text: Risk management and strategy Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. To that extent, the Company has not currently engaged with a third-party service provider for the purpose of managing its ongoing cybersecurity risk. Furthermore, the Company is currently putting processes in place in order to oversee and identify risks from cybersecurity threats associated with The Company employs a full time, degreed internet and technologies engineer, Matthew Bellestri, as its Director of Internet and Security Services. The Company entered into a three (3) year employment agreement with Mr. Bellestri as of February 1, 2025. Mr. Bellestri has also been nominated to serve on the Company's Executive Committee that reports to the Company board of directors.

companyName: flooidCX Corp.


text: The Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

secItem: Item 1C


text: The board of directors now has formal oversight of risks from cybersecurity threats. At the end of 2023, it is important to note that, as discussed in Part III of this filing, our board of directors was comprised solely of Messrs. Danzik, Kitchen and Westbrook. As such, pursuant to the information provided below, all risks from cybersecurity threats our immediately shared with the board of directors.


text: From the last quarter of 2023 through the date of this Report, the Company's President, Dennis Danzik, is responsible for managing the Company's cybersecurity risk. Mr. Danzik has served as the Company's President since 2022. His business experience includes industrial engineering, program development and technical management. Until the beginning of 2025, flooid/Quantum was a small company with a limited number of employees and any cybersecurity threat or incident, of which there were none, were immediately brought to the attention of Mr. Danzik. Further, as noted above, Mr. Danzik would immediately inform his fellow board members, including Messrs. Kitchen and Mr. Westbrook.


text: We are a blank check company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: Inflection Point Acquisition Corp. V

ticker: IPEX


text: The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance. We may in the future engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our existing cybersecurity processes.


text: Risk Management and Strategy The Company's cybersecurity environment is led by its Chief of Staff with input from the Chief Executive Officer and sole director, who in addition to cybersecurity matters, oversees the Company's IT infrastructure and is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats. The Company establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems.

companyName: Onar Holding Corp

ticker: ONAR


text: The Company's cybersecurity principles, goals and targets are defined in a policy approved by the Board of Directors (the "Policy"). This Policy is anchored in a risk-based approach based on industry standards to balance the level of cybersecurity against the risks faced by the Company. Material risks are managed by both internal resources and third-party contractors, with cybersecurity risk monitoring integrated into our overall risk management program. The Company believes that effective information security management is necessary for the secured sharing and protection of information within the Company's cyberspace.

companyName: Cosmos Health Inc.

ticker: COSM


text: The Audit Committee oversees the Policy and its implementation of the Company's oversight, programs, procedures, and policies related to cybersecurity, cybersecurity risks, information security, and data privacy. Team leads from various departments of the Company have been identified under the Policy to report to the Company's CFO overseeing the cybersecurity strategy as defined in the Policy.


text: The management team includes members with IT backgrounds and relevant experience to guide our cybersecurity efforts. Management ensures that employees are provided with adequate resources and training to fully understand cybersecurity guidelines and expectations. In the event of a Policy breach, members of the management team may be asked by the IT Department to assist with security investigations. If any member of management is unaware of the best course of action in dealing with an IT-related matter, the manager shall immediately contact the Company's third-party IT representative. Upon discovering a potential violation of the Policy or a cybersecurity breach, the member of management must document the incident and request the individual surrender possession of any devices that may have suffered a security breach.


text: Additionally, the Company's management reports to the Audit Committee on the Company's and its subsidiaries' strategies, risks, metrics and operations relating to cybersecurity and information security matters, including significant cybersecurity and information security-related projects and initiatives and related progress, the integration and alignment of such strategy with the Company's overall business and strategy, and trends that may affect such strategy or operations.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: Cybersecurity threats have not impacted our operations, and we do not anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, the preventive measures we adopt may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of artificial intelligence ("AI") technologies, and the potential challenges in implementing timely preventive measures.

companyName: Appsoft Technologies, Inc.

ticker: ASFT


text: Risks from Cybersecurity Threats. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024.

companyName: Qrons Inc.

ticker: QRON


text: Governance. Our board of directors, also acting as our audit committee, is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our CEO is responsible for assessing and managing our material risks from cybersecurity threats and conducts this assessment on a regular basis, or at least once per year.


text: As of December 31, 2024, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Winvest Group Ltd

ticker: WNLV


text: Risk Management and Strategy Our cybersecurity policies, standards, processes, and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Catalyst Crew Technologies Corp.

ticker: CCTC


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Executive Officer, who is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: The Company has several methods in place to carry out its security risk management strategy. We currently implement security controls to prevent unauthorized access, including but not limited to geo policies, AV scanning, and VPN restrictions. We use a SEIM to monitor and identify potential threats in order to constantly adjust our security posture.

companyName: Crown Equity Holdings, Inc.

ticker: CRWE


text: All material cybersecurity risks, incidents, and responses are to be reported to the CEO as a routine matter. The CEO then reports the information to the Board of Directors.


text: There are regular tests to ensure readiness. Since security is an ever-changing and evolving platform, we aim to continuously grow our methods to ensure we continue to excel in securing our systems.


text: We employ processes for assessing, identifying, and managing material risks from cybersecurity threats that are incorporated into our overall risk management system. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our system includes procedural and technical safeguards, response plans, and reviews of our policies. We engage various external entities, including consultants, to improve and enhance our cybersecurity oversight. We provide all employees and consultants with cybersecurity and prevention training including timely and relevant topics covering social engineering, phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately. With respect to third parties that assist in our cybersecurity oversight, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, have developed cybersecurity measures for our technology platform that include a variety of safety measures. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " We face cyber security risks that could result in damage to our reputation and/or subject us to fines, payment of damages, lawsuits and restrictions on our use of data " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Information Technology department is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.


text: Although we have designed our cybersecurity program and governance procedures discussed above to mitigate cybersecurity risks, we have experienced, and we may in the future experience cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled " Risk Factors " included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: Our Board has overall oversight responsibility for our risk management, including our cybersecurity risk management. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored. We have not experienced any cybersecurity incidents in fiscal year 2025.

companyName: Minerva Gold Inc.

ticker: MINR


text: Risk Management and Strategy The Company invests in information technology systems for its Herbo website. Such investments, including the implementation of technology updates, improves the Company's customers' experience, and supports both compliance and internal controls. The Company is actively attempting to identify and manage cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is a Company Priority.

companyName: ECO SCIENCE SOLUTIONS, INC.

ticker: ESSI


text: Cybersecurity Risk In recent years there has been an increased risk of information and security risks due to increased sophistication and activities of perpetrators of cyber attacks. The computers are used for our everyday business operations including mobile devices and other online means of activities to connect with our customers, employees, suppliers, and other parties. This extensive use gives rise to cybersecurity risks such as system disruption, theft, and release of confidential information. There is sensitive information stored in the systems and intellectual property, including employees, customers and other financial information.


text: In the future we may be required to expend additional resources to continue to enhance information security measures to investigate and remediate any information security vulnerabilities. We can provide no assurance that the measures we have implemented to prevent security breaches and cyber incidents will be effective in the event of a cyber-attack. Our Directors do not have enough expertise to monitor and manage such risks and will need to rely upon others to help us stay vigilant, process, report, and remediate any incidents.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats for our Company, if any, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Corner Growth Acquisition Corp.


text: As of the date of this Annual Report, we have not yet adopted a formal, written cybersecurity risk management policy or enterprise-wide cybersecurity governance framework. However, we are aware of the growing risks associated with cybersecurity threats and are in the early stages of assessing and developing appropriate controls to identify and mitigate such risks in proportion to our size, scale, and operational complexity. We intend to implement a formal cybersecurity risk assessment and governance policy by Q4 2025. This process will include third-party vendor risk assessment, incident response protocols, and reporting mechanisms to management and the sole director.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: Risk management and strategy While we do not currently have dedicated cybersecurity personnel or a Chief Information Security Officer (CISO), responsibility for cybersecurity-related matters currently resides with our senior management team. Management oversees the implementation of basic safeguards, including secure login credentials, limited network access, and offsite data backups. We rely on third-party cloud-based software and IT vendors for the majority of our infrastructure and data storage, and we depend on their built-in security protocols.


text: We have not yet experienced any known material cybersecurity incidents. However, the lack of a formal cybersecurity risk management framework may expose us to vulnerabilities that could have an adverse effect on our operations, financial position, or reputation if not appropriately addressed in the future. We are currently evaluating the need for a more structured cybersecurity program and anticipate allocating resources to strengthen our risk management processes as we grow.


text: Cybersecurity oversight is provided by our executive officers, who periodically review cybersecurity considerations as part of their general oversight of business operations and IT needs. The Board of Directors has not yet established a dedicated cybersecurity committee or delegated specific oversight responsibility to an existing committee. Cybersecurity risks, to the extent material, are discussed by management with the Board on an ad hoc basis.


text: Our management team is responsible for monitoring industry trends, consulting with outside IT vendors, and taking basic steps to protect company systems and data. Although none of our executive officers have formal cybersecurity credentials, we recognize the importance of increasing our capabilities in this area as we scale our operations and infrastructure.


text: We are committed to using technology to improve our competitive position. We depend on a variety of information systems and technologies (including cloud technologies) to manage the operations of our growing customer base. Our core business systems consist mostly of purchased and licensed software programs that integrate together and with our APP.

companyName: Karbon-X Corp.

ticker: KARX


text: We manage data security and privacy at the highest levels. Our Chief Executive Officer (CEO) is actively engaged in oversight of cybersecurity and IT infrastructure and works with outsourced vendors to manage all network operations. Our vendors keep our CEO informed on cybersecurity and privacy matters throughout the year. We have strengthened our data protection capabilities through investments in our infrastructure hardware and software. During the fiscal year ended May 31, 2025, the Company did not experience any material cybersecurity incidents.


text: Cybersecurity risks are overseen by the full Board of Directors and the Audit Committee as part of their regular oversight. Members of the Board and Audit Committee are encouraged to engage in ad hoc conversations with management on cybersecurity related updates to our risk management and strategy. Cybersecurity incidents are reported to the Chief Financial Officer to determine incident severity and response. In an effort to deter and detect cyber threats, we also provide all employees with access to digital assets with an ongoing cybersecurity awareness training program, which further educates employees and covers timely and relevant topics, including phishing, password protection, asset use and mobile security.

companyName: UPEXI, INC.

ticker: UPXI


text: The Company has established processes to assess, identify, and manage material risks from cybersecurity threats as part of its overall enterprise risk management system. Its cybersecurity processes include security monitoring and detection through third-party vendors. The processes also extend to oversight and identification of risks associated with vendors and customers if their computer systems interface with the Company's information systems. Upon detection of a potentially material cybersecurity incident, the Company initiates its cyber incident procedure to investigate, contain, and remediate the incident.


text: The Custodians are responsible for safekeeping all of the SOL owned by the Company. We maintain multiple Custodians to reduce the risk of a single failure and we plan to expand to additional custodians as our Treasury grows. The Custodian accounts are all opened by the Company, this segregates our assets into an individual custodian account owned by the Company and access is monitored and controlled by the Company. Our Asset Management Company is given access to the Custodian accounts with established controls to ensure transactions require consensus of a minimum of two individuals when assets are being transferred between wallets and additional controls if an asset of the Treasury is moved out of the Custodians control. The assets go through the Custodians Trust Company, which maintains its own insurance and is regulated by their respective state where the trust is incorporated in.


