and temporary staff, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We have implemented a proactive cybersecurity monitoring program that is designed to achieve threat detection and swift response, which includes the use of best-in-class tools to mitigate vulnerabilities and protect our information assets and operations. We also utilize a stringent endpoint security practice, geo-fencing and geo-blocking on firewalls, and automatic prioritization of emails to enable our information technology department to efficiently prioritize response to the most dangerous threats.


text: Risk Management and Strategy Marine Products approaches cybersecurity as an enterprise-wide risk and has created a Cybersecurity Risk and Compliance Program that outlines governance programs in place and outlines efforts undertaken to mitigate cyber risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, the Company uses the Center for Internet Security (CIS) Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: The Company has several security policies that are published and accessible to all employees. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. Marine Products has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate. While the Company is currently self-insured for cybersecurity risks, we are evaluating a cyber liability insurance policy that may provide coverage for expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. The Company has a periodic touchpoint with all third-party information technology service providers to identify materials risks from cybersecurity threats.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Role of the Board The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk, at least annually. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including cybersecurity.


text: Role of Management Company management has established a Cybersecurity Governance Committee that is comprised of the Information Technology Manager and senior members of management. The Committee meets periodically to discuss cybersecurity program updates and challenges, watch for potential threats from both external and internal sources, monitor compliance in existing or emerging business practices, and respond to stakeholder inquiries. The Information Technology department is comprised of professionals with extensive expertise and led by its manager with over 20 years of experience in various aspects including cybersecurity. The manager is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.


text: Risk Management and Strategy RPC approaches cybersecurity as an enterprise-wide risk and has created an accountability framework that includes oversight of cybersecurity risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, RPC uses the Center for Internet Security (CIS) Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture. RPC has created a cross-departmental team to continuously monitor and screen Company vendors (also known as partners and managed service providers) for vulnerabilities on their own systems and compliance with RPC's policies and procedures, to mitigate risks potentially caused by third party breaches. We have completed an initial risk assessment for each vendor and identified an external cybersecurity firm to further assist with this initiative that is being guided by CIS Control Standards.

companyName: RPC INC

ticker: RES


text: As part of its Standard Operating Procedures, RPC has adopted Incident Response Policy (IRP), Data Loss Prevention Policy, and other policies regarding key areas of information security. These policies are reviewed periodically and updated as needed to address emerging risks or gaps in compliance. The IRP also includes guidance on internal and external escalation in the event of an incident or breach. RPC has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed by the cybersecurity team to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors, We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack. Our cyber risk coverage includes assistance in the timely remediation of material cyberattacks and incidents.


text: Role of Management RPC's cybersecurity program is overseen by the Chief Information Officer (CIO) as well as several key members of RPCs Enterprise Technology team including the Principal Security Architect. These key leaders collectively have over 50 years of experience in network security, cybersecurity and enterprise risk management. The Chief Executive Officer and CIO receive regular updates on cybersecurity matters, results of mitigation efforts related to existing risks and cybersecurity incident response and remediation. These leaders communicate closely with members of RPCs Information Security Committee (ISC) which oversees the adopted CIS Control Framework, governs the Company's information security programs and ensures the effectiveness of the Company's cybersecurity and technology risk management practices. In addition, ISC provides oversight to ensure that security strategies are aligned with business objectives. T he Company also maintains business continuity and disaster recovery plans. RPC performs scheduled tabletop exercises periodically to evaluate the resilience of its cyber crisis processes, tools, and proficiency in responding to cyber attacks from both a strategic and technical response perspective.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Managing Material Risks and Integrated Overall Risk Management The Company has implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is designed to align with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, third-party conducted penetration tests and network monitoring. We also provide security awareness training for employees and contractors, maintain a cybersecurity insurance policy and invest in new security capabilities designed to address emerging threats.


text: In addition, the Company has a set of enterprise-wide policies, standards, and procedures concerning cybersecurity matters, which include an information security policy and program reviewed and approved by senior management and the Board of Directors. Additionally, technical standards and procedures related to incident response and use of Bank systems and devices are in place, as well as standards for critical security operational functions related to encryption, endpoint protection, vulnerability management, remote access, multifactor authentication, handling confidential information, use of internet, social media, email, and wireless devices. Policies and standards are subject to an internal review process and are approved by senior management.


text: The Company has strategically integrated cybersecurity risk management into our enterprise-wide risk management framework in alignment with the three lines of defense model to promote an enterprise-wide culture of cybersecurity risk management. This integration aims to provide that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our enterprise technology and cybersecurity management teams to evaluate and address cybersecurity risks in alignment with our business objectives, regulatory requirements and operational needs.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity service providers, assessors, advisors and consultants, in evaluating and testing our cybersecurity program. These partnerships enable us to leverage specialized knowledge and insights to ensure our cybersecurity strategies and processes are aligned to industry best practices. Our collaboration with these third parties includes threat assessments and consultation on security improvements, program maturity and regulatory compliance. Additionally, we conduct multiple penetration tests annually and retain an external consultant to periodically evaluate the overall state of our program.


text: Overseeing Third-Party Risk The Company has processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.


text: Risks from Cybersecurity Threats Like all financial institutions, we, as well as our third-party service providers, are the target of various evolving and adaptive security threats, including malware, ransomware, phishing, credential validation and distributed denial-of-service attacks. Cyber-attacks have also focused on targeting online applications and services, such as online banking, as well as cloud-based and other products and services provided by third parties. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to the Company or our employees and customers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on the Company's operations, reputation and financial results.


text: The Company's Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and the significance of these threats to our operational integrity and stakeholder confidence. Accordingly, the Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.


text: Board of Directors Oversight As part of its responsibility to oversee the management, business, and strategy of the Company, the Board of Directors, through its Risk Committee, reviews and approves the Company's risk management framework, including reviewing the overall risk appetite, risk management strategy and policies and practices established by management to identify and manage the risks we face. In addition, other Board committees are responsible for overseeing certain risks under their respective charters.


text: The Board's Risk Committee is central to the Board's oversight of cybersecurity risks and bears the primary oversight responsibility for this domain. The Risk Committee is composed of Board members with diverse expertise, including audit and finance and technology experience, equipping them to oversee cybersecurity risks effectively. The Risk Committee actively participates in strategic decisions related to cybersecurity, offering review and guidance on, among other things, program design, the Company's cybersecurity risk profile and the effectiveness of its risk management strategies.


text: The Board Risk Committee reviews and receives regular briefings from the Chief Information Officer, Chief Information Security Officer (the "CISO"), Chief Technology Officer, Chief Operating Officer, Chief Risk Officer, Senior Vice President – Enterprise Information Security, Chief Audit Officer, and Chief Executive Officer on information security and technology risks, including discussions of the Company's information security and cybersecurity risk management programs. The Board also receives regular reports on cybersecurity risks, vulnerabilities, incidents, staff security awareness training and overall progress to improve the Company's cybersecurity risk profile.


text: Management's Role in Managing Risk Senior management is responsible for creating and recommending for approval to the Board of Directors risk appetite metrics related to cybersecurity, reflecting the aggregate levels and types of risk the Company is willing to accept in connection with the operation of our business and pursuit of our business objectives.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO, our Vice President – Cyber Risk Governance and our Senior Vice President – Enterprise Information Security. The management team is highly experienced in cybersecurity matters. The CISO has over 20 years of experience in cybersecurity including working at a global bank and leading cybersecurity vendors, and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Privacy Professional certifications for security and privacy, respectively. The CISO has a bachelor's, master's, and law degrees. The Vice President – Cyber Risk Governance has advanced degrees and certifications related to cybersecurity and over 15 years of experience with the federal government in a similar role. The Senior Vice President – Enterprise Information Security has more than 20 years of information security risk management experience, including serving as a bank CISO, and has bachelor's and master's degrees and holds the CISSP certification.


text: The CISO is responsible for developing and implementing the Company's cybersecurity and information security program, reporting on cybersecurity matters to the Board and senior management, ensuring compliance with standards, remediating known risks, overseeing incident detection and response and leading the employee cybersecurity awareness training program. The Vice President – Cyber Risk Governance is responsible for third party cybersecurity risk management and cybersecurity risk and controls governance. The Senior Vice President – Enterprise Information Security provides regular updates to senior management and the Board's Risk Committee regarding the effectiveness of security controls and the state of the Company's cybersecurity program and risk level.


text: The Bank maintains a three lines of defense structure with the Cybersecurity Division as the primary security control owner, Enterprise Information Security providing review, assessment and challenge of risk management policies and processes, and an Internal Audit team providing independent review of the first and second lines of defense. The CISO facilitates communication across business lines to support effective and consistent information security risk identification and control infrastructure, maintaining an ongoing dialogue regarding emerging or potential cybersecurity risks, receiving updates on significant developments in the cybersecurity domain and ensuring that the Board's oversight is proactive and responsive.


