text: Risk Management and Strategy Our cybersecurity management process is based on an internally developed Intelligence Policy and a Vulnerability Management Framework. Cybersecurity risk management is currently independent of enterprise risk management. Our Vulnerability Management Framework addresses discovery, risk rating, remediation timeliness required per risk, and obligations on reoccurring third-party security products. Risks that fall outside the required remediation timeline are documented on the risk register, which is discussed during periodic Cybersecurity Steering Committee meetings.


text: We have in place a Security and Privacy Incident Response Plan that specifies incident classifications, reporting requirements, and which person must respond to such incidents. In most cases, cybersecurity management is handled by employees of the Company as described above, though if an incident does occur, external counsel and experts related to impacted systems or data may be engaged to supplement the Company's response.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH

secItem: Item 1C


text: Existing third-party relationships are monitored on a risk-by-risk basis via the Vulnerability Management Framework. Before entering into new third-party provider agreements, third-party providers and related services are subject to scrutinization and a review from the AVP of Cybersecurity's team.


text: We are constantly evolving our cybersecurity strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats with respect to our information systems that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Failure to maintain the security and functionality of our information systems, or to defend against or otherwise prevent a cybersecurity attack or breach, could adversely affect our business, financial position, results of operations and liquidity" described under "Risk Factors" contained in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity risk management is an integral part of the Company's overall enterprise risk management framework. Our technology team, together with third-party information security experts, has designed our cybersecurity risk management program with industry best practices in mind and to provide a roadmap for handling cybersecurity threats and incidents, including threats and incidents associated with our use of third-party service providers, and facilitate cross-functional coordination within the Company. This roadmap includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: Specifically, our technology team relies on third-party information security experts for risk assessment, monitoring, and system enhancements. In addition, our technology team provides training to all employees periodically, on an ongoing basis.


text: Our audit committee of the board of directors is responsible for ensuring that management has processes in place designed to identify and evaluate risks, including cybersecurity risks, to which the company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our board of directors and/or our audit committee receive regular updates throughout the year on cybersecurity risks. At least annually, each of our board of directors and/or our audit committee receives reports on cybersecurity matters and related risk exposures from our Chief Technology Officer, or CTO. When covered during an audit committee meeting, the audit committee reports on its discussion of cybersecurity risks to the full board of directors.


text: Management, together with third-party information security service providers, is responsible for assessing material cybersecurity risks on an ongoing basis, ensuring processes are established to monitor and respond to such potential cybersecurity risks, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CTO, who receives reports from our third-party information security service providers and technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as well as resource levels, technology trends and third-party provider risks. Our CTO and technology team are experienced information systems security professionals and information security managers with many years of experience. Management, including the CTO and our technology team, periodically update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – General Risk Factors – Cyber risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition or results of operations." in this annual report on Form 10-K.


text: We place a high priority on securing confidential business information and the personal information we receive and store about our customers and employees. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, which we use, together with information collected from internal assessments, to develop policies for use of our information assets (for example, mobile phones and personal computers) and protection of personal information. We protect these information assets through techniques such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including restricting access to information based on business need. We utilize an established, nationally recognized cloud-services provider to maintain and manage our data with the exception of certain highly sensitive information, which we maintain in separate designated systems with enhanced security controls. In addition, we contract a third-party IT consultant with over twenty years of experience, who manages the core information technology functions of the business including coordinating with our cloud-services provider, implementing new processes, monitoring of our network for cyber threats, and other information technology administrative responsibilities. Throughout the year, we train our employees on cybersecurity awareness, confidential information protection and perform simulated phishing attacks. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have developed a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure and comply with applicable legal obligations. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. To date, we have not experienced a material cybersecurity or information security breach.

companyName: Heritage Global Inc.

ticker: HGBL


text: Oversight responsibility in this area is shared by management, the Board, and its Corporate Governance Committee. To prevent, detect and respond to information security threats more effectively, the Company has established a Management Cybersecurity Committee (MCC) consisting of the Chief Financial Officer, the Executive Vice President, General Counsel and Secretary, the Chief Marketing Officer, business unit leaders, the third-party IT consultant, and other internal and external IT resources. The MCC regularly reports to the Corporate Governance Committee, which in turn reports to the Audit Committee and the Board. The Board also receives an annual update from our senior leadership on cybersecurity and information security matters. The Corporate Governance Committee regularly briefs the Board on these matters, and the Board also receives periodic briefings on cyber threats to enhance our directors' awareness on cybersecurity and information security issues.


text: At its core, our cybersecurity program is the collection of people, processes and technologies that are designed to protect our networks, computers and data from attack, damage, or unauthorized access. The cybersecurity program is also part of a broader cybersecurity framework, which involves how we assess and manage cybersecurity threat risks and how this integrates into our overall risk management framework. While the foregoing summary is specific to our North America business operations we believe that the cybersecurity programs of our International business operations are consistent with the approach and framework outlined below and are appropriate for the scope and scale of their operations.

companyName: Zumiez Inc

ticker: ZUMZ


text: The Security and Compliance Team, within our IT department, takes the lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. The Security and Compliance Team is led by the Security and Compliance Program Manager and consists of a Lead Security Engineer and a Security Analyst. The Security and Compliance Team works very closely with our team across the IT department and with several different third parties who provide expertise in different areas such as threat hunting and penetration testing.


text: Objectives and Key Principles and Priorities The objective of the Security and Compliance Team is to build practices within the company to define, implement, enforce, and measure our security, compliance and disaster recovery readiness. In doing so, it utilizes some of the following key guiding principles and priorities: • Alignment. Working within the organization to clearly define the need for secure computing practices, gaining buy-in on this need and the development of a mindset across the organization around secure computing. • Measurement and Visibility. Developing measurement and reporting methods which inform our stakeholders both in the business as well as external audit and other outside entities as to compliance with various security frameworks and regulatory obligations. • Protection. Using a commonly accepted industry framework to build and ensure the enforcement of policies and procedures which secure the data and systems of all our stakeholders. • Response. Ensuring that that if a security incident occurs there is a clear and well understood response plan which is followed by all response participants. • Resources and Tools. Identifying the resources needed to run the cybersecurity program commensurate with the size and complexity of our company, including identifying and implementing appropriate tools and systems to help strengthen our security posture.


text: On a day-to-day basis and from a project perspective, the Security and Compliance Team undertakes the following activities: • Builds and reviews reports on newly identified security threats. • Monitors various internal security toolsets including EDR (Endpoint Detection and Response), email security and logging from company firewalls and other security related systems and takes action to prevent or resolve incidents identified by monitoring. • Ensures that appropriate vendor patches/configurations are applied to the various internal systems that operate to maintain a secure environment. • Works with various teams with the IT department to ensure that company servers and data are properly backed up and that compliance requirements and security best practices are following during new system implementations. • Deploys and tunes various security and monitoring platforms. • Manages the North America Annual PCI (Payment Card Industry) review and consults with Zumiez international entities regarding PCI. • Provides evidence gathering for, and conducts walk throughs with, internal and external audit teams for internal control over financial reporting related to Section 404 of the Sarbanes-Oxley Act of 2002 (SOX Controls). • Maintains a system of security policies and procedures within the IT department related to cybersecurity and compliance requirements, primarily related to PCI compliance and SOX Controls.


text: Framework for Cybersecurity Controls We have implemented risk-based controls to protect our networks, computers and data. To this end, we utilize the Center for Internet Security (CIS) version 8.0 framework, which is comprised of eighteen critical security controls. The CIS framework is based on the COSO (Committee of Sponsoring Organizations on the Treadway Commission) and NIST (National Institute of Standards and Technology) frameworks and provides a highly actionable way to implement those frameworks and maps directly to other compliance requirements relevant to us, including PCI compliance and SOX controls (briefly discussed above).


text: Use of Third Parties We work with a third party that provides us with threat hunting services via an Endpoint Detection and Response (EDR) platform. This team proactively searches for newly uncovered threats based on up-to-the-minute intelligence on the cybersecurity threat landscape and their knowledge of the Zumiez environment. Upon discovery of a potential threat, the threat hunting team provides initial remediation guidance.


text: We also conduct periodic penetration testing of our systems. This testing is performed by a qualified third-party testing company and is in alignment with our CIS controls. Penetration testing is meant to provide us with information on the security of a particular system or application. These findings then can be used by us to inform remediation work on a go-forward basis. Cybersecurity Insurance.


text: We maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for the following breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information and computer system security breaches: • Computer expert services (such as a cybersecurity firm to determine the existence and cause of an actual or suspected electronic data breach or a PCI forensic investigator in connection with investigations dealing with credit card data); • Legal services; • Notification services to provide notification to impacted individuals; • Call center services; • Breach resolution and mitigation services, including credit monitoring and identity theft monitoring; and • Public Relations and crisis management expenses.


text: Cybersecurity Incident Response Plan We have a Cybersecurity Incident Response Plan which is maintained by the Security and Compliance Team. The Incident Response Plan establishes what people and organizations need to be engaged in the event of a significant incident. The Incident Response Plan also provides templates for technical resolution, documentation and communication to internal stakeholders as well as insurers and governmental and other regulatory agencies.


text: We also manage cybersecurity risk by limiting our threat landscape. For example, as an omni-channel retailer, we accept credit and debit cards via all sales channels and protecting cardholder data is a critical component of our security practices. Accordingly, PCI compliance (discussed briefly above) is very important and we engage an external qualified assessor to audit our compliance and to provide us with a report on compliance that is also shared with various payment providers. To help reduce our exposure to unauthorized access of cardholder data, we have utilized a strategy of minimizing or eliminating the storage of, and unencrypted transmission of, cardholder information across our various systems.


text: Moreover, our businesses do not involve or represent national infrastructure, the likes of which are common targets of cyber attackers (e.g., energy, oil & gas, transportation, communications, banking and financial systems, etc.). We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority at Zumiez.


text: Like many companies, we face a number of cybersecurity risks in the day-to-day operation of our business. Although to date these risks have not materialized into any instances or series of instances that have had a material adverse effect on our business or otherwise caused material harm to the company, we have, on occasion, experienced cybersecurity threats to our data and information systems, including phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "If we fail to meet the requirements to adequately maintain the privacy and security of personal data and business information, we may be subject to adverse publicity, litigation and significant expenses" in Item 1A Risk Factors.


text: As discussed above, the Security and Compliance team takes a lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. This team is supported by our Zumiez North America Cybersecurity Team, which consists of the Security and Compliance Program Manager, the Director of Infrastructure IT, the Vice President of IT, the Chief Financial Officer and the Chief Legal Officer. Additional support and guidance are provided by the Zumiez North America IT Steering Committee, which consists of the Chief Financial Officer, Chief Legal Officer, the Executive Vice President of North American Consumer Teams, the Vice President of IT, the Director of Infrastructure IT and the Senior Program Manager of Digital Commerce. Together, the Zumiez North America Cybersecurity Team and the Zumiez North America IT Steering Committee provide guidance and oversight to the Security and Compliance Team in alignment with the company's overall risk management and oversight framework.


text: Members of management, including our Chief Legal Officer, regularly report on the company's cybersecurity matters to our board's Audit Committee. The Audit Committee has been assigned the responsibility for reviewing and discussing with management the company's major operational, legal and regulatory risks, including data security and privacy and the company's policies to identify and manage cybersecurity risks.


text: In order to inform the Audit Committee of the planning and execution of our cybersecurity program, several different reports are provided from management.


text: Annual Cybersecurity Plan. This plan is provided for the first quarter Audit Committee meeting and outlines the cybersecurity related strategic initiatives for the fiscal year. It outlines any new investments and projects and their alignment with the cybersecurity framework, as well as the expected timelines for the implementation of these activities.


text: Quarterly Cybersecurity Memos. At the 2nd, 3rd and 4thquarter Audit Committee meetings, an update memo is provided to the Audit Committee that details the progress against the Annual Cybersecurity Plan, any updates on PCI compliance and SOX compliance activities and any emerging threats. The memo also contains a summary of significant cybersecurity threats over the past quarter both within our ecosystem and outside our ecosystem and any impact (if any) they may have had upon the company.


text: Internal Audit Reports. Our internal audit function's reviews of our information security programs and controls are included in quarterly reports to the Audit Committee.


text: The cybersecurity program and related risks are also discussed with the full Board of Directors as part of the review and discussions around the topic of risk management and the risk oversight framework that generally take place at the 3rd quarter Board of Directors meeting.


text: Any potentially significant information security issues that arise during the year are discussed with management and captured in our disclosure controls and procedures and are discussed with our Audit Committee chair between board meetings as appropriate.


text: Risk management and strategy The Company has implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient data ("Information Systems and Data").

companyName: TerrAscend Corp.

ticker: TSNDF


text: The Company's cybersecurity function, led by our Chief Information Officer ("CIO") and Director of IT Operations, helps identify, assess, and manage the Company's cybersecurity threats and risks. The Company's CIO has over twenty-five years of technology leadership experience including infrastructure design and management, software development, system implementation, cybersecurity, and network design administration. The Company's CIO has proven success in data protection for systems and has supported a complex global public enterprise environment with operations in over 200 countries. The Company's Director of IT Operations has over ten years of experience developing and leading healthcare solutions and has led the development in web and infrastructure design, serverless architecture, database integrations, SMS, mass-email and mass phone notification solutions. The Company's Director of IT Operations has dealt directly with numerous cyber security threats, breaches, detection and containment activities and strategies under strict requirements and expectations for HIPAA covered entities. The Company's cybersecurity team works in partnership with our managed security service provider ("MSSP") and managed service provider ("MSP") to help identify, assess, and respond to risks from cybersecurity threats. The Company's Security Incident Response Team leverages a cybersecurity managed detection and response partner, which monitors certain of our endpoints, cloud infrastructure, and networks for irregular activity.