text: Our primary custodian is currently BitGo Trust Company, Inc. a South Dakota corporation ("BitGo") and is regulated by the state of South Dakota. On May 1, 2025, we entered into a Custodial Services Agreement with BitGo (the "BitGo Agreement") to hold our digital currency. The term of the BitGo Agreement is for one year with successive one-year renewals unless prior notice of non-renewal is given by either party. The Company pays BitGo a monthly digital asset storage fee based upon the market value of the assets in storage, plus $500. The BitGo Agreement is terminable by either the Company or BitGo on thirty days' notice as a result of a breach of the Agreement and may be suspended by BitGo if the Company violates the intended use of the account or due to a change in the applicable law, litigation or bankruptcy.


text: Our secondary custodian is Coinbase Inc., a subsidiary of Coinbase Global, Inc., a Delaware corporation, which is primarily used for the acquisition of digital assets. On May 5, 2025, the Company entered into an Institutional Client Agreement with Coinbase (the "Coinbase Agreement"). The Coinbase Agreement is terminable at will by either the Company or Coinbase. The Company pays Coinbase its regularly scheduled fees based on the dollar trading volume over a thirty-day period. The Coinbase Agreement is terminable by either the Company or Coinbase on ten days' notice as a result of a breach of the Agreement and may be suspended by Coinbase if the Company violates the intended use of the account or due to a change in the applicable law, governmental proceeding, litigation or bankruptcy. Coinbase may also close the Company's account if it has been inactive for more than one year.


text: BitGo maintains a $250,000,000 policy against loss, theft and misuse. Currently we have approximately $253,000,000 of treasury value at Bitgo, based on the SOL price of $202.51 per token. Coinbase has an insurance policy for any cash held in the account of $250,000. We currently have less than $250,000 of cash held at Coinbase and less than $6,000,000 in SOL value, based on the SOL price of $202.51 per token. At the current price of SOL as of the date of this report, these policies are not adequate to fully cover the full loss of our SOL.


text: Solana, as with all digital assets, can be highly volatile. Management reviews the account balances and the total value held with a custodians to allocate the Company's holdings between multiple accounts and custodians to mitigate risk. We do not use self-storage for any of the SOL treasury assets.


text: Private keys are generated by the Custodian in key generation ceremonies at secure locations using offline devices that have never been connected to a network. Private keys are generated according to detailed procedures using specialized offline devices and within these secure facilities to mitigate risk of hacks, errors, or other unintended external exposure. Key ceremony processes are highly controlled, require segregation of duties across multiple parties and are reviewed and witnessed by designated oversight personnel. Thorough validations and signoffs are performed to verify the integrity and security of key generation ceremonies.


text: The Custodians hold a majority of SOL in cold storage and provides a user interface for the Company to manage the allocation of SOL between cold and hot storage for the wallets. The Company maintains more than 98% of its SOL treasury in cold wallets.


text: The Custodians have multiple, redundant cold storage sites, which are geographically distributed including sites within the United States. Cold storage locations of the Custodian are monitored by 24x7 on-site security, video surveillance and alarms, hardened room structures, and access to these facilities is controlled by multi-person controls, multi-team access rules, and multi-factor authentication. The locations of the cold storage sites may change at the discretion of the Custodian and are kept confidential by the Custodian for security purposes. Transactions from cold to hot storage require physical access, according to the above controls, to one or more cold storage facilities, as well as systematically enforced approvals and integrity verifications, before the secure device can be used to cryptographically complete the transaction. At no point during this process is the private key removed from the secure device(s) nor the cold storage facility. Once these security processes have been completed, a transfer on the Solana network can be executed, as signed using the private keys held offline in cold storage.


text: The Custodians also maintain geographically dispersed backups of private keys, which are cryptographically generated into shards and stored in separate locations; multiple locations must be accessed to reconstruct a single key. The storage facilities are highly secured, and include 24x7 on-premises security presence, video surveillance, and alarms for unexpected entry. Access to facilities is controlled by multi-person controls, multi- team access rules, and multi-factor authentication.


text: All of our Custodians have SOC type 2 reports that the Company has reviewed and we get regular bridge reports from our Custodians to help ensure the controls are being maintained. Our Custodians maintain their own insurance policies to cover our loss, which is in addition to the policies that we maintain ourselves. We currently have two qualified Custodians that we have approved for our treasury use and we are in the process of onboarding a third as part of our risk management process.


text: The Company is charged for storage fees, staking fees and transaction fees for services specifically requested by the Company or the Asset Management Company. Except as set forth above, the contract terms of the agreements are typically for one to three years and can be terminated upon 30 day notice and payment of all fees due and one month of additional fees.


text: As of July 31, 2025, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Independence Power Holdings, Inc.

ticker: ITXP


text: We rely upon internally and externally managed information technology systems for the collection and storage of sensitive data and business information. We approach cybersecurity risks with a risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to our business.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: Role of Management One of the key functions of our executive officers is to inform oversight of our risk management process, which includes risks from cybersecurity threats. Our executive officer monitor and assesses strategic risk exposure, and manages the material risks we face.


text: Our Chief Executive Officer works to manage our cybersecurity policies and processes. He is responsible for managing how we identify, address, prevent and resolve cybersecurity issues and related matters. He is also responsible for tracking how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan.


text: The Board of Directors now has formal oversight of risks from cybersecurity threats. At the end of 2024, it is important to note that, as discussed in Part III of this filing, our Board of Directors was comprised solely of Messrs. Danzik, Kitchen and Westbrook. As such, pursuant to the information provided below, all risks from cybersecurity threats our immediately shared with the Board of Directors.

companyName: flooidCX Corp.


text: In the ordinary course of our business, we are subject to cybersecurity threats and risk which it manages as an important component of its overall enterprise risk management strategy. We store and process data for our customers, employees, partners and suppliers. We have not yet implemented a formal cybersecurity risk management program designed to identify, assess and mitigate risks from cybersecurity threats to this data, our systems and business operations. We intend to implement a cybersecurity risk management program before the end of 2025.