text: The CISO, Senior Vice President – Enterprise Information Security, and Vice President – Cyber Risk Governance regularly inform the Chief Executive Officer, the Chief Operating Officer, the Chief Risk Officer, the Chief Information Officer, the Chief Technology Officer, and the Chief Audit Officer of all concerns related to cybersecurity risks and incidents, including the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. This aims to ensure that senior management is kept up to date on the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Company's Board of Directors, ensuring that they have comprehensive information and can provide oversight with respect to critical cybersecurity issues.


text: Monitoring Cybersecurity Incidents In addition to the monitoring and reporting described above, the Company maintains an Enterprise Information Security Response Program, which includes regular monitoring of information systems through deployment of security controls designed to detect and identify threats and sets forth immediate actions to mitigate the impact of cybersecurity incidents. The Company maintains a vulnerability management program to identify and remediate critical security vulnerabilities. An after-incident report is done to review critical events so as to inform long-term strategies for remediation and prevention of future incidents.


text: Cybersecurity Risk Management and Strategy. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. As part of our enterprise risk management, we maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology, to support the effectiveness of our information technology systems and identify, prevent and mitigate information technology and data security risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: B&G Foods, Inc.

ticker: BGS


text: Our cybersecurity program also addresses cybersecurity risks associated with our use of third-party service providers. We use systems and processes that are designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analysis.


text: We have an information security policy, which is supported by a security awareness program. We also have an information security training and compliance program in place. Our information technology (IT) department has engaged a third party to provide regular cybersecurity awareness training to our employees. We also have business continuity plans and incident response plans in place to prepare us to act quickly in the event of cyber incidents. We test our business continuity plans and incident response procedures at least annually.


text: Cybersecurity Governance. Our chief information officer, who leads our IT department, oversees our cybersecurity program. Our chief information officer has twenty-eight years of IT experience. Our chief information officer reports to our chief financial officer. As part of our company's risk management function, our chief information officer provides periodic updates about our cybersecurity risk profile to our executive leadership team. We have an incident response program that provides for the prompt escalation of certain cybersecurity incidents to certain members of management, including our chief financial officer and our general counsel, so that decisions regarding disclosure and reporting of such incidents can be made in a timely manner.


text: Our chief information officer meets at least annually with the risk committee of our board of directors and/or the full board of directors to provide them with updates on IT matters, including cybersecurity. At least two members of our Board of Directors have IT and cybersecurity experience or expertise, including the chairs of our audit committee and risk committee. While our board of directors is ultimately responsible for risk oversight at our company, the risk committee of our board of directors assists the board in fulfilling its oversight responsibilities by reviewing risks in certain areas, including cybersecurity.


text: Cybersecurity Threats and Incidents. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our company, including our business strategy, results of operations or financial condition. However, we and third-parties with which we have shared personal information have been subject to attempts to breach the security of networks, IT infrastructure, and controls through cyberattack, malware, computer viruses, social engineering attacks, ransomware attacks, and other means of unauthorized access. For example, in February 2023, we experienced a cyberbreach resulting from a global ransomware attack that impacted thousands of network servers around the world and which encrypted certain of our network servers. In this case, our internal IT department together with third-party cybersecurity incidence response teams that we keep on retainer were able to unencrypt and restore most of the affected servers and restore others from backups within a few days and with minimal disruption to our manufacturing operations, sales, order processing, distribution and other business operations, and without paying any ransom. We incurred costs relating to the cyberattack, including costs to unencrypt and restore our servers, scan our network to ensure there was no remaining malware or other problematic remnants of the attack and to enhance our cybersecurity defenses.


text: The February 2023 ransomware attack also resulted in the unauthorized release of sensitive personal information of certain of our current and former employees that has required remediation expenditures by our company, including, without limitation, expenditures to scan the leaked files to identify the specific individuals impacted and the scope of the sensitive personal information, and expenditures to notify and provide free credit monitoring to our employees and certain former employees and other individuals.


text: Despite our ongoing efforts to continuously improve our ability to prevent and minimize the impact of future cyber incidents, we cannot assure you that we will not be the subject of future threats or incidents. While the February 2023 cyberattack and our remediation efforts have not had and are not expected to have a material adverse impact on our consolidated financial position, results of operations or liquidity, we cannot assure you that in response to a future cyberattack we will be able to restore our systems so quickly and with minimal disruption to our business operations and without incurring material costs. In addition, the mishandling or inappropriate disclosure of non public sensitive or protected information could also lead to the loss of intellectual property, negatively impact planned corporate transactions or damage our reputation and brand image. Misuse, leakage or falsification of legally protected information could also result in a violation of data privacy laws and regulations and have a negative impact on our reputation, business, financial condition and results of operations.


text: Please refer to the risk factor captioned " We are increasingly dependent on information technology; Disruptions, failures or security breaches of our information technology infrastructure could have a material adverse effect on our operations " included in Part I, Item 1A, "Risk Factors," of this report, for further information about cybersecurity risks and potential related impacts on our company.


text: Risk Management and Strategy The Company believes that a strong cybersecurity program is vital to effective cybersecurity risk management. The Company recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to help safeguard sensitive information and its business operations, and to protect the confidentiality, integrity, and availability of its information systems and the nonpublic information transmitted, processed and stored on its systems or those of third-party service providers.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Managing Material Risks & Integrated Overall Risk Management The Company has integrated cybersecurity risk management into its broader risk management framework in order to promote a culture that values protecting sensitive information. This integration is intended to promote the inclusion of cybersecurity considerations in decision-making processes throughout the Company. As the operating company, the Bank's general risk management personnel, including the Chief Risk Officer ("CRO"), work closely with their information technology and security counterparts to evaluate and address cybersecurity threats in alignment with our business objectives and operational needs.


text: The Company also maintains a system-wide information systems security program that applies to all employees. All employees are expected to assist in safeguarding the Company's information systems and to assist in the discovery and reporting of cybersecurity incidents. This Company-wide program is intended to identify and assess internal and external cyber and information security risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems or those of third-party providers from unauthorized access, use or other malicious acts.


text: The Board of Directors is responsible for overseeing the Company's cybersecurity program. The Board of Directors has established oversight mechanisms that are intended to promote effective governance in managing risks associated with cybersecurity threats because it recognizes the significance of these threats to the Company's operational integrity and the information stored on the Company's information systems or those of third-party service providers. See "—Governance— Board of Directors Oversight."


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts from time to time, including cybersecurity assessors, risk management professionals, and other consultants, in evaluating and testing our risk management systems. We also engage third-party services on an ongoing basis to conduct independent audits of our risk management systems. These engagements enable us to leverage specialized knowledge and insights and assist the Company with its goal of maintaining cybersecurity strategies and processes that are consistent with industry best practices. Our collaboration with these third-parties includes table top exercises, penetration testing and other cyber-support services.


text: Oversee Third-party Risk Because the Company is aware of the risks associated with third-party service providers, the Company has implemented policies and processes to oversee and assist with managing these risks. The Company's Third-Party Risk Management Officer (the "TPRM") conducts security and risk assessments of all third-party providers before engagement and monitors these third-party providers on an ongoing basis to assess each provider's compliance with the Company's cybersecurity standards, which are intended to be commensurate with the level of risk and complexity of the relationship with, and the activities performed by, a given provider engaged by the Company. In addition, the TPRM conducts an annual risk assessment of any third-party provider that provides critical services to the Company or has access to customers' protected data. This approach is designed to help identify and mitigate risks related to data breaches or other cybersecurity incidents originating from third-parties in order to better protect our customers' personally identifiable information and the Company's assets and data.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business strategy, results of operations or financial condition. Notwithstanding the defensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats, incidents or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see Part I, Item 1A., "Risk Factors— Risks Related to the Company's Operations—A failure in the Company's operation and/or information systems or infrastructure, or those of third parties, including cyber-attacks, could impair the Company's liquidity, disrupt its businesses, result in the unauthorized disclosure of confidential information, damage its reputation, and cause financial losses."


text: Board of Directors Oversight The Board of Directors is responsible for overseeing the Company's cybersecurity program. In connection with carrying out these oversight responsibilities, the Board of Directors delegated certain matters to the Technology Committee (the "Technology Committee") of the Board of Directors. The Technology Committee is central to the Board of Directors' oversight of cybersecurity risks and is responsible for assisting the Board of Directors in its oversight of technology and innovation strategies, as well as developing plans related to information systems and cybersecurity. The Technology Committee meets at least quarterly and is composed of three board members with diverse skills and experience, including risk management, technology, and finance, which the Board of Directors considers to be helpful in overseeing cybersecurity risks. The Technology Committee reports quarterly (and more frequently if necessary) to the Board of Directors on the activities of the Technology Committee since its last report, including material developments with respect to the risks from cybersecurity threats.