text: As part of our cybersecurity risk management program, we implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. Additionally, we have established and maintain processes related to incident response and have been developing processes related to business continuity and disaster recovery designed to address our response to a cybersecurity incident. We leverage third parties and cybersecurity consultants as appropriate, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. Further, we have a risk-based process to assess the cybersecurity practices of certain third parties prior to onboarding, including vendors, service providers and other external users of our systems.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX

secItem: Item 1C


text: Our information technology representative, in consultation with our vCISO, is responsible for the day-to-day administration of our cybersecurity policies, processes and practices. The information technology representative and our vCISO meet regularly to review any outstanding cybersecurity risks and to discuss any recommended hardening or remediation measures. The information technology representative reports and provides periodic updates regarding the cybersecurity risk management program to our Chief Financial Officer. The individual currently operating as our information technology representative has 19 years of experience in information technology and information security, including at another public company.


text: The AVROBIO Board has delegated oversight of the Company's cybersecurity risk management program to our Audit Committee, which generally oversees our enterprise risk management program. Our Audit Committee receives periodic updates on the cybersecurity risk management program, including our risk management practices, from our information technology representative. Our Audit Committee reports on cybersecurity risks and risk management to the full AVROBIO Board as appropriate.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Given the increasing reliance on technology and potential cyber threats, information security (and by entailment cybersecurity) is a critical component of this program. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the enterprise risk management organization, which is overseen by our Chief Risk Officer. As discussed below, our CISO reports periodically throughout the year on cybersecurity related risks, threats, and our responses, to the Technology Committee and our board of directors.

companyName: GUARANTY BANCSHARES INC /TX/


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, Guaranty has implemented comprehensive cybersecurity practices. Key components of the cybersecurity program include the following: • A dedicated cybersecurity team working closely with our Information Technology team to cover all critical cyber defense functions such as engineering, data protection, vulnerability management, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A risk assessment process that identifies and prioritizes material cybersecurity risks, identifies and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the Board of Directors. • A Managed Detection and Response ("MDR") service, which provides an additional layer of around-the-clock security monitoring (including intrusion detection and alerting) for information systems. • A training program that educates employees about cybersecurity risks, how to protect themselves from cyberattacks, and encourages general awareness about cybersecurity threats and how to stay safe online. • An incident response plan, which is tested periodically and outlines the steps that will be taken to respond to a cybersecurity incident. The Bank engages reputable third-parties to conduct various independent assessments on a regular basis, including but not limited to security audits, vulnerability assessments, and various other testing.


text: The Bank leverages in-house resources and third-party service providers to implement and maintain processes and controls to manage identified risks.


text: Our Vendor Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to maintain appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Bank's risk management program and strategy are designed to ensure confidential information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank and customer information. Minimally, these controls include identity and access management, data encryption, data loss prevention, incident response, security monitoring and alerting, third party risk management, and vulnerability management.


text: The Bank's risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives.


text: Risks from Cyber Threats Like many businesses, the Bank faces numerous cybersecurity risks in connection with providing services to our customers. Guaranty does not currently believe that any current or pervious cybersecurity threats have materially affected, or are reasonably likely to materially affect the Bank, including its business strategy, results of operations, or financial condition. Unfortunately, the sophistication of cyber threats continues to increase, and the Bank's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. No cybersecurity program will be able to anticipate all cyber threats and breach attempts, and there may exist limitations to the ability to effectively implement preventive measures against such breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Bank's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: Board of Directors Oversight The Board of Directors is charged with overseeing the establishment and execution of the Bank's risk management framework and monitoring adherence to related policies required by applicable regulations and statutes. Consistent with this responsibility, the Board may delegate some responsibilities to the Audit Committee. The CISO holds the primary day-to-day responsibility for the strategic, operational, and risk management components of cybersecurity. The Audit Committee, and the board through summary reports, receives updates on cybersecurity risks and incidents and the cybersecurity program through direct communication with the CISO. Additionally, awareness and training on cybersecurity topics is provided to the Board at least annually.


text: Management's Role The Information Security department is responsible for implementing and maintaining the Banks's Information Security program, which addresses cybersecurity risk management and cyber threats. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Financial Officer and with dotted-line reporting to the Audit Committee. Additionally, the CISO is a key member of the Technology Committee, which is charged with Bank's managerial oversight and steering organization for all information technology areas (including cybersecurity).


text: The Bank's CISO has over 20 years of experience in cybersecurity across various verticals. Our CISO brings a wealth of expertise to his role. His background includes extensive experience and certifications in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The Bank's CISO remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist the Information Security team in such knowledge acquisition, we subscribe to services that provide Bank personnel with alerts on security incidents and threats. Our CISO oversees the implementation and processes for regular monitoring of our information systems. This includes the deployment of advanced security measures and regular internal/external assessments to identify potential vulnerabilities. In a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our Company's risk management, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the Committee of Sponsoring Organizations of the Treadway Commission 2013 Framework. In general, our Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: STORE CAPITAL LLC


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our board of directors' oversight of cybersecurity risk management is supported by our Senior Vice President of Information Technology, who leads our cybersecurity team, which is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and ensuring our compliance.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that would provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments, audits and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. Further, we perform ongoing phishing simulations to help employees recognize, avoid and report potential threats that could compromise critical business data and systems. Additional mandatory training is provided to employees who engage in potentially compromising activities during these simulations.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We may engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to those charged with governance by our Senior Vice President of Information Technology, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these activities.


text: Our board of directors oversees our risk management approach, including the management of risks arising from cybersecurity threats. Our board of directors receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our board of directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our board of directors discusses our Company's approach to cybersecurity risk management with management.


text: Our board of directors, in connection with management led by our Senior Vice President of Information Technology, work collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our Company are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our board of directors monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our Senior Vice President of Information Technology has served in his role since January 2020 and has managed STORE's Information Technology department since joining the Company in January of 2015. In these roles, he has been instrumental in the evolution and implementation of our business systems and technical infrastructure as well as the development and enforcement of Sarbanes-Oxley (SOX) compliance processes and reporting. Prior to joining STORE, he was the Chief Information Officer for Southwest Network, a non-profit organization for mental and behavioral health services serving the greater Phoenix, Arizona community. He has over 35 years of experience in the information technology industry serving in several technical and leadership positions.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have had or are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Identiv, Inc.

ticker: INVE


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize using tools such as a SIEM (Network and Cloud Platform Log Collector), Network Vulnerability Scanner, and other utilities for monitoring all Company assets. We conduct these risk assessments directly and also engage security product platform support teams as needed.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, IT team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our Company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such threats or incidents in the future. Like any technology provider, we have experienced cybersecurity incidents in the past which were remediated on a case-by-case basis. See "Risk Factors" for more information on our cybersecurity risks.


text: Cybersecurity Governance One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has been responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and, going forward, the audit committee of our board of directors will oversee management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CEO has over 30 years of experience in information technology and cybersecurity risk management at the Company and at similar companies, and our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. As part of our continued investment in developing our overall risk management process, going forward, our Global Director of IT will provide periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee will provide periodic reports to the board of directors on such matters.


text: As a company, we devote significant resources to cybersecurity and risk management processes in order to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is led primarily by our Vice President - Cybersecurity & DevOps, who has over 15 years' experience in cybersecurity, information technology, and related compliance and holds a Certified Information Systems Security Professional certification. The information security team works cross-functionally, with significant involvement from other members of senior management and oversight by the Board.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: The information security team is responsible for, among other matters: • designing, implementing and periodically assessing our cybersecurity safeguards and related policies and procedures, including those pertaining to encryption standards, antivirus protection, remote access, multi-factor authentication, data classification, device management, and the use of the internet, social media, email and wireless devices; • monitoring current and emerging cybersecurity threats to which the business may become exposed; and • providing oversight of risks of cybersecurity threats associated with our use of third-party service providers, including reviewing such engagements when proposed in order to identify and assess risks potentially arising therefrom.


text: In addition, the information security team is responsible for obtaining and maintaining Service Organization Control Type 2 ("SOC-2") certification for the Company's product portfolio. The Company has obtained SOC-2 certification for many of its products, which subjects those products to an annual compliance audit conducted by a third party, and we work to include progressively more products within the scope of the audit year over year.


text: We view cybersecurity as a shared responsibility throughout the Company. At a management level, we periodically perform tabletop exercises incorporating external resources, advisors and relevant members of the Board as needed. The Company requires all employees to participate in an annual cybersecurity training reviewed by the information security function, and management regularly communicates with employees about potential cybersecurity risks and methods for reporting incidents. The Company has adopted and maintains an Incident Response Plan, which provides for various methods of reporting and escalation of incidents, activation of an incident response team consisting of relevant cross-functional leaders (e.g., legal, information security, operations), assessment of the severity of incidents, processes for investigating and remediating incidents and compliance with related legal and regulatory obligations, among other matters. The Incident Response Plan provides for the involvement of the Company's Disclosure Review Committee to assess the materiality of cybersecurity incidents and any disclosure obligations required in respect thereof. Management periodically reviews the Company's cybersecurity risk management strategy and processes - including the Incident Response Plan - to assess their efficacy in light of current and emerging threats.


text: The Company's Board, which is responsible for oversight of risk management related to our business as a whole, has delegated responsibility to the Audit Committee for oversight of the Enterprise Risk Management ("ERM") program and cybersecurity risk, among other matters. Cybersecurity risk is among the risks monitored by the ERM program, which establishes an annual cadence for identifying material risks facing the Company, as well as quarterly reporting to the Audit Committee on the severity of each such risk and mitigation measures being implemented. The Audit Committee also receives an annual update from the information security function on the Company's current cybersecurity risks, recent enhancements to the Company's safeguards and related policies. The Company's Incident Response Plan provides for notification of and consultation with the Audit Committee in the event of a cybersecurity incident exceeding specified levels of severity.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to, and breaches of, our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled, "Cyberattacks, security, privacy, or data breaches or other security incidents that affect our networks or systems, or those of our service providers, involving our or our customers' sensitive, personal, classified or confidential information could expose us to liability under various laws and regulations across jurisdictions, decrease trust in us and our products and services, increase the risk of litigation and governmental investigation, and harm to our reputation, business, and financial condition" in Item 1A- Risk Factors - "Information Technology and Data Risks."