companyName: T-REX Acquisition Corp.

ticker: TRXA


text: Cyber Risk Management and Strategy Under the oversight of our Audit Committee, we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process. We expect to utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We intend to utilize well-known cloud-based technologies and service providers, such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.


text: No material cybersecurity incidents were identified as of filing date. We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Quantum Genesis AI Corp.

ticker: QTZM


text: As of September 30, 2025, we have not identified any material weaknesses in our cybersecurity controls. Our ability to protect our business from cybersecurity risks is subject to uncertainty, and there can be no assurance that our cybersecurity measures will prevent all potential attacks.

companyName: GEE Group Inc.

ticker: JOB


text: Risk Management and Strategy In the ordinary course of business, the Company is subject to cybersecurity risks, which the Company manages as a component of its overall risk management strategy. The Company's management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. The Company has created a cybersecurity monitoring and reporting framework that it uses to respond to any potential cybersecurity risks. As part of this framework, the Company utilizes a third-party vendor to provide network security and assist with protection against cybersecurity risks through network assessments, monitoring, and related activities. The Company's management continues to assess material risks from cybersecurity threats, its compliance policies, and its reporting framework in order to limit the risk posed by cybersecurity incidents.

companyName: Kingfish Holding Corp


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not affect the Company's business in a material manner. At the effective date of this Annual Report, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Board actively oversees our enterprise risk management program. Our Board's role in risk oversight is consistent with our overall leadership structure: management is responsible for assessing and managing our short- and long-term risk exposures, and our Board and its committees provide effective oversight through independent monitoring of strategic risks and regularly scheduled meetings with management to discuss in-depth the strategic objectives of the Company and associated risks. In order to maintain effective Board oversight across the entire enterprise risk management program, the Board delegates to the individual committees certain elements of its oversight function. The Audit Committee of the Board has oversight of cybersecurity risk and receives regular updates on any developments from our Chief Information Security Officer ("CISO"), including biannual updates on strategies and action plans, with periodic reports provided to our full Board.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: We have an Enterprise Risk Council made up of leaders from our principal functional areas and business units that meets on a quarterly basis to update our enterprise risk framework used to identify and manage our key risks, including cybersecurity. Cybersecurity is a standing item on our Enterprise Risk Council agenda and our cybersecurity team regularly presents its work to the Enterprise Risk Council to enable evolving risks to be integrated into our management processes. All cybersecurity processes and frameworks are created by the Global Information Security team, led by our CISO. Our CISO has a Systems Engineer degree in Computer Science from St. Petersburg University of Information Technology and gained experience in the manufacturing, consultancy, and energy industries prior to joining the Company in 2012. Our CISO is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Information Technology Infrastructure Library (ITIL) v3 Expert, and Certified in Risk and Information Systems Control (CRISC).


text: Our Integrated Information Security Framework ("IISF") defines the policies and processes we have in place to safeguard proprietary and confidential information. Our IISF is based on relevant industry frameworks and laws, including, but not limited to National Institute of Standards and Technology ("NIST"), Good Practices Quality Guidelines (GxP), Health Information Trust Alliance (HITRUST), the ISMS Family of Standards (ISO 27000 family), Control Objectives for Information Technologies (COBIT), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The framework consists of policies, standards, procedures, work instructions and documentation. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. In 2023, we conducted a mapping with the NIST to align our procedures with industry standards in an effort to create a first-in-class approach. Our global data centers and IT controls are included in an annual SOC2 Type II attestation program carried out by an independent audit firm who performs control testing and issue reports. Our set of SOC2 controls is aligned with ISO 27001 specification and therefore provides an equivalent level of assurance on a global level. Additionally, our cybersecurity controls are regularly assessed as part of our global Internal Audit plan, and the maturity of our Information Security program is also regularly assessed on at least an annual basis with the help of independent consultants.


text: Our internal Business Information Security Office ("BISO"), established in 2022, continues to streamline communications between our IT function and business units. The BISO connects several key functions, including Chief Information Officer Business Partnership, business continuity, governance, risk, and compliance.


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, data centers, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery / business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We learn of security threats through automated detection solutions as well as reports from users and business partners. We draw on the knowledge and insight of external cybersecurity experts and vendors and employ an array of third party tools to secure IQVIA information infrastructure and protect systems and information from unauthorized access. We manage risk in our supply chain through engagement with suppliers and vendors, including vendor on-boarding risk assessments, ongoing oversight, and independent cyber-reputation score monitoring for key suppliers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. To protect against such threats, we employ an array of data security technologies, processes and methods across our infrastructure to protect systems and sensitive information from unauthorized access. We maintain comprehensive identity and access management practices (e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employ a variety of security information and event management tools. Non-technical safeguards also play an important role in our cybersecurity program. We provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues. We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Our Board actively oversees our enterprise risk management program. Our Board's role in risk oversight is consistent with our overall leadership structure: management is responsible for assessing and managing our short- and long-term risk exposures, and our Board and its committees provide effective oversight through independent monitoring of strategic risks and regularly scheduled meetings with management to discuss in-depth the strategic objectives of the Company and associated risks. In connection with Board oversight across the entire enterprise risk management program, the Board delegates to the individual committees certain elements of its oversight function. The Audit Committee of the Board has oversight of cybersecurity risk and receives regular updates on any developments from our Chief Information Security Officer ("CISO"), including biannual updates on strategies and action plans, with periodic reports provided to our full Board.


text: We have an Enterprise Risk Council made up of leaders from our principal functional areas and business units that meets on a quarterly basis to update our enterprise risk framework used to identify and manage our key risks, including cybersecurity. Cybersecurity is a standing item on our Enterprise Risk Council agenda and our cybersecurity team regularly presents its work to the Enterprise Risk Council to enable evolving risks to be integrated into our management processes. The Global Information Security team, led by our CISO, create cybersecurity processes and frameworks for use throughout IQVIA. Our CISO is an experienced cybersecurity leader with over 25 years of experience in security, technology and risk management, and has previously served as a public company CISO for a global financial services firm, where he spent 18 years serving in roles of increasing responsibility, leading large cross functional security and technology teams.


text: The IQVIA cybersecurity program employs policies, procedures, guidelines, training, communications, tools, assessments and other methods and resources to identify and manage cybersecurity risks. Our Integrated Information Security Framework ("IISF") defines minimum controls and safeguards used to safeguard proprietary and confidential information. Our IISF is based on relevant industry frameworks and laws, including, but not limited to National Institute of Standards and Technology ("NIST"), Good Practices Quality Guidelines (GxP), Health Information Trust Alliance (HITRUST), the ISMS Family of Standards (ISO 27000 family), Control Objectives for Information Technologies (COBIT), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The framework is integrated with IQVIA policies, standards, procedures, work instructions, documentation and development and oversight activities. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. In 2023, we conducted a mapping of the IISF with the NIST framework to make it easier for customers and other stakeholders to understand how IQVIA's cybersecurity program aligns with published frameworks. Our global data centers and IT controls are included in an annual SOC2 Type II attestation program carried out by an independent audit firm who performs control testing and issues reports. Our set of SOC2 controls is aligned with ISO 27001 specification and therefore provides an equivalent level of assurance on a global level. Additionally, our cybersecurity controls are regularly assessed as part of our global Internal Audit plan, and the maturity of our Information Security program is also regularly assessed on at least an annual basis with the help of independent consultants.


text: Our internal Business Information Security Office ("BISO"), established in 2022, continues to streamline communications between our IT function and business units. The BISO connects several key functions, including the Chief Information Officer Business Partnership, business continuity, governance, risk management, and compliance.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. To protect against such threats, we employ an array of data security technologies, processes and methods across our infrastructure to protect systems and sensitive information from unauthorized access. We maintain comprehensive identity and access management practices (e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employ a variety of security information and event management tools. Non-technical safeguards also play an important role in our cybersecurity program. We provide standard operating procedures, work instructions, guidelines, communications, training programs, tools and other documentation and resources to help employees avoid risky practices, help us promptly identify potential or actual issues and employ cybersecurity requirements in their day-to-day work We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: We recognize the importance of maintaining the trust and confidence of our tenants, business partners and employees with respect to the integrity of our IT network and related systems. We seek to address cybersecurity risks and preserve the confidentiality, security and availability of the information collected and stored on our IT networks and related systems through a comprehensive approach focused on (i) identifying, evaluating and managing our cybersecurity risks, (ii) preventing or mitigating potential threats, and (iii) responding appropriately to security breaches, cyber-attacks, IT network failures and other incidents, if and when they occur. While risk management is primarily the responsibility of our senior management team, our board of directors plays a role in overseeing our cybersecurity risk management program. Our board of directors administers this oversight function directly and with support from its audit committee, which has been delegated the responsibility to evaluate our major financial risks, including our policies and practices to govern the process by which risk assessment and management is undertaken.

companyName: STAG Industrial, Inc.

ticker: STAG


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially and adversely affected the Company (including our business strategy, results of operations or financial condition), nor are such threats reasonably likely to materially and adversely affect the same.


text: For additional information regarding our cybersecurity risks, see "Item 1.A. Risk Factors—Other General Risks—We face risks associated with system failures through security breaches or cyber-attacks, as well as other significant disruptions of our information technology ("IT") networks and related systems" above.


text: Risk Management and Strategy Our cybersecurity risk management program is focused on the key areas below: • Governance. In fulfilling its oversight responsibility, our board of directors receives regular reports from our senior management team on our cybersecurity risks and exposures, infrastructure and countermeasures, and other monitoring, testing and recovery systems. • Collaborative Approach. We use a comprehensive, cross-departmental approach for identifying, evaluating, preventing and/or mitigating cybersecurity threats and incidents, and have implemented controls and procedures that provide for the prompt escalation of significant cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner. • Technical Safeguards. We deploy technical safeguards intended to protect our IT networks and related systems from cybersecurity threats, including firewalls, intrusion prevention, detection and isolation systems, anti-virus and malware functionality, backup functionality. and access controls. These technical safeguards are regularly evaluated and improved through vulnerability assessments, network penetration testing and threat intelligence, including by third-party consultants, who also continually monitor our information security. Any significant developments related to our technical safeguards, including the results of any vulnerability assessments or network penetration testing, are reported to our board of directors, and we adjust our cybersecurity risk management policies and practices as necessary. • Management of Third-Party Risks. We use a risk-based approach to evaluating cybersecurity risks presented by third parties, such as vendors, service providers, and external users of our IT networks and related systems, as well as risks related to our use of third-party systems that could adversely affect our business in the event of a cybersecurity incident centered on those systems. • Education and Awareness. We provide regular, mandatory cybersecurity training for our employees to help them identify and avoid potential cybersecurity threats and understand our policies and guidelines related to our IT network and related systems. As part of this training program, we regularly test our employees for information security awareness, including through random electronic communications designed to simulate how a threat actor might attempt to compromise our IT network and related systems. • Cybersecurity Insurance. We carry comprehensive cyber liability insurance coverage that covers us against claims related to certain first-party and third-party losses, including data restoration costs and crisis management expenses, subject to the policy's coverage conditions and limitations.


text: Our board of directors, together with the audit committee of our board of directors, oversees our cybersecurity risk management program. In addition, the audit committee is responsible for reviewing with management the effectiveness of our internal control structure and procedures for financial reporting systems, including, among other things, our internal controls designed to assess, identify, and manage material risks from cybersecurity threats.


text: On regular basis, our board of directors receives a presentation on cybersecurity risks from our senior management team, which may, depending on relevance at the time of the report, address topics such as prevailing cybersecurity threats, vulnerability assessments and/or network integrity testing, infrastructure and practice updates, and other considerations applicable to our IT network and related systems and other third-party systems.


text: Members of management work collaboratively to develop and implement policies, practices and procedures to protect our IT networks and related systems from cybersecurity threats and to respond appropriately and timely to any cybersecurity incidents. The members of management responsible for our cybersecurity risk management program include our Vice President–Information Technology, our Chief Financial Officer, our General Counsel, our Chief Accounting Officer, our Head of Data, Analytics and Technology, and our Vice President–Financial Reporting and Accounting. Through ongoing communications from employees in each of our Data, Analytics and Technology and Information Technology departments, such members of management monitor our assessment of material cybersecurity risks, our prevention and detection of cybersecurity threats, and, if a cybersecurity incident were to occur, our mitigation and remediation of such incident.


text: We believe the members of our management team involved in assessing and managing material cybersecurity risks have the experience needed to perform their duties, including through education, certification, work experience or a combination thereof. For example, our Vice President–Information Technology has approximately 25 years of IT experience in various roles, the majority of which has been at publicly-reporting real estate companies. In addition, the other members of our management team identified above have from 14 years to 29 years of work experience managing risks or control environments, including experience at the Company and other professional businesses, or, as third-party advisors, helping businesses manage risks or control environments.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially and adversely affected the Company (including our business strategy, results of operations or financial condition), nor, in our view, are such threats currently reasonably likely to materially and adversely affect the same.


text: Risk Management and Strategy Our cybersecurity risk management program is focused on the key areas below: • Governance. In fulfilling its oversight responsibility, our board of directors receives regular reports from our senior management team on our cybersecurity risks and exposures, infrastructure and countermeasures, and other monitoring, testing and recovery systems. • Collaborative Approach. We use a comprehensive, cross-departmental approach for identifying, evaluating, preventing and/or mitigating cybersecurity threats and incidents, and have implemented controls and procedures that provide for the prompt escalation of significant cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner. • Technical Safeguards. We deploy technical safeguards intended to protect our IT networks and related systems from cybersecurity threats, including firewalls, intrusion prevention, detection and isolation systems, anti-virus and malware functionality, backup functionality, and access controls. These technical safeguards are regularly evaluated and improved through vulnerability assessments, network penetration testing and threat intelligence, including by third-party consultants, who also continually monitor our information security. Any significant developments related to our technical safeguards, including any material results of any vulnerability assessments or network penetration testing, are reported to our board of directors, and we adjust our cybersecurity risk management policies and practices as necessary. • Management of Third-Party Risk s. We use a risk-based approach to evaluating cybersecurity risks presented by third parties, such as vendors, service providers, and external users of our IT networks and related systems, as well as risks related to our use of third-party systems that could adversely affect our business in the event of a cybersecurity incident centered on those systems. • Education and Awareness. We provide regular, mandatory cybersecurity training for our employees to help them identify and avoid potential cybersecurity threats and understand our policies and guidelines related to our IT network and related systems. As part of this training program, we regularly test our employees for information security awareness, including through random electronic communications designed to simulate how a threat actor might attempt to compromise our IT network and related systems. • Cybersecurity Insurance. We carry comprehensive cyber liability insurance coverage that covers us against claims related to certain first-party and third-party losses, including data restoration costs and crisis management expenses, subject to the policy's coverage conditions and limitations.


text: Members of management work collaboratively to develop and implement policies, practices and procedures to protect our IT networks and related systems from cybersecurity threats and to respond appropriately and timely to any cybersecurity incidents. The members of management responsible for our cybersecurity risk management program include our Vice President–Information Technology, our General Counsel, our Chief Accounting Officer, our Senior Vice President–Data and Technology, and our Vice President–Financial Reporting and Accounting. Through ongoing communications from employees in each of our Data, Analytics and Technology and Information Technology departments, such members of management monitor our assessment of material cybersecurity risks, our prevention and detection of cybersecurity threats, and, if a cybersecurity incident were to occur, our mitigation and remediation of such incident.


text: We believe the members of our management team involved in assessing and managing material cybersecurity risks have the experience needed to perform their duties, including through education, certification, work experience or a combination thereof. For example, our Vice President–Information Technology has approximately 26 years of IT experience in various roles, the majority of which has been at publicly-reporting real estate companies. In addition, the other members of our management team identified above have from 15 years to 30 years of work experience managing risks or control environments, including experience at the Company and other professional businesses, or, as third-party advisors, helping businesses manage risks or control environments.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity standards and practices are guided by CIS's Critical Security Controls, which provides a framework for prioritizing best practices to improve the Company's cyber security measures.

companyName: Revance Therapeutics, Inc.


text: The Company, using CIS's guidance, approaches cybersecurity threats, through a cross-functional, multilayered approach, for purposes of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, consumers, patients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.


text: Vigilance: The Company's endpoints and networks are monitored 24/7 by its security operations center and the Company conducts periodic reviews and testing to prevent and mitigate cybersecurity threats and respond to cybersecurity incidents.


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Collaboration: The Company collaborates with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: Training: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.


text: Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated annually.