text: Depending on the environment and system, the Company implements and maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, monitoring and response services in certain environments and systems, system access controls for certain systems, an employee cybersecurity training program, asset management and recovery processes, penetration testing, dark web monitoring, monthly environment risk reviews, external threat intelligence reports, regular digital infrastructure scans, internally reported threats, and cybersecurity insurance.


text: The Company's assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is identified in the Company's risk register detailing certain known and potential risk items; the Company's IT operations department works with our MSSP/MSP vendor partners to review certain identified threats and our cybersecurity practices in an effort to prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact on our business; and our CIO regularly presents to senior management, the Board and Audit Committee to evaluate material risks relative to our overall business objectives.


text: The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats including, for example, managed cybersecurity service providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.


text: The Company uses third-party service providers to perform a variety of functions throughout our business, such as enterprise resource planning, point of sale, eCommerce, wholesale sales, and web hosting. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Our vendor management program includes completion of a cybersecurity questionnaire for certain vendors designed to help us evaluate the potential cybersecurity risks associated with our use of the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the risk factors under Item 1A. "Risk Factors" in this Annual Report, including "The Company (and the third parties upon which it relies) faces physical security risks, as well as risks related to its information technology systems, potential cyber-attacks, and security breaches.".


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Company's Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Company's cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, the CIO and the Director of IT Operations. The CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the security management department, CIO, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO") and others. The security management department, CIO, CFO, CEO, and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the Board for certain cybersecurity incidents.


text: The Board receives regular reports from the CIO concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. These reports also include materials related to certain cybersecurity trends we have identified, potential cybersecurity threats and risk, and proposed mitigation measures.


text: Cybersecurity Risk Management and Strategy. Our cybersecurity and data protection strategy is part of our overall enterprise risk management program, and is focused on the identification, detection, management and mitigation of security risks and prompt incident response intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, technology and financial risk. Key elements of our cybersecurity risk management strategy include: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security program; • data protection policies and controls; and • the deployment of technologies designed to mitigate material cybersecurity risks to our critical systems, information, products and services, and our broader enterprise information technology environment.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: As of the date of this report, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, see Item 1A, "Risk Factors".


text: Cybersecurity Governance. The Audit Committee of our Board of Directors reviews risks related to information technology, including cybersecurity, and receives reports from our executive officers and third parties on cybersecurity matters. Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. Our Chief Technology Officer oversees cybersecurity matters, with support from our internal information technology team and third parties. We expect that our cybersecurity risk management processes and strategy will continue to evolve in response to the evolution of the cybersecurity threat landscape.


text: The Corporation understands the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Corporation is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Corporation collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and Enterprise Risk Management Committee, provide direction and oversight of the enterprise-wide risk management program of the Corporation, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Corporation.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Corporation deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Corporation also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Corporation employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Corporation, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.


text: Cybersecurity Risk Management and Strategy As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Debt Solutions BDC


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board of Trustees, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Cybersecurity Governance Apollo's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of Apollo's Board of Directors ("Apollo's audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Apollo's Board of Directors, Apollo's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, Apollo's Chief Security Officer ("CSO"), the CISO, the AHL CISO. other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, Apollo's Board of Directors and/or Apollo's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full Apollo Board of Directors or Apollo's audit committee receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, as well as from AHL's CISO, at least annually.


text: Apollo's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously Apollo's CISO for nearly eight years. Apollo's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: Apollo's CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to Apollo's audit committee or Apollo's Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Trustees, our audit committee regularly interacts with, and receives reports from, our management, the Adviser, Apollo, and other service providers. The audit committee of our Board of Trustees receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and employees ("Information Systems and Data").

companyName: IN8BIO, INC.

ticker: INAB


text: Our information security function is led by our Director of Information Technology (IT Director), who reports to our Chief Financial Officer (CFO), and is supported by our third party security consultant, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting threat assessments for internal and external threats, engaging third parties for threat assessments, and conducting assessments to identify vulnerabilities. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management processes. For example, our IT Director and certain management, including our CFO, evaluate material risks from cybersecurity threats against our overall business objectives and our CFO periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, encryption of certain data, segregation of certain data, network security controls, physical security controls, asset management, employee training, penetration testing, and cybersecurity insurance. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We utilize certain vendor management processes to help manage cybersecurity risks associated with our use of certain these providers, including, for example, risk assessments and reviews of the provider's written security program documentation. Our vendor management processes may vary depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the rick factor entitled "If our information technology systems or sensitive information, or those of our collaborators or other contractors or consultants, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to, a significant disruption of our product development programs and our ability to operate our business effectively, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CFO, the Chief Operating Officer (COO) and the IT Director having over 30 years of information security experience. The CFO and COO each have over ten years of experience in roles with responsibility for overseeing information technology and security functions.


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CFO, COO and Chief Executive Officer, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The Company's Chief Financial Officer ("CFO"), Information Technology ("IT") manager, legal function and external information technology and cybersecurity service provider help to identify, assess and manage our cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, conducting internal audits, and conducting internal and external threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of data, network security controls, access controls, asset management and disposal, physical security, systems monitoring, employee training, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT manager works with our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our management team evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to the Audit Committee of our board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, managed cybersecurity providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosted services, CROs, and CMOs. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A titled "Risks Related to Our Business Operations, Employee Matters and Managing Growth."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO and IT manager. Our CFO has overseen and been responsible for the Company's information technology and cybersecurity programs since 2018, and before that held equivalent responsibilities at another public company. Our IT manager has approximately seven years of experience with testing, implementing and maintaining our information technology systems and security.


text: Our CFO is responsible for hiring appropriate personnel, retaining third-party information technology service providers, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel and approving budgets. Our IT manager and our third-party information technology service provider are together responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to key members of management depending on the circumstances. Our CFO works with the Company's IT manager and our third-party information technology service provider to help us mitigate and remediate cybersecurity incidents of which our CFO is notified. In addition, our incident response plan includes reporting to the Audit Committee of our board of directors for certain cybersecurity incidents.


text: The Audit Committee receives regular reports from our CFO concerning the Company's significant cybersecurity threats and risks, and the processes the Company has implemented to address them. The board of directors also has access to reports, summaries and presentations related to the Company's cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We have established a risk management framework which provides for the identification, assessment, management, and monitoring of cybersecurity risks. The implementation of this framework includes an iterative and periodically updated risk identification process and will include penetration testing. Identified risks are assessed, managed, monitored, and periodically reassessed to account for new threats, changes in operations, the effectiveness of implemented safeguards, and other factors.


text: Our risk management framework activities include the identification, assessment, and monitoring of reasonably foreseeable internal and external risks, including risks associated with key third-party vendors and service providers. The risk assessment, monitoring, and review process address the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. In this context, under our risk management framework, we periodically work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks, including risks related to third-party vendors and service providers; monitor the effectiveness of our safeguards; and reasonably address any identified gaps in existing safeguards.


text: As part of our risk management framework, we also periodically assign third-party cybersecurity training to our employees on our cybersecurity policies and safeguards.


text: We employ external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, and to identify, assess, manage, and monitor cybersecurity risks. Under the supervision of senior executive management, our Head of Information Technology (IT), supported by external cybersecurity consultants, supervises and directs the implementation of our cybersecurity risk management framework.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled, "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer actual or suspected security or data privacy incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal information, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations, and potentially significant delays in our clinical trials and delivery to market." and "We are subject to stringent and changing privacy, data protection and data security laws, regulations and standards as well as policies, contracts and other obligations related to data privacy, data protection and data security. Our actual or perceived failure to comply with such obligations could lead to enforcement or litigation (that could result in fines or penalties), a disruption or cancellation of clinical trials or commercialization of products, reputational harm, or other adverse business effects."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. The audit committee has primary board responsibility for strategic oversight of our cybersecurity program, including by quarterly reviewing and discussing with management the Company's cybersecurity and other information technology risks, controls and procedures, as well as the Company's plans to mitigate cybersecurity risks and to respond to data breaches.


text: Our Chief Legal Officer, who serves as our Head of Information Technology (IT), with the assistance of and informed by our external consultants, is primarily responsible for overseeing our cybersecurity risk management framework, including assessing and managing our material risks from cybersecurity threats, as well as monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Legal Officer and Head of IT has experience as a senior legal, compliance and operations executive in highly regulated companies, including in roles with executive-level responsibility for overseeing data privacy and security compliance.


text: The processes by which our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular reports from the Chief Legal Officer and Head of IT. Our Chief Legal Officer and Head of IT also provides quarterly briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses as well as the results of our risk management activities. Our audit committee provides updates to the board of directors on such reports.


text: The audit committee of our board of directors is responsible for the general oversight around cybersecurity-related matters, while our management is responsible for the day-to-day operations around the assessment and management of any cybersecurity risks we might face. Our board of directors and the audit committee, in consultation with management, established and maintained robust procedures and internal controls around cybersecurity. These mechanisms are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: At each regularly scheduled audit committee meeting, our chief financial officer provides an update on our cybersecurity position, and where necessary, the audit committee then provides an update to the board of directors. Our incident response process also contemplates that the executive team will notify the audit committee of a material cybersecurity incident.


text: We engage an experienced consultant to oversee the day-to-day functions of cybersecurity management, including proactive reviews of activity logs, regular vulnerability scans, and, where applicable, effective incident response. Our expert consultant has over 30 years of experience in the cybersecurity space, and reports to the chief financial officer. We also engage a highly qualified third-party cybersecurity assessor to conduct annual threat assessments and penetration tests. To date, we have not encountered cybersecurity incidents that have materially impacted our operations or financial standing.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Allakos Inc.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report, including the risk factors entitled "We may experience disruptions and delays or incur financial damages as a result of system failures or security breaches or incidents" and "If we fail to comply with applicable U.S. and foreign privacy and data protection laws and regulations, we may be subject to liabilities that adversely affect our business, operations and financial performance".


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer, in conjunction with our information security team and third-party consultants, is primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer provides briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In addition, our Chief Financial Officer provides briefings of any significant cybersecurity matters to the Board as well as an annual update of cybersecurity risks and activities.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, providing multiple layers of security, to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's ("FFIEC"), the National Institute of Standards and Technology ("NIST"), and other agencies providing guidance in this area, as well as by engaging experts to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: • conduct annual customer data handling and use requirements training for our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for employees with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • utilize an incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • maintain multiple layers of controls, including embedding security into our technology investments; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • external reviews of our cybersecurity position to help ensure adherence to best practices and validate risk assessments and response plans.


text: We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal and third-party assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Information Technology Steering Committee of the Board of Directors of the Bank at least quarterly. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence.


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Privacy of Customer Information and "– Cybersecurity" included in Part I. Item 1 – Business of this report.


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future. For additional information regarding the risk the Company faces from cybersecurity threats, please see the risk factors titled "We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers" and "We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action." included in Part I. Item 1A. – Risk Factors of this report.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Information Technology Steering Committee of the Board of Directors of the Bank, which then reports to the entire Board, is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Information Technology Steering Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Information Technology Steering Committee generally receives materials, including materials indicating current and emerging material cybersecurity threat risks and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer, Information Security Officer, and other staff as needed.


text: Members of the Information Technology Steering Committee, and other members of the Board, are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management process, which is discussed in greater detail above, is led by our Chief Information Officer, Information Security Officer, Chief Risk Officer, and other staff as needed. Such individuals have collectively over 90 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and safeguarding corporate and customer information.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. As discussed above, these members of management report to the Information Technology Steering Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly. A summary report is provided to the full Board of Directors at least annually.


text: Cyber Risk Management and Strategy We have implemented and maintain various information security processes designed to manage cybersecurity risks relating to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and products (Information Systems and Data).

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Our Director of Information Technology, assisted by our managed information technology service provider and other third party service providers, lead the Company's cybersecurity risk management processes. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing threat intelligence reports and feeds, conducting scans of certain environments, and other tests.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage risks from cybersecurity threats to our Information Systems and Data, as applicable depending on the environment, including incident detection and response, disaster recovery/business continuity policies, network security controls and data segmentation, access controls, physical security, asset management and tracking, systems monitoring, and employee training.


text: Our assessment and management of risks from cybersecurity threats are part of the Company's overall risk management processes. Our Director of Information Technology works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us to identify, assess, and manage risks from cybersecurity threats. These third-party service providers may include threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We also have established a process to conduct diligence on certain third parties before engaging with those third parties, such as those that support our GxP processes, which may include a security assessment.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see our risk factors under Part 1 Item 1A. Risk Factors.


text: Our board of directors holds oversight responsibility over the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of the Company's processes for monitoring and controlling cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, who has over 10 years of information technology management experience.


text: The Director of Information Technology, along with management, is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security-related reports.


text: We have processes designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President Legal and Compliance, Vice President Finance and Administration, Chief Financial Officer and Director of Information Technology. In addition, the Company's incident response policy includes a process for reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives reports from members of the Company's management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them, as applicable.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data associated with our clinical trials or manufacturing campaigns, and other confidential information that is proprietary, strategic or competitive in nature. We perform periodic assessments of our information security processes, and the results of these assessments are reported to the audit committee of the board of directors (Audit Committee) as part of a cybersecurity update report conducted at least annually.

companyName: aTYR PHARMA INC

ticker: ATYR


text: We also engage vendors from time to time to assist with enterprise managed detection and response, security information and event management, and enterprise vulnerability management. These vendors also assist us from time to time in identifying, assessing and managing material risks from cybersecurity threats. The vendors include threat intelligence service providers, cybersecurity software providers and managed cybersecurity service providers.


text: We have adopted an Incident Response Management Procedure (Procedure) designed to help us respond to cybersecurity incidents and mitigate our risks and impacts. An incident response team is responsible for carrying out the Procedure and is led by our Information & Technology (IT) department, and includes members from our legal and compliance, finance, and human resource departments (Security Management Team). We also manage and maintain business continuity and disaster recovery capabilities to help ensure the availability of business-critical technology resources during adverse conditions.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management process. In addition, we have implemented a cybersecurity third party risk management process designed to assess the cybersecurity practices and monitor certain critical third parties, and to assist the business in making risk-informed technology services decisions. Our practice is to perform due diligence on certain third parties who maintain Sensitive Information, including CROs that manage and administer our clinical trials, and our CDMOs that manufacture our drug product to be used in clinical trials. Additionally, we monitor these third parties through frequent program management meetings as well as joint steering committee meetings in certain cases.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those threats may do so, see our risk factors under Part 1. Item 1A. "Risk Factors - If our information technology systems or data, or those maintained on our behalf, are or were compromised, this could result in a Material Adverse Impact."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing, assessing and considering the overall risk management policies and procedures, including our cybersecurity risk management processes, and oversight of mitigation of risks from cybersecurity threats.


text: Our Security Management Team is responsible for day-to-day management of cybersecurity risk, including hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity risk assessment and management processes are implemented and maintained by the Security Management Team. Our Security Management Team includes our CFO who has more than 15 years of experience in managing IT departments, and certain members of our IT department who have over 25 years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CEO and other members of our executive leadership team (ELT). Our CFO, CEO and ELT work with our Security Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives annual reports from the Security Management Team concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have processes in place for identifying, assessing and managing material risks associated with cybersecurity threats. For a discussion of how risks from cybersecurity threats affect our business, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Risk Management and Strategy Enterprise risk management is the responsibility of our executive management team consisting of our chief executive officer, chief financial officer, chief legal officer and our vice presidents of operations, business development and environmental, health and safety. Our executive management team meets on a weekly basis and discusses cybersecurity on an ad hoc basis when it is relevant. Our director of Information Technology, who reports directly to our chief executive officer, and our director of Internal Audit are primarily responsible for management of cybersecurity risk. Our director of Information Technology is an active ISC2 accredited member with 14 years of information technology experience, namely in developing solutions focused on private and hybrid cloud computing systems for small scale organizations. In accordance with our overall enterprise risk management process, our executive management team supervises our director of Information Technology and director of Internal Audit to assess, identify and manage material risks from cybersecurity threats. As part of this process, we rely significantly on third-party providers to assist us with our cybersecurity risk management and strategy. These providers supply ongoing services including consulting services, access to a virtual CISO, threat monitoring and detection, threat response and mitigation strategies, updates on emerging trends and developments and policy and procedure guidance. Other service providers offer targeted assistance such as security and forensic expertise on an as needed basis. We also maintain cybersecurity insurance.


text: With respect to our employees, we run a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing.


text: As part of our Sarbanes-Oxley controls, our Internal Audit department tests our IT policies including those pertaining to passwords, backup and recovery, user access, change control and hardware and software maintenance. These audits assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of financial reporting systems and data. Additionally, key employees complete a survey containing questions about cybersecurity in connection with the quarterly Sarbanes-Oxley certification process. If any control deficiencies that represent material cybersecurity risks are identified in connection with these audits, those would be reported to the Audit Committee and Board of Directors. We also obtain SOC 2 certifications from certain of our third-party service providers.


text: As of the date of this Annual Report on Form 10-K, we have not implemented formal processes to oversee and identify risks from cybersecurity threats associated with our use of third parties. We are working toward the implementation of a third-party risk management program. We believe that this program will better enable us to identify and manage material risks from cybersecurity threats related to our third-party service providers.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.


text: The Audit Committee is tasked with overseeing our risks related to cybersecurity, including reviewing the state of our cybersecurity, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks. From time to time, members of our executive management team and our directors of Information Technology and Internal Audit provide updates to the Audit Committee and the Board of Directors regarding cybersecurity incidents and cybersecurity planning.


text: Governance and oversight of cybersecurity risks and strategies form a core component of our risk management framework. Recognizing the critical importance of cybersecurity in protecting our operations and preserving shareholder value, we have established a governance structure that emphasizes proactive risk identification, management, and mitigation across the entirety of our organization.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Central to our governance approach is the active involvement of our Audit Committee, which plays a vital role in overseeing the Company's cybersecurity strategy. Alta's Audit Committee is a subset of our Board of Directors, which maintains oversight of our strategic direction regarding cybersecurity.


text: Key to the Audit Committee's effectiveness is its regular engagement with our cybersecurity team, as further described below, a practice that provides direct communication and alignment on cybersecurity matters. During these critical meetings, several pivotal areas are reviewed to assess the adequacy and effectiveness of our cybersecurity measures: • Incident Response: Evaluation of our readiness and response strategies to cybersecurity incidents, positioning us to quickly and effectively mitigate any potential impacts. • Cybersecurity Industry Updates: Review of recent industry developments (i.e., new threats/tactics, industry news) to comply and adapt our strategies accordingly. • Acquisition Security Integration: Discussion on the security aspects of recent or upcoming acquisitions, focusing on the integration of their cybersecurity frameworks into our broader security posture. • Key Initiatives: Reflection on the major cybersecurity initiatives undertaken in the past year, assessing their outcomes and lessons learned. • Goals: Setting forth our cybersecurity objectives for the coming year, aligning them with our overall business strategy and risk management framework. • Employee Security Awareness and Training: Results from our regular testing and training of employees is presented and discussed. • Penetration Test Results: Analysis of the findings from our regular penetration testing exercises, which help identify vulnerabilities and strengthen our defenses. • Questions and Answers: An open forum for the Audit Committee to seek clarifications and provide guidance on cybersecurity matters, fostering a culture of transparency and continuous improvement.


text: This structured approach to governance and oversight, with a clear emphasis on receiving feedback allows us to align with the entire Alta organization. By prioritizing the identification and management of cybersecurity risks at the highest levels, we aim to safeguard our assets, protect shareholder interests, and maintain the continuity of our business operations in the face of evolving cyber threats.


text: Our Senior Director of IT and Director of Security and Compliance have primary responsibility for assessing and managing cybersecurity risks. An internal team of cybersecurity experts execute our cybersecurity program while our VP of Information Services provides executive oversight. Combined, our experts bring multiple decades of cybersecurity experience and have earned cybersecurity-related certifications. Our internal team is bolstered by strategic third-party security partners leveraged to provide 24x7 monitoring and response. Third parties routinely assess our security practices providing tactical assistance or strategic guidance through audits and penetration tests. All members of the team routinely discuss emerging security threats and ways to mitigate risk.


text: We utilize an in-depth layered approach to security. This allows us to respond and proactively mitigate cybersecurity risks, underscoring our commitment to the confidentiality, integrity, and availability of our data and systems. The Company has processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. Our strategy includes the deployment of advanced security products and rigorous penetration testing to identify and mitigate vulnerabilities by continuous vulnerability scanning and round-the-clock monitoring by both internal and external teams. This proactive stance is further bolstered by backup and recovery protocols, ensuring data resilience, and enhanced by email security measures and endpoint detection and response systems to thwart malicious activities.


text: Additionally, our commitment to security best practices is evident in our implementation of privileged access management, security awareness training for all employees, dark web monitoring, and 24x7 threat monitoring.


text: Our incident response plan is designed to address security incidents promptly and effectively, supported by stringent information security policies and the implementation of a Security Information and Event Manager (SIEM) system for real-time analysis and reporting of security events and incidents. Furthermore, identity management and mobile device management extend our security perimeter, safeguarding against both external and internal threats. As part of our annual security commitment, we undergo annual penetration testing to assess whether our necessary security controls are maintained.


text: The Company faces risks from cybersecurity threats that could potentially have an adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Security breaches and other disruptions in the Company's IT systems, including the Company's ERP system, could limit the Company's capacity to effectively monitor and control our operations, compromise ours or our employees', customers' and suppliers' confidential information, or otherwise adversely affect the Company's operating results or business reputation" in Item 1A. Risk Factors.


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.

companyName: AGENUS INC

ticker: AGEN


text: Our cybersecurity risk management program is aligned to our business strategy and has been incorporated into our enterprise risk management process.


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. To date, we have not experienced any material cybersecurity incidents.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. Our Chief Information Officer is a member of our Enterprise Risk Management Committee and provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our team of cybersecurity professionals is led by our Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.


text: We, under the oversight of our Audit Committee, have implemented and maintain an enterprise risk management program that encompasses cybersecurity risk management and is designed to identify, assess and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program is informed by, and incorporates elements of, recognized industry standards and frameworks, including elements of the National Institute of Standards and Technology Cybersecurity Framework. Our program includes controls and procedures designed to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents, if any, in a timely manner.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX