text: Cybersecurity Governance The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. Our Chief Information Officer (CIO) and other internal members of our technology team provide regular reports to the audit committee regarding the evolving cybersecurity landscape, including emerging risk, as well as our processes, program and initiatives for managing these risks. The audit committee, in turn, periodically reports on its review with the board of directors.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy processes are led by our CIO, VP Information Technology, and Manager of Security. Such individuals have collectively over 50 years of work experience in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT

secItem: Item 1C


text: The CIO also presents at least annually to the Board an overview of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results of third-party assessments, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Risk Management and Strategy As SandRidge has increasingly relied on information technology systems and networks in connection with our business activities, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: SandRidge has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with IT professionals to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. The underlying controls of our cybersecurity risk management are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").


text: The following is a brief list of some of the cybersecurity risk management tools we employ to identify, assess and manage threat risks: –Third party system and network scanning tools that identify or automatically block potential cybersecurity threats; –Live 24-hour monitoring of corporate and field operations IT networks for cybersecurity threats; –Mandatory annual employee cybersecurity awareness training program that includes phishing simulations and other microlearning courses; –Monthly IT and cybersecurity meetings with management and IT professionals; –Completion of annual IT network cybersecurity assessment and vulnerability scan;


text: –Segregation of our financial data records, that are stored on remote servers, separate and apart from our corporate office network with backups stored in different geographical regions in the United States.


text: Recognizing the complexity and evolving nature of cybersecurity threats, SandRidge engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes focus on industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Because we are aware of the risks associated with relying on third-party service providers, to, among other things, estimate quantities of oil and natural gas reserves, analyze seismic and drilling information, process and record financial and operating data and communicate with employees and third parties, SandRidge implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes assessments by our internal audit and IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Incidents and Threats We have in the past experienced, and expect to continue to confront, cybersecurity incidents and cybersecurity threats from hackers and other third parties. Although such prior incidents have not had a material adverse impact on our operations or financial performance, there can be no assurance that we will be successful in preventing cybersecurity incidents or successfully mitigating their effect on our Company. Any cybersecurity incident could have a material adverse effect on our reputation, competitive position, business, financial condition and results of operations.


text: Additionally, although out of our control, cybersecurity incidents affecting oil and natural gas distribution systems maintained by third parties, or the networks and infrastructure on which they rely, could delay or prevent delivery of our production to markets, which could, in turn, have a material adverse effect on our business, financial condition and results of operations.


text: For additional information regarding the risks we face from cybersecurity threats, please see the section entitled "Item 1A. Risk Factors—Cybersecurity incidents or other failures in telecommunications or IT systems could result in information theft, data corruption and significant disruption of our business operations."


text: Governance – Board Oversight and the Role of Management The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee ensures effective oversight by reviewing reports on information security and cybersecurity from the Director of Internal Audit at least annually.


text: Primary responsibility for assessing and integrating within enterprise risk management of our cybersecurity risks rests with our Director of Internal Audit, who oversees our governance programs, tests our compliance with standards, remediates known risks, and coordinates our employee training program.


text: The Director of Internal Audit, in their capacity, regularly informs the Chief Executive Officer ("CEO"), the Chair of the Audit Committee, and other members of management of aspects related to cybersecurity risks and incidents. This ensures that the appropriate levels of management are kept abreast of the cybersecurity posture and potential risks facing SandRidge. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Our Chief Technology Officer ("CTO") is responsible for cybersecurity within our company, including information technology risks, controls, strategies and procedures. The Cybersecurity Subcommittee of the Board of Directors oversees cybersecurity for our company and meets with the CTO at least quarterly to discuss the status of cybersecurity efforts as well as any security incidents. Cybersecurity Subcommittee materials are provided to the Audit Committee as well as the full Board of Directors. The Board of Directors believes that a strong cyber strategy based on industry accepted best practices is vital to protect our business, customers and assets.

companyName: JOINT Corp

ticker: JYNT


text: A dedicated team of technology professionals works throughout the year to monitor all matters of risk relating to cybersecurity. We have begun our certification process for the globally recognized International Organization for Standardization certification for Information Security Management Systems (ISO 27001) that we expect to achieve by the second quarter of 2024. Additionally, we operate and are compliant under the following provisions: HIPAA attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.


text: We annually assess our cybersecurity programs against third-party requirements, including HIPAA and the Sarbanes-Oxley Act (SOX). We test multiple aspects of cybersecurity regularly, including annual pen testing over our proprietary information systems and have historically tested annually and beginning 2024 will test semi-annually our technical recovery and incident response procedures.


text: We maintain a robust privacy compliance program. Employees receive periodic email communications, which train them to detect and report malware, ransomware and other malicious software and social engineering attempts that may compromise our information technology systems. In the first quarter of 2024, we will be implementing a best in class security awareness training system and a quarterly training program for all employees.


text: Currently, we rely on an established major incident management and communication process to address any potential cybersecurity incidents. This established process includes the use of third party partnerships to make available the distinct skill sets needed to assist in properly responding to any cybersecurity threat. We are in process of establishing defined response procedures to effectively address any cyber threat that may occur regardless of the safeguards in place that minimize the chance of a successful cyberattack. The response procedures will be designed to identify, analyze, contain and remediate such cyber incidents expeditiously. These procedures and approach to safeguard our information and assets will be continuously monitored by management and updated to evolve with the current cyber landscape in alignment with the ISO 27001 standard mentioned above.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data"). Our information security function is led by our Director of Information Technology, with the support of our third-party specialists. Our information security function helps identify, assess and manage risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including automated tools, domain name system filtering, antivirus protection, vulnerability scanning and penetration testing.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include an incident response policy, encryption of certain data, network security controls, segregation of certain data and system monitoring. Our incident response policy provides the framework for the execution of cybersecurity incident response procedures and internal communications while adhering to applicable legal reporting and disclosure requirements.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our information security function works with management to prioritize risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats. In addition, we use third-party service providers to perform a variety of functions throughout our business, including, for example, hosting and processing data, manufacturing our product candidates and assisting with R&D and clinical trial activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.


text: For a description about our cybersecurity risks, refer to Item 1A. "Risk Factors," to this Annual Report on Form 10-K "Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."


text: Our board of directors maintains oversight of our most significant risks and our processes to identify, manage and mitigate those risks. The audit committee of our board of directors (the "Audit Committee") has responsibility for oversight of our management of cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who reports to our Chief Operating Officer. Our Director of Information Technology is responsible for monitoring third-party specialists, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Operating Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our Incident Response Policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer. Our Chief Operating Officer and other senior management work with our incident response team to help mitigate and remediate cybersecurity incidents in which case they are notified. In addition, our Incident Response Policy includes reporting to the Audit Committee for certain cybersecurity incidents. The Incident Response Policy is managed and maintained by our Director of Information Technology, with oversight from our Chief Operating Officer. The Audit Committee receives periodic updates from our Chief Operating Officer regarding the status of our cybersecurity program and our posture to identify and mitigate risks to our information security.


text: Cybersecurity Strategy and Risk Management At Vista Credit Strategic Lending Corp., we recognize the importance of assessing, identifying and managing risks associated with cybersecurity threats. These risks include operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws, and other litigation and legal, financial and reputational risks.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: We rely on the cybersecurity strategy and policies implemented by Vista, the parent of our Adviser. Vista maintains, and we rely on, a comprehensive cybersecurity program that is aligned to the National Institute of Standards and Technology's Cybersecurity Framework as part of its enterprise risk management program, including physical and digital technologies and administrative, operational, and technical controls, to aid in efforts to identify, assess and manage cybersecurity risks. The program is designed to provide for the availability of critical data and systems, maintain regulatory compliance, manage material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents. Among other things, the program includes a risk management framework; controls designed to monitor our digital infrastructure and detect and alert to suspicious, anomalous, and/or malicious behavior and indicators of potential cybersecurity threats; regular scanning of our networks and systems to triage and manage any potentially exploitable vulnerabilities; regular tabletop exercises to test our incident response and business continuity and disaster recovery preparedness; and annual Information Security Awareness training for employees.


text: Vista has an Incident Response Plan which guides the actions to be taken in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable compliance with applicable legal and regulatory obligations and mitigation of financial and reputational damage. The Incident Response Plan includes notification to the applicable members of cybersecurity leadership, including Vista's Chief Information Officer ("Vista CIO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on the nature of the incident, the incident may also be reported to Vista's Executive Committee, as well as to our Audit Committee and to our full Board, if appropriate. Vista also maintains a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents which may materially impact operations.


text: Vista engages with independent assessors and other third parties to validate security controls, standards, and policies, conduct annual penetration tests of networks and systems to identify threats and vulnerabilities, and assist with forensic analysis of material cybersecurity incidents. In addition, to identify and assess material risks from cybersecurity threats, Vista's enterprise risk professionals collaborate with subject matter specialists, the Vista CIO, and Vista's Chief Compliance Officer ("Vista CCO"), Vista's Chief Operating Officer and Vista's Chief Legal Officer, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: These processes are also designed to address cybersecurity threats associated with the use of third-party providers. When selecting third-party service providers, associated cybersecurity threats are assessed, and, in addition, ongoing cybersecurity risk assessments of third-party service providers are conducted. These third-party service providers are also required to provide notifications of material breaches that may impact Vista's data. Vista incorporates the cybersecurity risk coordination and assessment of third-party service providers into the overall cybersecurity program and enterprise-wide risk management.