text: As discussed in this Annual Report on Form 10-K, the changes in our business and operations that will occur in connection with our review of strategic alternatives may impact our cybersecurity program in the future. As such, the following section describes the Company's cyber risk management and strategy, and governance related to cybersecurity risks, for the fiscal year that ended December 31, 2023. For more information regarding the changes to our business and operations and associated risks, please see (i) Item 1 – Business, (ii) Item 1A – Risk Factors, and (iii) Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operations in this Annual Report on Form 10-K.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Cyber Risk Management and Strategy We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information in our day-to-day operations. To help protect against risks from cybersecurity threats to these systems, we have implemented cybersecurity processes in accordance with our risk profile and business that are designed to identify, assess, and manage cybersecurity risks.


text: We leveraged internal and external resources to support our cyber risk management efforts, including security monitoring tools, periodic penetration tests and vulnerability assessments, and employee cybersecurity awareness training. We have in the past also engaged the services of external information security service providers to help support our information technology environment, assist with security monitoring, and help us draft and implement information security policies.


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process has included a review by our external partners, as appropriate.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. As mentioned above, the changes in our business and operations may impact our cybersecurity program in the future. In addition, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.


text: Governance Related to Cybersecurity Risks Our Vice President, Head of Information Technology meets periodically with representatives from our external partners to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats. The individual who currently holds the title of Vice President, Head of Information Technology has approximately 20 years of experience in information security and cybersecurity risk management. Our Vice President, Head of Information Technology reports to the Chief Financial Officer.


text: We have established a process for management, including our Vice President, Head of Information Technology and Chief Financial Officer, to report to the Audit Committee on potential major cybersecurity risks, their potential impact on us, and the steps we take to manage them. The Audit Committee considers identified cybersecurity risks and the steps that the Company's management has taken to monitor and control such risks in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines, as appropriate. The Audit Committee has periodically reviewed and discussed the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents.


text: Our board of directors oversees management of our cybersecurity risks through the Audit Committee. As needed, the chairperson of the Audit Committee provides updates on the Company's cybersecurity risk program to the full board of directors.


text: QNB maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, QNB's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the QNB's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: QNB CORP.

ticker: QNBC


text: As part of the QNB's overall risk management processes, it has established both the Information Technology Committee and the Security Committee. The Technology Committee comprises the executive management team, selected department heads, and the Information Security Officer ("ISO"). The Technology Committee reports to the Board of Directors. The second committee is the Information Security Committee, composed of QNB's Chief Operations & Technology Officer ("COTO"), the Information Technology Director, and the ISO. The Information Security Committee reports to QNB's Audit Committee. QNB's COTO presents a detailed report on information systems and cybersecurity matters to the Board of Directors at least once annually. The Board of Directors also receives and reviews copies of minutes of all meetings of the Audit Committee and the Information Technology Committee.


text: QNB Bank's information technology resources are managed by the Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The present COTO, who reports directly to the current President and Chief Executive Officer ("CEO"), has been with QNB Bank for over eight years and has over twenty-five years of experience in banking technology and operations. He has an MBA in Management Information Systems and is a current Certified Information Systems Security Professional. QNB's IT Director and ISO report directly to the COTO. The Information Technology Department is managed by the IT Director. The present IT Director has been employed by QNB Bank in the information technology area for ten years has been in the technology industry for over fifteen years and holds numerous technology certifications. QNB's ISO, whose responsibilities include security relating to QNB's information systems, is a Certified Information Systems Security Professional and a Certified Information Security Manager. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to QNB's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the COTO and the ISO and to both the Information Technology Committee and the Information Security Committees. Additionally, cyber security incidents are reported to QNB's Board of Directors by the COTO no less than quarterly.


text: QNB maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures, including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Information Security Committee and is reviewed and tested at least annually.


text: QNB uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing, and vulnerability assessment. The Information Security Committee has established risk management guidelines for third-party vendors. QNB conducts due diligence reviews of third-party vendors before contracts or agreements for the provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, QNB's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed at least annually. QNB cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, QNB may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that QNB shares with such providers.


text: To date, QNB has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect QNB, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by QNB to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, QNB may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented QNB's cybersecurity controls and procedures are, and QNB may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, processes, and practices, which are integrated into the Company's overall risk management process. To protect the Company's information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Managing Material Risks & Integrated Overall Risk Management The Company has incorporated cybersecurity risk management within its Enterprise Risk Management framework. Led by the Company's Senior Vice President of Operations, the Company's risk management team, comprised of senior management team members, integrates the evaluation of cybersecurity risks in accordance with its business objectives, operational needs, and legal requirements.