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's IT, legal, enterprise risk and compliance, internal audit and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's Chief Financial Officer, the Company's VP of Information Technology, other members of management and the Company's external Chief Information Security Officer.


text: A key part of the Company's strategy, informed by CIS's guidance, for managing risks from cybersecurity threats is the regular evaluation, ongoing assessment and testing of the Company's processes and practices through assessments, tabletop exercises, threat modeling, penetration testing, employee training and testing (including on phishing scams), and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets preestablished factors, as well as ongoing updates regarding such incident until it has been resolved. Cybersecurity events that meet specified criteria are also escalated to the Disclosure Committee. At least once each year, the Audit Committee holds a meeting dedicated to cybersecurity matters, in addition to receiving quarterly updates on cybersecurity matters at regularly scheduled Audit Committee meetings. On an annual basis, Company management presents to the Board on the Company's approach to cybersecurity risk management.


text: The Company's VP of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with the Company's Chief Financial Officer and other business leaders across the Company, including in cybersecurity and legal and enterprise risk & commercial compliance. The VP of Information Technology has over twenty years of technology experience, during which his responsibilities have included technology operations, third-party assessments and risk management.


text: The Company has established a Core Incident Response Team, which is comprised of the VP of Information Technology and members of the cybersecurity, legal and enterprise risk & commercial compliance teams. The Core Incident Response Team works with other members of the Company's management and collaboratively across the Company to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Core Incident Response Team, along with the Chief Financial Officer, monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time. Cybersecurity events that meet specified criteria are escalated for further review by the Audit Committee and/or the Disclosure Committee.


text: The Disclosure Committee assesses and determines materiality based on the information provided by the Incident Response Team and makes recommendations to the Chief Financial Officer regarding disclosure.


text: In addition, the Company's VP of Information Technology works closely with an external Chief Information Security Officer to provide valuable perspectives and industry insights into evaluating cybersecurity threats. The Chief Information Security Officer has over twenty-five years of experience in cross-vertical security, software, and systems engineering.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: Nutex manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our cybersecurity program is managed by our Director of Information Technology and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Director of Information Technology and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Director of Information Technology and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We will perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Director of Information Technology and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Director of Information Technology and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Director of Information Technology has more than 25 years of information technology experience across the healthcare industry before joining Nutex Health. The Chief Operating Officer has more than 20 years of in-depth knowledge of our business operations that helps integrate the cybersecurity program into the overall business operations.


text: Risk Management and Strategy We believe cybersecurity is critical to our mission to help every person live their healthiest life. Our customers, members, partners, and employees trust Accolade to maintain a secure environment for their health information. We process and maintain sensitive data on our customers and members in the form of PHI and PII and we maintain intellectual property of our solutions and PII of our employees. Because of the sensitivity of this data, we are subject to various cybersecurity threats that could adversely affect our business, customers, and members through impacts to the confidentiality, integrity, and availability of our systems.

companyName: Accolade, Inc.


text: As part of our enterprise risk management ("ERM") program, we maintain a cybersecurity program in an effort to reduce the risk of a breach of our systems or information. Our cybersecurity program includes policies and controls which are regularly reviewed through internal assessments. We have an active HITRUST certification for our expert medical opinion offering and Service Organization Control ("SOC") 2 Type II security compliance reports that are issued by third-party entities for our other offerings. We have controls in place intended to assess our cybersecurity readiness and prevent unauthorized access to our critical systems, including, for example, vulnerability scanning of our systems, detection and blocking of potentially malicious email, multifactor authentication, and security review of our vendors. We also actively engage with the law enforcement community, industry groups, and key vendors to maintain awareness of the evolving threat environment. We have a documented cybersecurity response plan for identification and assessment of cybersecurity incidents, including an escalation process for management to assess the materiality of an incident.


text: Despite our cybersecurity program, we cannot guarantee that we will not be subject to a material cybersecurity incident. For a description of the risks from cybersecurity threats that may materially affect the Company, and how they may do so, see Item 1A-"Risk Factors" included elsewhere in this Annual Report on Form 10-K. As of the date of this Annual Report, we have determined that there have been no cybersecurity incidents which materially impacted our business, financial condition, or results of operations.


text: Our board of directors maintains oversight of our risk management and the audit committee of our board of directors maintains primary responsibility related to overseeing our cybersecurity risk. One member of our audit committee has experience in cybersecurity and provides perspective regularly. We maintain a cybersecurity program to identify, assess, and manage our cybersecurity threats that is led by our Chief Information Security Officer ("CISO") and General Counsel / Chief Compliance Officer. These individuals regularly engage with the audit committee and other members of senior management to discuss cybersecurity risks.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, employees and communities. The Board is actively involved in oversight of the Company's operational and strategic risk management process. With regard to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to cybersecurity and data-protection, including its assessment, identification and management of material risks, mitigation strategy, governance and incident reporting that are based on recognized frameworks established by the National Institute of Standards and Technology (NIST), the International Organization for Standardization and other applicable industry standards. The entire Board receives periodic updates on the Company's cybersecurity risk management progress through the Company's general enterprise risk management ("ERM") program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Overall


text: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives periodic updates from the Company's ERM function, the Company's Executive Director of Information Security & Compliance, other members of management and relevant management committees and councils.


text: Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness The Company launched a security awareness campaign, Be Cyber Smart, that helps employees make sure valuable data remains private, keep physical and digital workspaces secure with good security hygiene, spot potential phishing and malware threats, and avoid risky behaviors. The Be Cyber Smart campaign provides employees with tools and tips for proactive protection measures such as password management, the importance of computer restarts and software updates, security measures when working from home, recognizing and avoiding phishing and maintaining data privacy. In addition, annual compliance, security awareness and acceptable use training, as well as regular phish testing, is delivered to all employees.


text: The Board is responsible for the oversight of the Company's operational and strategic risk management process. The Board oversees a company-wide approach to risk management, carried out by management. The Board determines the appropriate risk for the Company generally, assesses the specific risks the Company faces and receives regular reports of the steps taken by management to manage those risks. With regard to cybersecurity risk, the Board (through the Audit Committee) conducts an annual review of the Company's cybersecurity program, and the entire Board receives periodic updates on the Company's cybersecurity risk management progress through the Company's general enterprise risk management program described in the foregoing sentence.


text: The Executive Director of Information Security & Compliance, with oversight from the Audit Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Executive Director of Information Security & Compliance monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee and Board when appropriate.


text: The Executive Director of Information Security & Compliance has served in various roles in information technology and information security for over 30 years, including serving as the Vice President of Information Technology and Executive Director of Information Security & Compliance for two large companies. The Executive Director of Information Security & Compliance holds undergraduate degrees in information systems and operations management, as well as graduate degrees in information systems and finance and has attained the professional certification of Information Technology Project Management. The Company's CEO, CFO and General Counsel, Corporate Secretary and Chief Risk & Compliance Officer each hold degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: Education and Awareness The Company launched a security awareness campaign, Be Cyber Smart, that helps employees make sure valuable data remains private, keep physical and digital workspaces secure with good security hygiene, spot potential phishing and malware threats, and avoid risky behaviors. The Be Cyber Smart campaign provides employees with tools and tips for proactive protection measures such as password management, the importance of software updates and computer restarts, security measures when working remote, recognizing and avoiding phishing and maintaining data privacy. In addition, annual compliance, security awareness and acceptable use training, as well as regular phish testing, is delivered to all employees.


text: Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. As such, we rely on our advisor's cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Our cybersecurity program, as implemented by our advisor and overseen by our board of directors, is fully integrated into our overall risk management system, and included as part of our information technology security incident response plan. The cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"). These processes include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.


text: Our advisor conducts annual cybersecurity training to ensure all employees are aware of cybersecurity risks and conducts monthly phishing e-mail simulations. Annually, our advisor engages a third party to conduct penetration testing to assess our cybersecurity measures and to review our information security control environment and operating effectiveness. Our advisor also uses a third-party platform to monitor our information security continually. The results of such assessments and reviews are reported to the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments. In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate. For any software platforms that are hosted by third parties, our advisor requires the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional information, see "Item 1A. Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems."


text: Our board of directors is responsible for understanding the primary risks to our business, including risks from cybersecurity threats. The board of directors is responsible for reviewing our advisor's cybersecurity policies with management and evaluating the adequacy of the program, compliance and controls with management.


text: Our advisor's Information Technology Director reports at least annually to our board of directors and to our audit committee as appropriate. These presentations include developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. Our board of directors also receives prompt and timely information regarding any cybersecurity incidents that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. These reports come from a member of our advisor's Executive Committee, comprised of our advisor's key executives and certain department leaders.


text: Our advisor has formed a Cyber Governance Committee ("CGC"), comprised of our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer (also our Chairman of the Board of Directors) and our advisor's Chief Financial Officer (also our Chief Financial Officer) material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.


text: Our advisor's Information Technology Director and Executive Committee are responsible for our incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. Our advisor's Information Technology Director also coordinates with consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.


text: Our advisor's Information Technology Director has 15 years of prior management experience in digital technologies. He has nine years of experience in creating and implementing procedures for managing Payment Card Industries Security Standards (PCI), SOX Cybersecurity measures to include ransomware, email phishing, and data breaches, and bringing into effective action the five pillars of the NIST Cybersecurity Framework.


text: Our advisor has formed a Cyber Governance Committee ("CGC"), comprised of our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer (also our Chairman of the Board of Directors) and our advisor's Chief Financial Officer (also our Chief Financial Officer), material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.


text: Our advisor's Information Technology Director has over 15 years of prior management experience in digital technologies. He has over 10 years of experience in creating and implementing procedures for managing Payment Card Industries Security Standards (PCI), SOX Cybersecurity measures to include ransomware, email phishing, and data breaches, and bringing into effective action the five pillars of the NIST Cybersecurity Framework.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: Notwithstanding the foregoing, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our SVP, Information Technology, as well as our Risk Committee, which includes our Chief Financial Officer, EVP, Business Affairs and General Counsel and Chief Risk Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer, EVP, Business Affairs and General Counsel and Chief Risk Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes technical and managerial expertise, enabling them to proficiently design, engineer, and oversee the organization's overall security stance. Their capabilities encompass a wide range of skills, including proficiency in Security and Risk Management, Vulnerability Management, as well as expertise in Network Security and Operations, and Security Architecture.


text: Our cybersecurity risk management program is i ntegrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Cybersecurity Risk Management and Strategy We face significant and persistent cybersecurity risks due to the global nature of our business, the use of information technology systems, infrastructure and data in our business operations and our reliance on third-party vendors, suppliers, customers and business partners. We defend our systems against cybersecurity attacks on a daily basis and rely heavily on the reliability, security and efficiency of our information technology systems and ongoing employee training to face these threats. In addition, to protect our business, we have implemented a cybersecurity risk management program with a robust governance structure and strong mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. These processes include, among other things, annual security awareness training for employees, programs to increase awareness of phishing attempts, tools to detect and monitor unusual network activity, and processes to contain, escalate and respond to incidents. In addition, we have an enterprise Information Security Policy describing our cybersecurity program and governance structure and the processes and procedures in place to identify, mitigate and remediate cybersecurity threats and risks.


text: To further protect our business, we partner with a third party vendor to provide cybersecurity and risk management as a managed service offering. They provide cybersecurity risk assessment and threat intelligence to the Company, in addition to acting as a managed service provider for our information technology program. We decided to retain a third party for these services given the small size of our Company and internal information technology staff and the quality, comprehensiveness, and cost-effectiveness of the services offered. An internal team, led by our Chief Operating Officer, oversees and works collaboratively with this third party vendor to evaluate the strength of our cybersecurity protocols and the results of testing to determine what additional actions, such as trainings or remedial actions, are necessary to lessen cybersecurity risks. We intend to continue to make investments to monitor and maintain the security of our data and cybersecurity infrastructure.