text: We are not aware of any material cybersecurity incidents that have impacted us. However, Vista is aware that similar institutions, as well as its employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity threats in recent years and will likely continue to be the targets of increasingly sophisticated cyber-attacks. We described whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy and results of operations, under the heading "We are dependent on information systems and systems failures could significantly disrupt our business, which may, in turn, negatively affect our liquidity, financial condition or results of operations", included in Item 1A of this Form 10-K, which is incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of Vista's enterprise risk management processes and an area of focus for the Board of Directors and management for both Vista and us. These cybersecurity risk management and strategy processes are overseen by the Data Privacy and Information Risk Committee (the "DPIRC"). The DPIRC is co-chaired by the Vista CCO and Vista CIO, with members including senior representatives from Vista's Information Security, Legal, and Human Resources departments. The Vista CIO has extensive experience in cybersecurity and technology. The Vista CIO was appointed in 2017 and has over 20 years of cybersecurity, information security, and technology services and innovation experience.


text: The DPIRC is responsible for implementing, reviewing and revising cybersecurity policies and directives, as well as overseeing the protection, detection and response capabilities of cybersecurity resources. In addition, the DPIRC promotes, endorses and validates Vista's cybersecurity risk posture, reviews industry best-practices, provides strategic direction for cybersecurity matters and oversees cybersecurity training programs. The DPIRC is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, Vista's cybersecurity risk program and the operation of the Incident Response Plan and Business Continuity Plan and works in coordination with Vista's internal information technology departments to, among other things, implement, review and revise the policies underlying its cybersecurity program. Additionally, Vista's Enterprise Risk Committee receives quarterly information security updates from the Vista CIO.


text: The Board is responsible for the oversight of risks, including from cybersecurity threats. At least annually, the Vista CIO provides the Board with an overview of Vista's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and the Incident Response Plan, as well as the steps taken to respond to such risks. Material cybersecurity threat risks are also considered during Board meeting discussions of matters such as enterprise risk management, operational budgeting, business continuity planning, brand management and other relevant matters.


text: Risk Management and Strategy. The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, overseen by the Audit Committee and the Board of Directors. The Company has developed an information security program to address material risks from cybersecurity threats. The program includes processes identifying how security measures and controls are developed, implemented, and maintained.

companyName: WK Kellogg Co


text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The company conducts regular risk assessments on systems and applications to detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also relies on services provided by Kellanova, a third-party entity, through a Transition Service Agreement (TSA). This agreement ensures the seamless continuation of essential operations during transitional phases.


text: To support our preparedness, the Company has a written incident response preparedness plan that we update as business needs and the security landscape change. In the event of a cybersecurity incident, our incident response team refers to the plan, and the Company conducts tabletop exercises to enhance incident response preparedness. The plan sets out clear response procedures, define roles, categorize incidents, determine materiality, record responses, comply with regulatory standards, assist in public disclosure, and lessen the impact on stakeholders. It is designed to enable a prompt, uniform, and efficient strategy to reduce the financial, operational, legal, and reputational risks associated with cybersecurity incidents. Business continuity and disaster recovery plans are used to prepare for the potential disruption of technology we rely on. The Company has implemented a user awareness program to enhance cybersecurity measures. These include phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. For further discussion of these risks, see "Risk Factors—Risks Related to Our Intellectual Property and Technology—Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."


text: Governance The Company has a Governance, Risk, and Compliance (GRC) IT function to address enterprise risks; cybersecurity is a category handled by that function. Cybersecurity is a vital pillar within a comprehensive risk management framework, fostering cross-functional collaboration to fortify organizational resilience against digital threats. The Company has a privacy and security governance committee. The company operates a privacy and security governance committee and a cybersecurity team led by a Chief Information Security Officer. With extensive cybersecurity experience across IT services, Telecom, and Manufacturing sectors, the Chief Information Security Officer spearheads cybersecurity risk and strategy and directly reports to the Chief Information Officer. Additionally, as part of our overall enterprise risk management strategy, our Audit Committee, which consists solely of independent directors, oversees cybersecurity and receives updates on cybersecurity matters, which include a review of potential digital threats and vulnerabilities, cybersecurity priorities, and our cybersecurity framework.


text: As of December 30, 2023, we are not aware of any material cybersecurity incidents that impacted the Company or are reasonably likely to impact the Company materially. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats rapidly evolve in sophistication and become more prevalent in the industry. We face risks of incidents, whether through cyberattacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology (NIST) and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Owlet, Inc.

ticker: OWLT


text: Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities; • cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer; • cybersecurity awareness training for employees; • security tools in our system to monitor and detect cybersecurity threats; • cyber liability insurance • a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and • a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Technology Officer (CTO) and Chief Operating Officer are responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.


text: Risk Management Strategy We have implemented and maintain various information security processes. These processes are designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, strategic or competitive in nature, and proprietary or confidential information, including clinical trial data, personal and financial information, referred to collectively as Information Systems and Data.

companyName: NGM BIOPHARMACEUTICALS INC


text: Our Chief Financial Officer, or CFO, together with our Incident Disclosure Committee, or IDC, Security Incident Response Team, or SIRT, which is led by our head of information technology, or IT, and composed of two employees who have direct work experience in network security, and third-party service providers, help identify, assess and manage the Company's cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, automated and manual tools, third-party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, evaluating the Company's and the industry's risk profile, evaluating reported threats, coordinating with law enforcement relating to threats, conducting threat assessments for internal and external threats, conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident detection and response plan and policy; encryption of data; network security controls; access controls; physical security and employee training.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example threat intelligence service providers, penetration testing firms, dark web monitoring services, cybersecurity consultants and software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor which includes a security questionnaire, a review of the vendor's written security program, and security assessment calls with the vendor's security team.


text: Depending on the nature of the services provided the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "We, our CROs, our CMOs, our current and potential future partners and other third parties we rely on or partner with could experience a cybersecurity incident that could harm our business".


text: Our board of directors, or the Board, addresses the Company's cybersecurity risk management as part of its general oversight function. The Board has delegated to the audit committee of the Board, or Audit Committee, responsibility for overseeing the Company's cybersecurity risk management processes generally, including oversight and mitigation of risks from cybersecurity threats.


text: Our CFO is responsible for cybersecurity risk management and has experience overseeing IT departments in previous roles. Our principal accounting officer, or PAO, oversees the IT department and in that capacity is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our PAO has significant experience with managing access to key company-wide information systems. Our head of IT is responsible for assessing and managing our material risks from cybersecurity threats and for our cybersecurity protections generally, including helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our head of IT has prior work experience in cybersecurity, holds relevant degrees and current cybersecurity certifications. The Audit Committee receives periodic reports from our CFO and head of IT concerning cybersecurity threats and risks, and the processes that we have implemented to address and mitigate them. The Audit Committee updates the Board on such cybersecurity issues as part of its general committee report to the Board at regular Board meetings. Our Board is responsible for approving budgets to support those activities.


text: We have in place a cybersecurity incident response plan, reviewed by the Audit Committee, which establishes incident response processes, policies and procedures. Under the plan, our CFO, as incident response leader, works with the Company's SIRT to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: Our IDC is notified and activated in the event of a significant cybersecurity incident. The IDC is composed of our CFO, the lead of the SIRT, our General Counsel and other members of our legal and finance teams. In the event of a severe or major cybersecurity incident, the IDC will oversee and coordinate the response, determine materiality of impact and any disclosure requirements in conjunction with legal counsel and will ensure that the Audit Committee and/or the Board are updated and that required disclosures are made in a timely manner.


text: Risk Management and Strategy Bioventus maintains a cybersecurity risk management program that is designed to enable us to assess, identify, and manage risk associated with cybersecurity threats (the "Cybersecurity Program"). Our Cybersecurity Program is based on standards promulgated by the National Institute of Standards and Technology ("NIST") and the United States Cybersecurity and Infrastructure Security Agency ("CISA") and includes the following elements: • Identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by CISA. • Technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness. • Processes designed to detect the occurrence of cybersecurity events and to respond to and recover from cybersecurity incidents. • A third-party risk management process designed to manage cybersecurity risks associated with our service providers, suppliers, and vendors.

companyName: Bioventus Inc.

ticker: BVS


text: Our Cybersecurity Program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit and Risk Committee of the Board of Directors. We also actively engage with key vendors, industry participants and threat intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of the Cybersecurity Program.


text: Integration of Risk Management Process Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Cybersecurity Program is integrated into our enterprise risk management program and framework. These programs are designed to foster a company-wide culture of appropriate cybersecurity risk management. Our IT Security team works closely with stakeholders across technology, legal, risk, and business operations to implement and monitor the effectiveness of the Cybersecurity Program.


text: Engagement of Third Parties in Connection with Risk Management The Company engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity consultants and external auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Bioventus in certain circumstances. We have implemented processes for overseeing and managing these risks. Those processes include assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements.


text: Risks from Cybersecurity Threats As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, a third-party vendor recently informed us that Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our Exogen device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. As a result of the Change Healthcare incident, certain of our patient billing and collections processes have been disrupted. While we have identified an alternative claim processing intermediary and have resumed claims submissions to some payers, this event may cause delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us. As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data. On March 7, 2024, UnitedHealth Group issued a statement indicating that it expects to begin testing and reestablish connectivity to the effected claims network to restore service beginning March 18, 2024. We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows. We continue to evaluate the impact of the Change Health incident on our Company.


text: The oversight of Bioventus' Cybersecurity Program falls under the purview of the Company's Director of IT Security, Risk and Compliance, who has over 25 years of combined technical and leadership experience, with the past 18 years focused on information security and technology risk management, and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.


text: The Audit and Risk Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats, and is regularly briefed on the Company's Cybersecurity Program by the Vice President of Information Technology and/or Director of IT Security, Risk and Compliance. These briefs include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: The Director of IT Security, Risk and Compliance implements and oversees our processes for regularly monitoring our information systems and detecting and reporting cybersecurity incidents. That process includes convening an incident response team composed of the Director of IT Security, Risk and Compliance, Vice President of Information Technology, Chief Compliance Officer, and General Counsel. The incident response team is responsible for overseeing the assessment of and response to any cybersecurity incident and for monitoring the Company's mitigation and remediation efforts. The incident response team is also responsible for informing executive management, the Audit and Risk Committee and, where appropriate, the Board of Directors, regarding the detection, mitigation, and remediation of cybersecurity incidents.


text: Risk management and strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and to protect the confidentiality, integrity, and availability of its data.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: The Company has integrated cybersecurity risk management into its broader enterprise risk management ("ERM") through defined training and incident response plans. The incident response plan defines the objectives, roles and responsibilities and scope of our incident response program, is designed to detect actual or potential cybersecurity events and is triggered by Endpoint Detection and Response ("EDR") system behavior monitoring. Once initiated, the incident response plan consists of several phases, which includes i) detecting a significant observable event, ii) examining a security related event with potential negative IT consequences for the company and iii) analyzing the risk of the event and the degree of remediation required. The Company has developed an incident management plan that operates within the incident response plan to help define the objectives, roles, responsibilities, and scope of our incident response plan.


text: In addition, the Company's training and response methodology includes regular end user cybersecurity updates, phishing tests and online trainings. We believe that these measures helps promote a company-wide culture of appropriate cybersecurity risk management, as well as ensure that cybersecurity considerations are an integral part of the Company's ERM decision-making processes at every level. The Company considers industry best practices to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.


text: The full Board of Directors is responsible for the oversight of the Company's cybersecurity risk management. The Board is updated by the EVP, Global Supply Chain & Import regularly to remain informed on the Company's efforts in managing risks associated with cybersecurity threats.


text: The Company's Infrastructure Director is responsible for managing cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Infrastructure Director has 20 years of experience in the creation and management of enterprise security risk programs. The Infrastructure Director reports to the Chief Information Officer, who actively engages to monitor IT activities and has 40 years of Enterprise Security Management Experience as well as membership in a CIO peer group that reviews local cybersecurity concerns on a regular basis. The Chief Information Officer in turn reports to the EVP, Global Supply Chain & Import who is responsible for the Company's management of cybersecurity risk. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the appropriate Business Team Member in accordance with the Company's Incident Management Plan.


text: The Company engages with third-party experts, including cybersecurity focused Security Operations Center (SOC) and leading-edge (EDR) providers, to assist in evaluating and detecting security risk and initiate corrective actions. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain aligned with industry best practices. The collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: The Company uses third-party service providers in various functions throughout its business. The Company has stringent processes to oversee and manage risk with these third parties. The Company's process includes risk assessment activities, such as security assessments of all third-party providers, policies such as "minimum required access" to ensure compliance with current cybersecurity standards and monitoring activities, such as the review of potential cyber breaches announcements made by the third-party service providers.


text: Notwithstanding the approach we take to cybersecurity risk management, we may be unsuccessful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Risk management and strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the by the Risk Management Committee of the Board of Directors. Our Data Breach Response Team performs annual cybersecurity tabletop incident response exercises, pursuant to our Data Breach Response Policy and Plan. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. See our risk factor "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed" in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Our Executive Director of Information and Technology Services ("IT Director"), who reports to our Chief Financial Officer, is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our IT Director has multiple university certifications in advanced cybersecurity with over 30 years' experience in cybersecurity and technology roles, most of which have been held with the Company. Meetings of our Risk Management Committee and Board of Directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The Board of Directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.


text: Cybersecurity Risk Management and Strategy We have an enterprise-wide information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats. We also use third party security tools to help identify, assess, mitigate, and remediate cybersecurity threats; however, we cannot guarantee that any third-party tools that we utilize will be successful in all circumstances, and whether such tools are appropriate for their level of risk.

companyName: Beauty Health Co

ticker: SKIN


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis (and at least on an annual basis) and also utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.


text: Our information technology systems are equipped to detect directed and non-directed attacks such as viruses and malware that can lead to interruptions and delays in the sale and service of our Delivery Systems and Consumables, general business operations, as well as loss, misuse of data, or theft of intellectual property, confidential information, and personal information (of third parties, employees, providers, and end consumers). However, as of the date of this report, these incidents have not had a material impact on our systems or business operations. Any significant disruption to our business operations or access to our systems could lead to a decline in operational effectiveness, result in a loss of our providers, and adversely affect our business and results of operation. In addition, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. For more information about the cybersecurity risks that we face, see the risk factor entitled, "We are increasingly dependent on information technology, and if we are unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program.


text: Management participates in discussions and updates the Audit Committee, as necessary, regarding any material cybersecurity incident as well as incidents with lesser potential impact. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk program on an as-needed basis. Members of our Board of Directors receive presentations on cybersecurity topics from our Chief Information Security Officer, internal staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team (and team personnel who support our information security program) has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity third party vendors and consultants. In addition, our team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external vendors and consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. The team is led by our Vice President - Software, Engineering, and IT, who also currently serves as our Interim Chief Information and Security Officer, and has over 24 years of industry experience leading IT for organizations of similar sizes. Team personnel who support our information security program have relevant educational and industry experience, including holding similar positions at previous large companies and government entities.


text: Cybersecurity risk management is a major component of our overall risk management systems and processes. We have a cybersecurity program and governance structure designed to identify and manage cybersecurity risks and threats. The program encompasses a comprehensive framework that begins with a clear governance structure comprised of our Chief Technical Officer (CTO), Director of Internal Audits, and Senior Director of Compliance, ensuring a holistic approach to risk management. Regular reporting mechanisms to the board and senior management keep all stakeholders informed about the evolving cyber risk landscape and the program's effectiveness.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: The program includes a well-defined risk assessment and analysis process, identifying critical digital assets, conducting thorough threat and vulnerability assessments, and quantifying risks based on potential impact and likelihood. This information prioritizes risks, allowing us to allocate resources effectively and focus on mitigating the most significant threats. Policies and procedures form the foundation of the cyber risk management program, with comprehensive guidelines covering data protection, access controls, incident response, and employee training. Security controls, such as robust identity governance and access controls, AI-based email security solutions, endpoint protection, and network security measures, are implemented to fortify our defenses. An effective incident response plan ensures a swift and coordinated response to security incidents, minimizing potential damages. Continuous monitoring through MDR (Managed Detect and Respond) solutions and staying informed about the latest threat intelligence feeds enhance our ability to detect and respond to evolving cyber threats.


text: As part of our cybersecurity program, we assess the cybersecurity posture of our third-party vendors and partners to ensure they meet our security standards. This includes due diligence during the vendor selection and periodic evaluations throughout our partnerships. Third-party risk management, compliance adherence, and the consideration of cyber insurance contribute to a holistic and proactive approach to cyber risk management. Regular reviews and updates to the program ensure its relevance and effectiveness in the face of emerging threats, fostering a culture of continuous improvement and resilience.


text: We have not identified any risks from cybersecurity threats including those ones resulted from previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy Our business is substantially dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct most aspects of our business. We have developed and maintain a cybersecurity program, which includes people, processes, and technology aimed at defending our computer systems, devices and networks against increasingly sophisticated threats.

companyName: Fat Brands, Inc

ticker: FATAQ


text: We recognize the importance of protecting both our information and operations from threats that could disrupt our business, put our assets at risk or compromise our customer and employee data. Our cybersecurity program is implemented and maintained using information security tools, policies and a dedicated team responsible for monitoring our networks, providing training to our employees, analyzing the evolution of new threats and strategies for mitigating such threats and seeking to continually harden our cybersecurity posture. The program is periodically exercised, reviewed, updated, and vetted through third-party audits, assessments, and tests with the goal of validating its effectiveness in reducing risk, as well as evaluating its compliance with legal and regulatory requirements. We assess, identify and manage our material risks from cybersecurity threats by employing the following: • Identification of critical systems – we seek to identify which operational or information technology, if compromised or exploited, would result in operational disruption or data compromise. We aim to protect the entire environment at an enterprise level where practical, combined with additional layered, risk-based controls designed to safeguard against cybersecurity threats. This strategic, defense-in-depth, and risk-based approach to cybersecurity provides a methodology designed to identify, protect, detect, respond, and recover from cybersecurity incidents. • Network segmentation – we use a combination of firewalls and routers to provide network segmentation seeking to provide us with network zone protection. • Access controls – we leverage several security capabilities to attempt to enforce access, authorization and authentication to relevant systems, technology, and controls. A least-privilege methodology is applied for localized client workstations, servers, and applications. Security capabilities for access control include physical, administrative, and technical controls that combine to provide a defense-in-depth approach designed to protect our cyber assets from unauthorized use. • Continuous monitoring, detection, and auditing – we employ various technologies, tactics, and procedures aimed to continuously monitor, baseline, and detect threats, and audit our network and systems. In addition, we use a combination of technology tools with outside managed security service providers designed to capture, analyze and respond to security anomalies. • Patch management – we use a network vulnerability scanning tool that continually scans, and reports identified vulnerabilities in servers and workstations in certain networks. Vulnerability scanner reports are used to drive patching and remediation efforts and are also used as a tool to evaluate the effectiveness of efforts to seek to ensure patches are applied timely. Application and infrastructure subject matter experts subscribe to various third-party vendor security notifications to receive proactive notifications on, among other things, bugs, security flaws and mitigations, related to operational and information systems.


text: The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be wide reaching and to intersect with various other enterprise risks. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with our use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers.


text: We regularly engage independent third parties to periodically assess our cybersecurity posture. These assessments include penetration tests, purple team activities, health checks and point-specific technical cybersecurity assessments of key systems. Some of these assessments are performed with internal audit oversight and tested in regular intervals.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Cybersecurity Governance Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we take seeking to mitigate and address those cybersecurity risks. Our Chief Information Officer (CIO) oversees our cybersecurity activities and leads our team of cybersecurity professionals responsible for our cybersecurity program and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our cybersecurity programs. Our CIO and other cybersecurity professionals provide periodic updates regarding cybersecurity risks to our Cyber Incident Response Steering Committee and Board of Directors.


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. We have developed an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the board of directors and our management. The program is designed to identify and assess risks most critical to our success including through an analysis of the likelihood of occurrence and potential impact of each risk. The executive leadership team, including our Chief Executive Officer, and our management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing, managing and mitigating risks with Board appropriate oversight.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Our cybersecurity risk management includes enterprise-wide monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on our services, systems, resources, or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Our cybersecurity monitoring and identification efforts include the use of a third- party managed detect and response security service to monitor and take action as necessary, with the response ranging from automated processes to immediately block and remove undesired risks to cybersecurity team review and action, depending on the nature and severity of the risk. We have a Cybersecurity Incident Response Plan which provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, and includes activating crisis, or business continuity recovery plans, as appropriate. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.


text: Cybersecurity Governance Our Audit Committee and board of directors provide ultimate oversight of our cybersecurity risk management. Our Chief Information Security Officer, who also functions as our Chief Information Officer ("CIO"), provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as our processes, program and initiatives for managing these risks. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity.


text: Our CIO, who reports directly to the CEO, has significant professional experience including senior technical leadership roles at public companies and maintains the certified information systems security professional (CISSP) certification. Under the direction of the CIO, our information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks and conducts regular enterprise-wide training on cybersecurity threats for all employees. This analysis drives our long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the department and are communicated to the board of directors regularly.


text: Risk Management and Strategy We are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems. Accordingly, security incidents are evaluated, classified by severity and prioritized for response, mitigation and remediation. From a high level, our incident response framework consists of five elements: (1) proactively identifying and appropriately managing cybersecurity risks to our systems, assets, data, and other capabilities; (2) designing and implementing the appropriate safeguards to timely deliver business services; (3) implementing systems and processes to detect the occurrence of cybersecurity events; (4) responding to events in a systematic and comprehensive fashion; and (5) utilizing mechanisms to promote system resilience and the restoration of critical business functions that may have been impaired due to a security incident.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Fundamentally, our information security program is tasked with developing pragmatic strategies for preserving the confidentiality, integrity and availability of Company and customer information. Pursuant to this approach, we have implemented controls to prevent, detect and mitigate cybersecurity risks posed by third parties. We use various tools and methodologies, including a written incident response plan and cybersecurity insurance, to manage and mitigate cybersecurity risk. Those tools and methodologies are evaluated on a regular and continuing basis. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Through both short-term "game day" events and more prolonged campaigns, red team programming is designed to continuously stress test the fortitude of our information security systems and assist in identifying areas of potential vulnerability. Based on the results of these simulated exercises, we aim to harden any identified exposure points and adjust our security processes to ensure dynamism and responsiveness. Along with our in-house cybersecurity capabilities, we also periodically engage third parties to assist with detecting and responding to cybersecurity risks. Third parties may be engaged to assist with procedures including red and blue team training exercises and penetration testing. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Amongst other controls, we maintain policies and practices that monitor, regulate and limit remote access of our information systems.


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. For more information on the risks from cybersecurity threats that we face, refer to Part I, Item 1A. "Risk Factors," of this Annual Report on Form 10-K, including but not limited to the risk factors titled, "We may be vulnerable to both physical and cybersecurity breaches, which could disrupt our operations and have a material adverse effect on our business, financial condition and results of operations" and "We may be exposed to cybersecurity threats and breaches, which could have a material adverse effect on our business, financial condition and results of operations."


text: Our information security team is led by our Chief Information Security Officer and is comprised of dedicated professionals responsible for overseeing cybersecurity risk management and mitigation, incident prevention, detection and remediation. These teams are spearheaded by professionals with decades of cybersecurity leadership experience across multiple industries, including our Chief Technology Officer. Our leadership working group meets on a weekly basis to discuss our approach to the rapidly-evolving cybersecurity landscape. To ensure that our top-level strategy is disseminated throughout the Company, our information security team provides hands-on and often role-specific training and awareness programs to our employees. Our employees with network access participate annually in required training, including spear phishing and other awareness training. We also periodically conduct simulated phishing exercises to practice appropriate response and augment employee awareness of established and emerging cyber threats.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including cybersecurity risk. Our Board of Directors considers cybersecurity risk and mitigation as a critical component of its risk oversight function and intends to further develop specific cybersecurity oversight functions and protocols. Our Board of Directors administers this oversight function directly through the Board of Directors as a whole, as well as through various standing committees of our Board of Directors, including the Audit Committee, that address risks inherent in their respective areas of oversight. In particular, our Board of Directors is responsible for monitoring and assessing strategic risk exposure and our Audit Committee has the responsibility to consider and discuss our major financial risk exposures and the steps our management has taken to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Audit Committee also monitors compliance with legal and regulatory requirements and is charged with oversight of the adequacy of Company's insurance programs, including cyber insurance.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our cybersecurity risk management program includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment. The information technology and legal departments help identify, assess and manage Sangamo's cybersecurity threats and risks. The information technology department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Sangamo's risk profile using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our board of directors, business continuity plans, encryption of data, network security controls, systems monitoring, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."


text: Our board of directors addresses Sangamo's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Information Technology, who has over 20 years of technology experience which includes extensive cybersecurity implementation and oversight.


text: Our Vice President, Information Technology, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President, Information Technology is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing.


text: Our cybersecurity incident response and vulnerability management protocol is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee of our Board of Directors receives periodic reports from the Vice President, Information Technology, concerning the Sangamo's significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Corporation's information technology resources are managed by a separate Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the CIO, who reports to the Corporation's President and Chief Financial Officer. The present CIO has been employed by the Corporation in the information technology area for twenty-eight years and holds an undergraduate degree in computer science. The Information Technology Department also employs a separate Information Security Officer ("ISO"), whose responsibilities include security relating to the Corporation's information systems. The present ISO is a Certified Information Systems Security Professional and also a Certified Fraud Examiner. The ISO reports directly to the Information Technology Steering Committee and to the Chief Risk Officer. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Corporation's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the CIO and the ISO to both the Risk Management Committee and to the Information Technology Steering Committee, each of which Committees includes the Chief Executive Officer and the President and Chief Financial Officer who are also directors of the Corporation.

companyName: PENNS WOODS BANCORP INC


text: We adhere to industry-leading frameworks to safeguard our systems and data. The primary framework we follow is the HITRUST CSF (Common Security Framework). The HITRUST CSF provides a comprehensive, scalable, and technology-neutral approach to regulatory compliance and risk management. It encompasses information security risk management controls, including risk assessment, mitigation, and evaluation. Our processes for assessing, identifying, and managing material cybersecurity risks align with the HITRUST CSF guidelines.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: We conduct monthly risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology departments. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. For further information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to our Business: Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, or use or other processing of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers, including our Chief Financial Officer and General Counsel, are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its audit committee.


text: Our Chief Financial Officer and Senior Director of Information Technology are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers. Our Senior Director of Information Technology leads our internal team and has over 20 years of cybersecurity experience, including the last 10 years in leadership positions, enabling him to build and transform successful cybersecurity programs and initiatives across several enterprises. His active associations include Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER), Information Systems Security Association (ISSA), and Forum of Incident Response and Security Teams (FIRST), and has held many technical certifications including Strategic Planning, Policy, and Leadership (GSTRT), Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP). Our third-party vendors include assessors, consultants, and auditors holding (but not limited to) the following relevant certifications: Certified Information Systems Security Architecture Professional (CISSP-ISSAP), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE), and Certified Ethical Hacker (C|EH).


text: Our Chief Financial Officer and Senior Director, Information Technology oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Financial Officer and Senior Director, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes company incident management and data protection policies, and applicable cybersecurity incident response playbooks.


text: Our Chief Financial Officer and Senior Director, Information Technology provide periodic briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and the data of our partners ("Information Systems and Data").

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our Chief Operating Officer ("COO") and our information technology ("IT") department help identify, assess, and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting threat and vulnerability assessments, and performing audits.


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a security incident response plan, disaster recovery and business continuity plans, encryption of data, access controls, asset management, and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT department works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to our board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms such as legal counsel, cybersecurity software providers and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as cloud-based infrastructure hosting, data hosting, and encryption and authentication services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which may include regular security assessments, audits, and compliance checks. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.