text: Acknowledging the intricate and dynamic landscape of cybersecurity threats, the Company collaborates with external experts, such as cybersecurity assessors, consultants, and auditors, to assess and test its risk mitigation tools. The Company's engagement with these external entities encompasses routine reviews, threat assessments, and ongoing consultations to enhance the Company's security measures.


text: Prior to engagement, the Company undertakes security assessments of third-party providers that process or store confidential Company information, and monitors their activities for alignment with the Company's cybersecurity standards. This monitoring involves evaluations performed by the Company's team of security analysts, and annual review by the Company's Chief Information Security Officer ("CISO").


text: Risks from Cybersecurity Threats Refer to the risk factor captioned "A failure in the Company's operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company's business, its reputation, and / or cause losses which would have a material effect on the Company's business operations and financial results" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks that could materially impact the Company's business strategy, results of operations or financial condition.


text: Management's Role Managing Risk The CISO advises the Enterprise Risk Management Committee (the "ERM Committee") of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis: • Company threat profile and emerging threats; • Status of cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: The Company conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk mitigation strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the CISO. The CISO has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company's compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.


text: Monitoring Cybersecurity Incidents The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan ("CIRP") supported by a cross-functional cyber incident response team ("CIRT"). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompasses detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.


text: Reporting to Board of Directors The ERM Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of aspects related to cybersecurity risks and incidents. Furthermore, the CISO escalates significant cybersecurity matters to the ERM Committee.


text: The Board has established oversight mechanisms to govern risks associated with cybersecurity threats because they recognize the significance of these threats to the Company's operational integrity and stakeholder confidence.


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and our customers' information, from cybersecurity threats against us, our third-party vendors, and services providers, that may result in a material adverse effect on the confidentiality, integrity, and availability of our information systems.

companyName: Techpoint, Inc.


text: Our Technology Team is responsible for the implementation, monitoring, and maintenance of cybersecurity and data protection practices across the Company. The Technology Team includes members who have experience in network security, server integration and data protection. In conjunction with a cross-functional team, our Technology Team regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to our internal cybersecurity capabilities, we also regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to participate in tabletop and other training exercises. The Technology Team monitors and is informed about cybersecurity incidents through firewalls that are triggered in our information technology systems.


text: Board of Directors Our board of directors, in coordination with the audit committee of our board of directors, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our audit committee regularly receives reports and presentations from the Technology Team regarding cybersecurity. The Technology Team also reports to our board of directors at least annually on cybersecurity matters. We plan to establish protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, are reported to our board of directors and/or our audit committee.


text: Risk Management and Strategy We employ a defense-in-depth approach with systems and processes designed to oversee, identify, and reduce the potential impact of a security incident against us or a third-party vendor or service provider. These include but are not limited to: multi-factor authentication, Endpoint, email, immutable backups, third party risk assessments, and other applicable controls.


text: Incident Response We have adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity incident that provides a standardized framework for responding to cybersecurity incidents. The IRP is expected to be integrated into our overall risk management system and applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats and have materially affected or could materially affect us, including our business strategy, results of operations, or financial condition.


text: We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. To date, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see "Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation" included as part of our risk factor disclosures in Part I, Item 1A of this report.


text: We have adopted and continue to maintain a cybersecurity risk management program that implements various controls, technology, and procedures for the evaluation, identification, and handling of significant cybersecurity risks that could impact the confidentiality, integrity, or availability of our information systems.


text: Our practices include, among others, providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying tools for the detection and analysis of anomalous network activities, and implementing containment and incident response procedures. We are committed to staying abreast of the latest industry standards, and we actively participate in industry forums to exchange insights and stay ahead of emerging cybersecurity threats.


text: A critical component of our cybersecurity strategy is the integration of a third-party Security Operations Center support, which monitors our global network environment on a 24/7/365 basis, and is designed to rapidly identify and respond to threats. This program monitors both internally detected and externally reported vulnerabilities that could impact our products, which are then evaluated for their cybersecurity implications according to Company protocols. We also utilize third-party service providers as part of our cybersecurity risk management program and maintain a framework for managing cybersecurity risks presented by our third-party Service Providers. This framework governs the third party's security management system and mandates that the program (i) adhere to certain information handling and asset management protocols and (ii) promptly notify us of any cybersecurity incidents that impact its systems.


text: Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy. This process involves an annual evaluation of the spectrum of risks facing the enterprise, including those related to cybersecurity. When elevated cybersecurity risks are detected, designated risk owners are tasked with formulating and overseeing the execution of targeted mitigation strategies.


text: This risk management approach informs decision-making processes related to the company's strategic priorities, the allocation of resources, and the establishment of oversight mechanisms. The governance of this program resides with our Board of Directors, which bears the ultimate responsibility for the oversight of cybersecurity risks. Supporting the Board, the Audit Committee plays a pivotal role by engaging in regular reviews of our cybersecurity efforts in collaboration with management and providing periodic updates to the Board. These assessments are conducted at least quarterly, with additional sessions convened as needed to address emerging issues or refine strategies.


text: Our Chief Information Officer ("CIO")/Chief Information Security Officer ("CISO") leads our cybersecurity program and reports to our Chief Executive Officer. The CIO/CISO stays informed of prevention, detection, mitigation, and remediation efforts through regular communication with professionals on our cybersecurity team, many of whom hold certifications such as Security+, Certified Information Systems Security Professional or Certified Information Security Manager. The CIO/CISO also utilizes technological tools, software, and third-party audits to monitor our cybersecurity efforts. Our CIO/CISO joined the Company in November 2018 and brings a wealth of experience from leading cybersecurity initiatives in previous roles. Our Chief Technology Officer ("CTO") joined the company in January 2023 following the Business Combination and previously served as Adtran Networks' CTO, leading their product management and advanced technology teams. Our CTO helps oversee our product security programs. Both the CIO/CISO and CTO have extensive experience in assessing and managing cybersecurity programs and risks. Our CIO/CISO reports to the Audit Committee and the Board of Directors on our cybersecurity program and efforts. Additionally, we have an escalation process in place to inform senior management and the Board of Directors of any material issues.


text: Risk management and strategy We have implemented and maintain policies and processes designed to assess, identify, and manage material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data"). We have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: biote Corp.

ticker: BTMD


text: The cybersecurity function within the Company, which comprises, in part, our information technology ("IT") security director (who has several years of commercial experience and a master's degree of information systems with a focus on cybersecurity) and other members of our technical staff management, along with our legal advisors, risk management team, and overall information security function, helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT security department, under the direction of our Chief Information Officer ("CIO") and led by our IT security director, identifies and assesses risks from cybersecurity threats by monitoring cybersecurity and operational risks using various security tools designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes automated tools, security assessment and monitoring; restricted physical access to servers and network equipment, system audits and third party assessments, third-party IT vendor risk management process to assess and manage risk presented by our IT vendors, third party threat assessments, evaluating threats reported to us, and annual review of cybersecurity insurance policies and the associated levels of coverage based on current risks.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan, a vendor risk management program, employee training, data encryption, physical security, dedicated cybersecurity staff, systems monitoring, cyber insurance, and asset management, tracking, and disposal.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, managed cybersecurity service providers, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: See our risk factors under Part I, Item 1A Risk Factors in this Form 10-K for additional information regarding cyber-security related risks that could materially affect our business strategy, results of operations, or financial condition.


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Board of Directors and Audit Committee receive quarterly reports on information security from our CIO. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our CIO, who reports to our chief executive officer. We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards. Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: Our IT security director reports to our CIO and has more than 25 years of experience working in information technology-related roles, holds a Masters in Information Systems, with a focus in cybersecurity and a Masters in Business Administration, with an emphasis in business intelligence and analytics management.


text: Cybersecurity Risk Management and Strategy The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats. Our processes include, but are not limited to, the following: • Engaging cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices; • Providing periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • Employing a variety of preventative and detective tools designed to monitor and block suspicious activity.

companyName: Velocity Financial, Inc.

ticker: VEL


text: Our Chief Information Officer (the "CIO") is primarily responsible for this cybersecurity component, reporting directly to the Chief Executive Officer, who periodically reports to our Board of Directors. To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents.


text: Cybersecurity Risk Management and Strategy Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program. Our cybersecurity program has been built around the National Institute of Standards and Technology (NIST) framework with flexibility to support our product development, deployment, operations, and monitoring. The NIST framework organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover, with an emphasis on prevention, detection and mitigation. We have key Company policies that directly or indirectly relate to cybersecurity matters, including policies relating to antivirus protection, remote access, multifactor authentication, restricted access based upon business need and confidentiality of information, as well as procedures designed to reduce phishing, increase employee awareness of phishing attempts and other activities. The key elements of our efforts to identify, prevent, mitigate, and remediate cybersecurity risks and incidents through our cybersecurity risk management program include: • We collect and analyze information about cybersecurity risks as part of our risk management program and monitor and discuss public alerts, threat levels, trends and remediation. • All employees receive periodic cybersecurity training and are exposed to phishing simulations designed to educate concerning the recognition of cybersecurity threats. • We use various security tools, including internal reporting, monitoring, and bug bounty programs, to identify vulnerabilities in our products. • Regular system updates and patching are done to protect our hardware and software against security vulnerabilities. • We conduct simulations, drills, and penetration testing to test our defenses and monitor threat levels, including the periodic performance of simulations and tabletop exercises to test our policies, incorporating external resources and advisors as needed. • We have controls and procedures in place for prompt escalation of cybersecurity incidents and regularly evaluate and update contingency planning, including plans in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. • We partner with third-party security consultants to review our incident response process and ensure our programs align with industry standards. • We assess the cybersecurity preparedness of key vendors, review any reports on system and organizations controls, before onboarding and monitor their vulnerabilities, including any publicly reported vulnerabilities. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the type of provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. • We have a cybersecurity risk insurance policy.

companyName: Cambium Networks Corp

ticker: CMBM


text: While we have not experienced any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition, we experience cyber-attacks and other attempts to gain unauthorized access to our systems on a regular basis, and we anticipate continuing to be subject to such attempts. Despite our implementation of security measures, (i) our products and services, and (ii) the servers, data centers, and cloud-based solutions on which our and third-party data is stored, are vulnerable to cyber-attacks, data breaches, malware, and disruptions from unauthorized access, tampering or other theft or misuse, including by employees, malicious actors or inadvertent error. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors -Cyber-attacks, data breaches or malware may disrupt our operations, harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business; and cyber-attacks or data breaches on our customers' networks, or in cloud-based services provided by or enabled by us, could result in claims of liability against us, damage our reputation or otherwise materially harm our business" and"-Vulnerabilities and critical security defects, prioritization decisions regarding remedying vulnerabilities or security defects, failure of third-party providers to remedy vulnerabilities or security defects, or customers not deploying security releases or deciding not to upgrade products, services or solutions could result in claims of liability against us, damage our reputation, or otherwise materially harm our business."


text: Cybersecurity Governance Cybersecurity risk is part of management's risk oversight, although periodic reports are made to the board of directors of management's implementation and monitoring of our cybersecurity risks programs. Our board of directors addresses our cybersecurity risk management as part of its general oversight function, and the board receives periodic reports from management on the results of our tabletop exercises designed to test our response to cybersecurity and other business interruption situations. Management will update the board, as necessary, regarding any significant cybersecurity incidents should they occur, following the controls and procedures laid out in our business continuity, disaster recovery, data breach and crisis management plans that are designed to ensure prompt escalation of certain cybersecurity incidents, so that decisions regarding public disclosure and reporting of such incidents can be made by management and the board in a timely manner.


text: Our cybersecurity team is led by our Vice President, IT, who reports to our Senior Vice President, Operations. Our Vice President, IT, has an M.S. degree in computer science and 31 years of experience in the information technology industry. Our cybersecurity functions include representatives from information technology, information security, legal, impacted product teams or products and other departments as needed. This team reviews enterprise risk management-level and product-based cybersecurity risks. This team is responsible for assessing and managing our material risks from cybersecurity threats and our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: Primary responsibility for our cybersecurity program rests with our Vice President of Information Technology, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of work experience at the Company and elsewhere. The Vice President of Information Technology is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Financial Officer. The Vice President of Information Technology at times attends meetings of the Board to report on any material developments and risk management practices.


text: The Vice President of Information Technology meets regularly with members of our information technology team, which includes a security architect whose responsibilities are dedicated solely to cybersecurity matters, a network engineer, and infrastructure director to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our cybersecurity team also works with our Chief Legal Officer to oversee compliance with legal, regulatory and contractual security requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We regularly conduct penetration and vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee, but retains overall oversight responsibility for cybersecurity matters. The Board and Audit Committee periodically review the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board and Audit Committee receive reports from members of our team responsible for overseeing the Company's cybersecurity risk management, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee discusses with such members of our management team our information technology systems and procedures and will report to the Board on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board and Audit Committee in a timely manner.


text: We have adopted an Information Security Incident Response Policy that applies in the event of a cybersecurity threat or incident (the "ISIRP") to provide a standardized framework for responding to security incidents. The ISIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The ISIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third party vendor on retainer to assist in such incidents.


text: As detailed elsewhere herein, we also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.


text: Governance Related to Cybersecurity Risks Our board of directors holds overall oversight responsibility for the Company's strategy and risk management processes, including in relation to cybersecurity risks. Our board exercises its oversight function through the audit committee, which oversees the assessment and management of risk exposure across various areas, including cybersecurity. Our audit committee receives regular reports from our Chief Financial Officer on significant cybersecurity matters, including, where appropriate, whether any significant incidents have occurred.

companyName: Markforged Holding Corp


text: Our IT Security Steering Committee, which is led by our Chief Financial Officer, is composed of various members of our organization, including our Chief Human Resources Officer, VP of Software Engineering, and Senior Director of TechOps and Security. The IT Security Steering Committee is involved in oversight of cybersecurity risk. The IT Steering Committee exercises this function through our IT Security Team, which includes our Senior Director of TechOps and Security and our VP of Software Engineering who collectively have over 40 years of experience. The IT Security Team is responsible for the administration of our cyber program and works with various vendors and external providers to test and monitor for vulnerabilities and threats. We also engage our employees in our cybersecurity efforts through a process for employees to complete annual security and awareness training.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is informed by industry standards and includes processes for identification, assessment, and management of cybersecurity risks. With support from external vendors, we conduct internal and external risk assessments to assess our cyber program and develop strategies for the management of cyber risks. We also employ vendors and external partners to monitor for and manage threats, and we engage in testing to identify vulnerabilities and use third-party tools to scan for potential risks.


text: Our IT Security Team is informed about and monitors the prevention, management, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. Our managed security service provider is also tasked with testing, auditing, and monitoring the performance of our cybersecurity processes. We also maintain processes for reviewing and assessing vendor security before new engagements as part of our Vendor Advisory Board's function.


text: We maintain processes to inform and update management and, as needed, the audit committee, about security incidents that may pose a significant risk for the business, as applicable. In accordance with our incident response policies, our IT Security Team and Chief Financial Officer are responsible for establishing incident response teams to manage cybersecurity incidents, should any arise. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland and the Sub-Advisor. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Advisor to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor, and Dealer Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor, and Dealer Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Advisor and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Advisor, and Dealer Manager, and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, borrowers, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.


text: The Sub-Advisor's cybersecurity program provides a structured approach which serves to promote practices, procedures, and methodologies that seek to appropriately mitigate information security risks on behalf of its investment vehicles and its underlying investors. At all times, the Sub-Advisor seeks to proactively identify potential risks to its business and develop policies and procedures to minimize such risks. The Sub-Advisor has implemented data security policies, which include provisions to limit access to sensitive data only to those who require it; to follow a policy of least privilege; and an authorization process for those who otherwise request access to data. The Sub-Advisor has also implemented backup and recovery procedures, with backup occurring on a nightly basis and disaster recovery tests conducted on an annual basis. The Sub-Advisor's internal systems are protected by security measures, including hardening policies, firewalls, and disaster recovery tests. In addition, the Sub-Advisor makes use of encryption standards on its systems and requires multifactor authentication for remote access. The Sub-Advisor ensures company-related data is compartmentalized on its employees' personal mobile devices and ensures that its employees are trained on and subject to appropriate confidentiality obligations. The Sub-Advisor performs security risk assessments on a monthly basis and additionally conducts internal and external penetration tests on an annual basis.


text: The Sub-Advisor has developed a comprehensive incident response plan and established a Cybersecurity Task Force which leads the effort for enhancing data protection practices and is responsible for administering the cybersecurity policy and determining and implementing the appropriate technical and organizational measures within the firm for the safeguarding of sensitive data. The Director of Information Technology at the Sub-Advisor is primarily responsible for assessing cyber risk and bringing risks to the attention of the other members of the Cybersecurity Task Force. The Sub-Advisor has also engaged a third-party to assist with tasks such as planning incident response plans, conducting tabletop exercises, conducting phishing exams, etc.


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, the Sub-Advisor, and the Dealer Manager and the measures we, the Advisor, the Sub-Advisor and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's, the Sub-Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.


text: Cybersecurity represents an important component of the Company's overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment. While the Board is ultimately responsible for risk oversight, the Audit Committee oversees the overall review of our policies and procedures with respect to risk assessment and risk management, and has oversight of information technology and security matters, which includes cybersecurity strategies and risks, as well as data privacy and data protection ("Information Security"). The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes, and practices that the Company's management implements to address risks from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: On a quarterly basis, our Chief Information Officer reports to the Audit Committee on our Information Security program, including presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, security initiatives, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and vendors; recent cybersecurity-related developments; strategic activities; and the execution of our cybersecurity awareness training. In turn, the chair of the Audit Committee reports out to the full Board on a quarterly basis regarding these matters, among other matters addressed by the Audit Committee.


text: Ongoing internal and external cybersecurity assessments are conducted, which include the evaluation of certain tools, procedures, and policies to measure the program's overall maturity based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework and annual compliance with the Payment Card Industry Data Security Standard to protect customer credit card data.


text: Our cybersecurity program includes: • Vigilance: The Company maintains a cybersecurity threat operation that endeavors to detect, contain and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Partnerships: The Company has established partnerships with a number of third parties, including service providers, to identify and assess cybersecurity risks. • Systems Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments. • Third-Party Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors and service providers. The Company performs due diligence on third parties that have access to our systems, data or facilities that house such systems or data. Additionally, the Company generally requires those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways. • Education: The Company provides periodic awareness training for personnel regarding cybersecurity best practices. Routine security bulletins are sent to personnel throughout the year to enhance awareness of responsibility regarding security risks and we conduct regular phishing exercises. "Security Awareness Month" activities also occur on an annual basis and include sessions with guest speakers, relevant communication, and additional educational opportunities related to security risks. • Incident Response Planning: The Company has established and maintains a written incident response plan that addresses the Company's response to a cybersecurity incident, and such plan is tested periodically with tabletop exercises. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving senior management personnel from the technology, operations, legal, risk management, internal audit and other key business functions (the "cybersecurity team"), as well as members of the Company's Board and the Audit Committee of the Board. • Insurance: The Company carries information security risk insurance that is designed to mitigate against certain potential losses arising from a cybersecurity incident.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through assessments, tabletop exercises and other exercises focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. The Company also engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Company's Chief Information Officer and Audit Committee, and the Company considers adjustments to its cybersecurity processes and practices as appropriate based on the information provided by the third-party assessments and reviews.


text: The Company's Chief Information Officer, who has many years of relevant experience, with support from the other members of the cybersecurity team, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program. We believe our cybersecurity team has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The Company's Chief Information Officer, in coordination with the cybersecurity team, works to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of this program, the cybersecurity team addresses cybersecurity threats and responds to cybersecurity incidents in accordance with the Company's written incident response plan. The Chief Information Officer and cybersecurity team regularly meet to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and the Chief Information Officer consults with executive management, including the CEO, to report such incidents to the Audit Committee and the Board and initiate a response to incidents when appropriate.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are likely to materially affect the Company, including its business strategy, results of operations, or financial condition; however, as further discussed in Item 1A, Risk Factors, if we are unable to protect our information systems against service interruption, misappropriation of data, breaches of security, or other cyber-related attacks, our operations could be disrupted, we may suffer financial losses and our reputation may be damaged.


text: Cybersecurity Risk Management and Strategy To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.

companyName: AWARE INC /MA/

ticker: AWRE


text: The Company has implemented a Cybersecurity Policy (the "Policy") that provides a framework for responding to cybersecurity incidents. The Policy includes requirements for incident disclosure and reporting, protocols for incident evaluation, including the use of third-party service providers and partners, and processes for notification and internal escalation of information to the Company's senior management, incident response team, and Board of Directors (the "Board") and appropriate Board committees. The Policy also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary but no less frequently than once a year, under the leadership of the Company's Chief Security Officer ("CSO").


text: The Board of Directors, primarily through its Audit Committee, oversees the Company's cybersecurity program. Management regularly reports to the Audit Committee on the current state of the Company's cybersecurity program, including the current threat landscape, cybersecurity risks, and any significant incidents. The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: At the management level, the Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported, to the extent required by applicable law.


text: Risk management and strategy We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information technology ("IT") systems and protect the confidentiality, integrity, and availability of our data.

companyName: FTC Solar, Inc.

ticker: FTCI


text: We have integrated cybersecurity risk management into our overall risk management and internal control framework and have established policies and controls that we believe are appropriate in light of the risks of damage to our reputation and financial condition from unauthorized access to our key digital assets and systems.


text: Many of our key IT systems are provided by third parties with extensive experience and knowledge in addressing cybersecurity risks involving those systems and have their own robust system of controls regarding their software products, which we monitor on a recurring basis through review of independent reports on their systems of internal controls provided to us. Such IT systems include our primary accounting, financial reporting, payroll and employee benefits, document storage, email and video communication and employee expense reporting systems. Our internal intranet and IT asset control systems are also managed on our behalf by a third-party service provider, with whom we participate in regular weekly meetings to discuss cybersecurity-related items such as (i) operating and application system patching, (ii) phishing attempts, (iii) malware, (iv) non-compliant devices, (v) third-party secure scorecard results, and (vi) alerts provided through our Security Operations Center.


text: We obtain security incident reports from our third-party software and service providers regarding unauthorized attempts to access our systems, when and if they occur, and we work closely with our third-party providers to explore the details of any unauthorized attempts to infiltrate those systems and to assess whether any critical information within those systems was compromised or not. We also evaluate to the extent possible our system of controls in comparison to information obtained from our third-party providers, as well as our independent accountants and other technology consultants, of practices followed by other companies in safeguarding their systems in order to ensure our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Many of our employees work remotely or in various locations around the world and are provided with company-owned IT equipment. Software and firmware updates to such equipment are managed and controlled by the Company.


text: In order to further protect ourselves financially, we maintain insurance coverage of up to $5 million with respect to losses from business interruption, data recovery, cyber-extortion and ransomware, data breach response and crisis management as a result of a cybersecurity incident.


text: As of the date of the filing of this Annual Report, we have not encountered any cybersecurity incidents that have materially impaired our business strategy, operations or financial standing.


text: Board of Directors Oversight Our Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms to ensure effective governance in managing these risks. The Audit Committee is central to the Board's oversight and has been directed to assume primary responsibility for such oversight by the Board. The Audit Committee is comprised of board members with diverse experience including risk management, technology and finance, which, in the judgment of the Board, equips them with the ability to oversee cybersecurity risks effectively. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance to our management and approval of major initiatives.


text: Management's Role Managing Risk We have established a Cybersecurity Governance Committee, which meets monthly or more frequently, if needed, to monitor: • our current cybersecurity controls and our ability to address emerging threats; • the status of our ongoing cybersecurity initiatives and strategy; • incident reports from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: Our Cybersecurity Governance Committee includes our Chief Financial Officer, Chief Operating Officer, General Counsel, Senior Director of IT, Director of IT, Senior Director of Software, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. We believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight.