text: Cybersecurity Risk Management and Strategy GitLab's cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats. Our cybersecurity program is led by our Chief Information Security Officer, who has over 25 years of experience working at SaaS and technology companies, and consists of over 120 security practitioners located around the world. Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact. Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit. We also make judgments based on current data, assumptions about the risk, the company's risk tolerance, impact to confidentiality, integrity, and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk. Our global incident response team iteratively evaluates security events for impact, using both qualitative and quantitative factors. Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable. Our global incident response team performs at-least annual tabletop exercises of our incident processes, including material breach, disaster recovery, and business continuity scenarios.

companyName: Gitlab Inc.

ticker: GTLB


text: Our security program accounts for our significant interactions with relevant external third-parties and analyzes the potential risks introduced from doing business with them. These risks are continually assessed throughout the vendor lifecycle from onboarding to offboarding. We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, security researchers, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is focused on protecting critical assets, including data, systems and applications; minimizing the impact of cyberattacks; understanding and preparing for the evolving threat landscape and complying with applicable law. The program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also continuously improving our cybersecurity program and maintaining a strong cybersecurity posture. Key to this approach is to broadly assess the potential impact of cybersecurity incidents on business operations and financial stability as well as any legal and regulatory requirements regarding cybersecurity. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, multi-factor authentication, privileged access management least privileged access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks. • Incident Response and Recovery Planning: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including our vendors who handle our data and systems through due diligence and vendor assessments. • Education and Awareness: We provide regular, training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: FORWARD AIR CORP

ticker: FWRD


text: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include: • Board of Directors: The Board has ultimate oversight responsibility for cybersecurity. The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. • Audit Committee: The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans. • Chief Information Security Officer (CISO): Casey O'Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program. Casey has had a distinguished career holding IT leadership positions since 2015 and has been employed in the cybersecurity field since 2001. • Information Security Governance: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy. • Cybersecurity Risk Management Team: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks. • Incident Response Team: The Incident Response Team is responsible for responding to and recovering from cyberattacks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. In collaboration with the Company's IT leadership, management has established structured processes for identifying, assessing, and mitigating cybersecurity risks that may impact our business operations including processes to identify cybersecurity risks associated with the use of third-party service providers.

companyName: Oklo Inc.

ticker: OKLO


text: Senior leadership regularly provides updates to the Audit Committee of the Board of Directors on the status and outcomes of internal audits evaluating our cybersecurity systems, controls, and processes. Our program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which serves as a valuable resource in helping us identify, assess, and manage cybersecurity risks aligned with our business needs. This does not imply that we meet any particular standards, specifications or requirements, only that we use NIST as a guide.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shared common methodologies, reporting channels, and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas. Our overall strategy in protecting against cybersecurity risks includes the following preventative and detective measures: • Multi-layered network security architecture – We have implemented firewalls, intrusion detection and prevention systems (IDPS), endpoint detection and response (EDR) solutions, and we utilize threat intelligence. • Incident Response – In the event of an incident, management has established an incident response plan designed to identify, evaluate, respond to, mitigate, and report potential cybersecurity threats, including notifying the Board or regulatory agencies, as deemed appropriate. This response plan is tested regularly and is intended to address cybersecurity risks to the corporate information technology ("IT") environment including the Company's systems, hardware, software, data, people, and processes. • Regular security assessments and penetration testing – We conduct periodic vulnerability assessments and simulated cyberattack exercises to identify and remediate security weaknesses in our IT infrastructure. • Third-party Security Operations Center (SOC) monitoring – We partner with a third-party SOC and incident response retainer to provide security monitoring, threat detection, and rapid incident response, ensuring proactive identification and mitigation of potential cyber threats. • Employee cybersecurity awareness and training programs – All employees are required to participate in cybersecurity training, including phishing simulations, social engineering awareness, and secure data handling practices.


text: Oklo has not experienced any material cybersecurity incidents to date, and we are not aware of any threats, current or ongoing, that would materially affect or be reasonably likely to materially affect our results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we or our third-party providers fail to protect confidential information and experience data security incidents, we may experience adverse effects, including regulatory enforcement consequences, on our business and results of operations."


text: Cybersecurity Governance The Board maintains oversight responsibility for cybersecurity risks and has delegated to the Audit Committee oversight of such risks, including oversight of management's implementation of our cybersecurity risk management program. Management regularly reports to the Audit Committee of the Board regarding the status and outcomes of regular internal audits of cybersecurity systems, controls, and processes. As needed, management also briefs the Board on our cybersecurity environment and information security philosophy. We also review and advise our Board of cybersecurity threats to us, including emerging cybersecurity threats, as well as our plans and strategies to address them.


text: Our cybersecurity management team consists of the following: • Chief Financial Officer – previously held roles associated with cybersecurity monitoring and reporting at bp plc, including being accountable for a global smart active monitoring implementation program focused on the North American Downstream business, as well as oversight for IT when serving as the CFO for the NA Fuels business for bp plc and while CFO at Renewable Energy Group. • Head of IT and Cyber – has over 20 years of IT leadership in cybersecurity, including risk management, incident response, and cybersecurity strategy across defense, education, and corporate sectors. He has managed IT and cyber operations for over 100,000 users, overseeing enterprise ERP, HRIS, internet services, email systems, and Security Operations Centers. He holds certifications including CISSP, CCNP, and ITIL. • Head of Business Operations – a seasoned operations and technology leader with extensive experience in scaling IT and cybersecurity functions for high-growth companies. He served as Chief Operating Officer of a Series A startup where he oversaw all operations and IT. • Head of Legal – has extensive experience helping companies manage cybersecurity, privacy, and data protection related risks across the technology, e-commerce, and healthcare sectors. He has served as the global Data Protection Officer at four companies, including at Shopify Inc. where he helped respond to cybersecurity incidents, and managed all related legal and regulatory impact. He also previously managed the cybersecurity function at a Series B startup where he served as General Counsel and Corporate Secretary.


text: All of the above individuals have played a key role in our transition as a public company, working closely with external cybersecurity advisory specialists to evolve IT and cybersecurity practices to meet public company compliance standards.


text: Our management team remains actively engaged in overseeing cybersecurity risk prevention, detection, mitigation, and remediation efforts. This is achieved through regular briefings from our internal IT and cyber staff, with insights from threat intelligence sources, including governmental, public, and private entities as well as guidance from external service providers. Additionally, management reviews alerts and reports generated by advanced security tools deployed within our environment to ensure a proactive and informed approach to cybersecurity threats.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Related to Our Business and the Products—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in this annual report on Form 10-K.

companyName: Acutus Medical, Inc.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. This includes scanning our internal network and infrastructure at least monthly to enhance security measures and conducting third-party vulnerability testing at minimum on an annual basis to better protect against external attacks. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Argo Group International Holdings, Inc.


text: In particular, our information security program and approach are based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties. This program includes categorizing vendor risk based upon the types of service being provided and types of data handled, performing risk assessments using proforma questionnaires, and undertaking reviews of Systems and Organization Controls (SOC) reports for critical vendor relationships.


text: As we have noted, increased adoption of AI technologies, especially Generative AI, may increase cybersecurity risks, so Argo Group has instituted an AI Policy specifically addressing such risks. Additionally, we have implemented additional technical controls to help safeguard against data loss to generative AI and have established a cross-functional AI Working Group, which meets on a periodic basis to ensure that the company remains abreast of any AI developments that may require changes to our security posture.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Refer to the risk factors under "Operational Risks" in Part I, Item 1A, "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board oversees the Company's risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority. The Company's Audit & Risk Management Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control. Meetings of the Audit & Risk Management Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Audit & Risk Management Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Information Officer and Chief Information Security Officer regularly reports on data protection and information technology security matters to the Audit & Risk Management Committee and to Argo senior management via Security Governance Council meetings.


text: As discussed above, our information security program and approach are based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Information Security Officer, under the guidance of the Chief Information Officer and in coordination with the Head of Risk, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Information Security Officer holds the Certified Information Systems Security Professional (CISSP) designation, has over 20 years of experience working in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.


text: In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo's material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions at least annually to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.


text: Our Chief Executive Officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. To strengthen our cybersecurity posture, we engage with external consultants for regular risk assessments, penetration testing, and vulnerability analyses, allowing for proactive identification and mitigation of potential threats. We also rigorously verify the cybersecurity practices of our third-party service providers, vendors, and partners, conducting due diligence before establishing relationships and ongoing monitoring to verify compliance with our cybersecurity standards.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: Our Principal Financial Officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team.


text: Risk Management and Strategy An important part of our business involves the receipt, storage and other processing of personal information of our customers and associates, including, in the case of our customers, payment information. Security of this information and our other proprietary or sensitive data is imperative to ensure the trust of our customers, vendors, and associates. We assess, identify and manage material risks related to potential cybersecurity attacks on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft and misuse, and unauthorized access to, or other cybersecurity attacks or vulnerabilities affecting, our data and information technology systems.

companyName: GameStop Corp.

ticker: GME


text: We have an information technology ("IT") security team, led by our chief information security officer, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. We seek to address cybersecurity risks through a cross-functional approach, including relevant training for applicable associates and regular reviews and tests of our cybersecurity program that leverage audits performed by our internal audit team. In addition to our in-house cybersecurity capabilities, at times we also engage consultants or other third parties to assist with assessing, identifying and managing cybersecurity risks.


text: We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. We maintain processes designed to reduce the impact of a cybersecurity attack or other compromise at a third-party vendor.


text: See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our data and information security systems.


text: As indicated above, we have an IT security team, led by our chief information security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. The security team's leadership has an average of 13 years of prior work experience in various roles including monitoring, response, compliance and privacy. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Audit Committee of the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cybersecurity attacks or other compromise. The Company's IT team consults with, and provides regular updates to, our Audit Committee, as well as members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of our cybersecurity program, and timely reports regarding any cybersecurity attack that meets established reporting thresholds. Our Audit Committee has oversight responsibility for our cybersecurity program.


text: The ongoing improvement of our cybersecurity measures is overseen by our Vice President of Engineering, who has 17 years of experience in software and security, along with a bachelor's degree in Computer Engineering. As part of our Chief Operating Officer organization, he manages the Information Technology team and the designated Data Security Coordinator, ensuring regular program reviews, risk assessments, and employee training sessions to strengthen our proactive security posture. We do not employ or engage any third parties for cybersecurity consulting or monitoring, aside from technical support teams from our application vendors.

companyName: CuriosityStream Inc.

ticker: CURI


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the review of vendors' SOC 2 Type 2 reports and a vendor security questionnaire.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: Governance Related to Cybersecurity Risks Our Director of Infrastructure, Operations and Cybersecurity, who has over ten years of experience managing organizational operations, security and infrastructure, manages the Company's cybersecurity program. We have a cyber subcommittee (the "Subcommittee"), which includes members of our finance, legal, and IT departments, that meets periodically to discuss the Company's ongoing cybersecurity efforts. The Subcommittee reports to the Chief Operating Officer ("COO") and Chief Financial Officer ("CFO"), who report outputs from the Subcommittee regarding potential cybersecurity risks to the Company's executive team and the board. The Director of Infrastructure, Operations & Cybersecurity is responsible for the day-to-day monitoring and remediation of cybersecurity risks.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see Item 1A. Risk Factors.


text: The strategy followed by our Security Incident Response Team ("SIRT") for managing material risks from cybersecurity threats is aligned to the National Institute of Standards and Technology's ("NIST") Cyber Security Framework 1.1 and its associated references in NIST SP 800-53r5.1.1 and NIST 800-61r2 Guides. The strategy was updated in the fourth quarter of 2023 to support our compliance with the SEC's Rules on Cybersecurity Disclosure for Public Companies and then it was reviewed in the fourth quarter of 2024 as part of our yearly review cycle and is included in our overall enterprise risk management program.

companyName: Satellogic Inc.

ticker: SATL


text: Our Incident Detection and Response ("IDR") processes and practices include the evaluation of each identified cybersecurity threat event to determine its authenticity and potential impact or whether our systems blocked or mitigated it. Our Incident Response Standard, governed by our Incident Response Policy comprises two separate workflows, both tracked in a ticket system. The first workflow encompasses all events requiring investigation. If an event is confirmed as positive and has caused an impact, a second workflow may be triggered, engaging the Materiality Determination Committee until the incident is reported to the SEC or otherwise determined that there is no material impact.


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also: • Use MFA based authentication and other cryptographical processes to address identity-based cybersecurity risks. • Use context aware access control processes. • Adopted processes to ensure security in specific remote environments. • Have implemented anti-phishing technologies. • Deploy anti-malware solutions, and have them continuously updated. • Implemented a SIEM system, where we monitor (automatically and otherwise) our networks, systems and users. • Perform periodic network and vulnerability scans of our external and internal networks and systems. • Have an incident detection and response team, with its policies and procedures, to review all events that may be part of a security incident. • Use processes to assess and prioritize risks related to applications and how we use them. • Ensure the asset inventory for relevant system components is kept current and accurate; • Maintain updated network and systems architecture documentation • Periodically engage well known external consultants, where appropriate, to assess, test or otherwise assist with aspects of our security controls. • Provide mandatory training on security and compliance matters to all employees, and some more specific as roles and responsibilities require. • Have defined and periodically updated our information security policies regarding, among others, access and control, networked devices, credentials management, physical security, etc. • Implement a secure software development life cycle and a maturity model to assess it, and accompany engineering teams during all the phases of the cycle. • Evaluate the information security risk associated with suppliers, partners, applications and services used.


text: We have established a committee specifically dedicated to determining the materiality of cybersecurity incidents (the "Materiality Determination Committee"), which includes key members of our organization: the CFO, Chief Information Security Officer ("CISO"), and the Sr. VP of Operations, the latter having ultimate oversight responsibility for compliance matters. Once a threat event is determined to have any impact, the committee is assembled, informed and the threat event's material impact is determined. If materiality is confirmed, then the reporting process starts in accordance with SEC rules (including reporting no later than four days after the materiality determination).


text: External help may be engaged at any step in the process, before or after the materiality committee is invoked, depending on the complexity and reach of the incident. Though we do not have a retainer on any external third parties, we have identified a list of potential entities to engage when needed.


text: We have not identified any cybersecurity incident that had or may have a material impact on our business whatsoever, in particular, no unauthorized access to our information technology systems that either occurred or is reasonably likely to have occurred, including of reports submitted to us by third parties (including regulatory agencies, law enforcement agencies and security consultants), to the extent that such unauthorized access to our information technology systems is reasonably likely to have a material effect on the (consolidated) financial statements, in each case or in the aggregate, and no ransomware attacks when we had been asked, paid or are contemplating paying a ransom, regardless of the amount. However, conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology are assumed to be vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target.


text: Our Board has ultimate oversight for risks relating to our cybersecurity strategy. In addition, the Board has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing steps management has taken to monitor and control such cybersecurity risks, and regularly inquiring with our management team and internal auditors in connection therewith. The Audit Committee performs quarterly reviews of any confirmed cybersecurity incident. Additionally, on a bi-annual basis, the Audit Committee receives a comprehensive update regarding any cybersecurity events occurring during the prior period, progress of cybersecurity programs, changes in cybersecurity policies, and ongoing assessments of risks and mitigation activities, and to discuss the evolution of our cybersecurity strategy. The information in these reports and the results of these discussions are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: The process for materiality determination of a cybersecurity threat event considers the possibility of contacting the Audit Committee for assistance, if needed, or to inform of the evolution of an incident with possible material impact.


text: Our Materiality Determination Committee is tasked with determining the materiality of cybersecurity incidents. Also, every week the CISO updates the Executive Leadership Team (CEO, President, CFO, Sr. VP of Operations, Chief Technology Officer ("CTO"), Chief Product Officer ("CPO"), and Sr VPs of Engineering) on cybersecurity matters including any confirmed incident or any possible threat with a material or otherwise meaningful impact and shares an updated dashboard with key performance indicators on on-going efforts and long-term metrics.


text: The CISO is directly responsible for directing, "all cyber related activities (including monitoring, preventing, detecting, mitigating, and remediating" and informing the Audit Committee of any cybersecurity incident or threat with material impact, including such threats associated with our use of external suppliers and other third-party service providers.


text: The CISO and VP of Information Security have more than 25- and 30-years' experience, respectively, working directly in the cybersecurity industry, performing and coordinating red-teaming and blue-teaming exercises, conducting research and developing cybersecurity tools and products, as well as presenting at various international conferences.


text: The Information Security Team is segmented into three distinct sections: IDR, Secure Development ("SDLC"), and Infrastructure and Access Control ("IAC"). Furthermore, it collaborates with our product groups to integrate security measures into our products and services, thereby enhancing the overall security posture for our customers.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to associates or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. These cybersecurity risks and other company risks are monitored and integrated into our enterprise risk management process. As part of this process, appropriate personnel consult with subject matter specialists as necessary to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our cybersecurity risk management approach includes: (i) an enterprise risk management process, which includes cybersecurity risks and is periodically refreshed; (ii) system vulnerability scanning; (iii) cybersecurity training for employees; (iv) penetration testing, which simulates cyber threats; and (v) t hird-party risk management for suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that allow for periodic auditing. We work to continually improve each of these processes with the goal of ensuring our cybersecurity strategy remains consistent with industry best practices.


text: As part of our cybersecurity risk management strategy, we periodically engage with assessors, consultants and other third-parties to evaluate and test our systems. We also engage an independent Qualified Security Assessor to review our Payment Card Industry compliance.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents have been immaterial.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Audit and Finance Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit and Finance Committee receives an overview covering current and emerging cybersecurity threat risks and the Company's ability to mitigate those risks, and discusses these topics with our Chief Information Security Officer and Chief Technology and Digital Officer. Cybersecurity risk management is also considered at least annually during separate Board of Directors meeting discussions with management.


text: Our cybersecurity risk management strategy process is led by our Chief Information Security Officer, and Chief Technology and Digital Officer, and leverages the expertise of our Chief Financial Officer, General Counsel and Chief Accounting Officer. Our Chief Information Security Officer and Chief Technology and Digital Officer have extensive prior work experience in roles involving managing information security, developing cybersecurity strategy, managing incident and breach response and implementing effective information and cybersecurity programs as well as several relevant degrees and certifications.


text: Risk Management and Strategy We employ a defense-in-layers approach in our cybersecurity program that includes various processes to identify, assess, prioritize, manage, and report on cybersecurity risks that could result in loss or other adverse consequences to Pure Storage. We maintain a variety of channels designed to identify risks, including risks associated with our use of third-party service providers, such as by conducting vulnerability assessments, reviewing audit findings, discussing with key stakeholders, and analyzing security incidents and reports from our employees and others.

companyName: Everpure, Inc.

ticker: PSTG


text: We maintain procedures and processes designed to evaluate and respond to certain identified risks. We assess potential adverse impact across a variety of factors, such as financial, product roadmap, brand and reputation, operational performance, and our ability to comply with applicable laws and regulations. Potential responses for cybersecurity risks are: • Avoiding activities or situations that could lead to harm. • Engaging in preventative measures, safety protocols, and security enhancements. • Transferring risk through contract or insurance. • Developing contingency plans to address potential negative outcomes associated with cybersecurity risks if they occur.


text: Our cybersecurity program is integrated into our broader enterprise risk management framework. For example, certain members of our executive management evaluate material risks from cybersecurity threats against our overall business objectives and report to our Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us, our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect our company in the future and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled "If our security measures, or those maintained on our behalf, are compromised, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, products, communications or data is compromised, limited, or fails, our business could experience a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, a loss of customers, significant fines, penalties and liabilities, or breach or triggering of data protection laws, privacy policies or other obligations."


text: Our Board of Directors addresses the company's cybersecurity risk management as part of its general oversight function. Our Risk Committee is responsible for overseeing the company's cybersecurity risk management program, including accepting, transferring, or mitigating cybersecurity risks as appropriate. In addition, we have established an Executive Security Council (ESC). The ESC oversees and governs our cybersecurity program.


text: Our cybersecurity program is implemented and maintained by Pure's Global Information Security Office (GISO), a team of security professionals responsible for developing and implementing an information security program designed to protect our assets, including data, networks, applications and people, from cyber threats. The GISO includes individuals with expertise in the following areas and who continue to leverage such expertise at the company in the following manners: • Governance, Risk & Compliance (GRC). Maintaining cybersecurity policies, standards, and processes as well as providing training to our employees on them. • Security Operations. Monitoring our critical systems and assets to identify and respond to security incidents in a timely manner. • Security Engineering & Architecture. Implementing risk-based security controls. • Product Security. Supporting our product teams' security objectives by providing design review, certification management, penetration testing, and consulting services, as well as operating security vulnerability management and reporting dashboard capabilities. • Enterprise resiliency. Developing policies, procedures and practices for critical operations recovery and business continuity in the event of a cybersecurity incident.


text: The GISO reports to our Risk Committee and ESC on cybersecurity risks. Our Chief Information Security Officer (CISO) meets with the ESC and Risk Committee periodically in an effort to review the company's cybersecurity risks, the company's prevention, detection and remediation efforts of cybersecurity incidents (as appropriate), and key cybersecurity performance indicators. We also maintain procedures designed to escalate certain cybersecurity risks and incidents to members of executive management and the board of directors, as appropriate.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information syst ems or any information residing therein.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: We adhere to industry-leading frameworks to safeguard our systems and data. The primary framework we follow is the HITRUST Common Security Framework (CSF). The HITRUST CSF provides a comprehensive, scalable, and technology-neutral approach to regulatory compliance and risk management. It encompasses information security risk management controls, including risk assessment, mitigation, and evaluation. Our processes for assessing, identifying, and managing material cybersecurity risks align with HITRUST CSF guidelines.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation processes.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. For further information, please refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to our Business: Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, or use or other processing of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Chief Financial Officer and Senior Director of Information Technology are primarily responsible for assessing and managing our material risks from cybersecurity threats w ith assistance from third-party service providers. Our Senior Director of Information Technology leads our internal team and has over 20 years of cybersecurity experience, including the last 10 years in leadership positions, enabling him to build and transform successful cybersecurity programs and initiatives across several enterprises. His active associations include Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER), Information Systems Security Association (ISSA), and Forum of Incident Response and Security Teams (FIRST), and has held many technical certifications including Strategic Planning, Policy, and Leadership (GSTRT), Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP). Our third-party vendors include assessors, consultants, and auditors holding (but not limited to) the following relevant certifications: Certified Information Systems Security Architecture Professional (CISSP-ISSAP), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE), and Certified Ethical Hacker (CEH).


text: Our Chief Financial Officer and Senior Director, Information Technology oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which o ur Chief Financial Officer and Senior Director, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include company incident management and data protection policies, and applicable cybersecurity incident response playbooks.


text: Cybersecurity Risk Management and Strategy All companies utilizing technology are subject to cybersecurity threats. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, extortion, harm to employees or customers and violation of data privacy or security laws. We aim to incorporate best practices throughout our cybersecurity program. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees to help identify, avoid, and mitigate cybersecurity threats; policy regarding cybersecurity; mechanisms to detect and monitor unusual network activity; and containment and incident response procedures. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT


text: In the event of an incident, we intend to follow our detailed incident response policy and procedure, which outlines the steps to be followed from incident detection to mitigation, including notifying functional areas (e.g. legal), as well as senior leadership and the board of directors, as appropriate. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Any significant disruption to our service or access to our systems could affect our business and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information regarding risks surrounding cybersecurity, please see "Risk Factors" of this Annual Report on Form 10-K.


text: In the past two fiscal years, we have not identified any risks from cybersecurity threats that have materially affected (or are reasonably likely to materially affect) our business, results of operations, or financial condition. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has ultimate oversight regarding our cybersecurity with our audit committee specifically assisting the board of directors in the role of risk oversight by regularly reviewing cybersecurity matters and reporting to the board of directors. The Company's Chief Technology Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters. Cybersecurity risk matters are reflected on reports and updates to operations management, senior management and our audit committee on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. To aid the board of directors with its cybersecurity and data privacy oversight responsibilities, the board of directors periodically hosts experts for presentations on these topics. For example, in 2023, management hosted an expert during the annual board of directors' retreat to discuss developments in the cybersecurity threat landscape. Our board of directors also engages in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Anu Pillai, our Chief Technology Officer, leads our cybersecurity efforts. She has been serving in her current role since March 2021. Ms. Pillai has over 20 years of experience serving companies across multiple industries in senior management roles, within information technology and as such has developed substantial experience in cybersecurity, among other areas. Team members who support our Chief Technology Officer have similar broad experience and expertise in information security, including cybersecurity.


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: P3 Health Partners Inc.

ticker: PIII


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: Our management team, including our Senior Vice President of Technology, Director of Information Systems Security, and Director of Information Systems Governance Risk and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience spans all aspects of information technology including cybersecurity, IT operations (infrastructure engineering and architecture design), and IT governance audit compliance across industries such as energy, healthcare, pharmaceuticals, and finance. Our Senior Vice President of Technology's experience includes over 30 years in technology leadership and management, with 25 years within the healthcare sector, specializing in cybersecurity programs, and establishing technology compliance programs with industry standards such as Sarbanes-Oxley, HIPAA, HITRUST, and NIST. Our Director of Information Systems Security's experience includes over 20 years in IT, with 12 years within the healthcare sector, managing risk assessments and leading security programs using the HITRUST framework to ensure compliance with HIPAA, NIST, ISO 27001, and GDPR. Our Director of Information Systems Governance Risk and Compliance's experiences includes over 25 years in IT audit and security governance, establishing and leading IT GRC programs, directing IT security initiatives, and maintaining relevant certifications including CDPSE, CRISC, and CISA.


text: Cybersecurity Risk Management At Katapult, cybersecurity risk management is an integral part of our overall enterprise risk management program and information security protocols. Our cybersecurity risk management program is based on industry best practices and Center for Internet Security Critical Security Controls for handling cybersecurity threats and incidents, including threats and incidents associated with the use of internally developed applications and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees throughout the year.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors —Risks Related to Our Technology and Our Platform" in this annual report on Form 10-K.


text: Risk Management and Strategy We believe that our cybersecurity program provides effective protection of client information and of our operating systems from known and reasonably expected risks, while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we maintain up-to-date information security and monitoring controls, which we believe mitigates cybersecurity risks and threats while optimizing the utility of our systems. At the same time, cyberattacks are increasingly common, sophisticated and destructive, and several large, highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. These events also have carried significant reputational risk for the successfully targeted institutions. In order to mitigate these risks, our Information Security Officer ("ISO") is responsible for our cybersecurity programs and for the detection of and response to any identified threats and incidents. That individual also reports regularly to our Board of Directors, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems.

companyName: OP Bancorp

ticker: OPBK


text: The ISO reports to the BRCC on the status and impact of any information security related developments and strategic initiatives, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Information Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. T he Company's Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives. The BRCC also receives quarterly reports from the Executive IT Committee and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to, and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk management assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: Our business strategy, results of operations, and financial condition have not been materially affected by cybersecurity risks, threats, or incidents in the past, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. We continue to invest in the cybersecurity and resiliency of systems and products and continue to enhance our internal controls and processes, which are designed to help protect our systems, products, and the information they contain. Nevertheless, we cannot guarantee that we will not be materially affected in the future by such risks or experience future material incidents.


text: We more fully describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A. of this Form 10-K. See the risk factors captioned "We may experience difficulties in managing our growth and expanding our operations," "We are subject to cybersecurity risks to our and our suppliers' operational systems, security systems, infrastructure, integrated software in our LiDAR solutions and customer data processed by us or third-party vendors or suppliers, and any material failure, weakness, interruption, cyber event, incident, or breach of security could prevent us from effectively operating our business" and "Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which we operate may adversely impact our business, and such legal requirements are evolving, uncertain, and may require improvements in, or changes to, our policies and operations."


text: The Audit Committee of our Board ("Audit Committee") is responsible for the oversight of cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats, and incidents. Multiple times per year, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials, including a cybersecurity scorecard and other materials, indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Vice President of IT, who is responsible for cybersecurity. Members of the Audit Committee also regularly engage in ad hoc conversations with management on cybersecurity-related matters and news events and discuss any updates to our cybersecurity risk management and strategy programs. When incidents occur, depending on the nature and severity, the Audit Committee Chair is notified immediately, and incidents are further reviewed periodically with the Audit Committee. Material cybersecurity matters are also periodically reviewed with the full Board of Directors.


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Board is responsible for overseeing risk management. Our Board understands the critical nature of managing risks associated with cybersecurity threats, and, accordingly, cybersecurity is an integral part of the Company's overall risk management program. The Board's Audit Committee has primary responsibility for overseeing cybersecurity and privacy risks. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Boxlight Corp

ticker: BOXL


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts, which are overseen by the Chief Operating Officer, regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Chief Executive Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents and reporting any such incidents to our Board of Directors, and periodically briefs our Board of Directors on our cybersecurity and information security posture and on any cybersecurity incidents deemed to have a moderate or higher business impact. In the event of a material cybersecurity incident, our cybersecurity consultant has extensive information technology and program management experience. We believe that we have implemented a governance structure and processes that are equipped to assess, identify, manage and report cybersecurity risks. Refer to "Item 1A. Risk Factors" for a discussion of certain of the cybersecurity risks that our business is subject to. As a smaller reporting company, with respect to compliance with Form 8-K incident disclosure requirements, we were required to comply with the reporting requirements beginning June 15, 2024.

companyName: Sphere 3D Corp.

ticker: ANY


text: Risk Management and Strategy We rely on our subsidiary-level information technology professionals to continuously monitor and update our IT networks and infrastructure. Their role is to prevent, detect, address, and mitigate risks related to unauthorized access, misuse, malware, and other security threats. To safeguard our data and business processes, as well as those of our subsidiaries, we invest in industry-standard security technologies to defend against cyber risks.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: To further strengthen our cybersecurity efforts, with our subsidiary's assistance, we are establishing an "IT Steering Committee" composed of IT professionals from our subsidiary. This committee will meet quarterly to discuss cybersecurity threats, emerging attack methods, and best practices.


text: In fiscal year 2024, our crypto-processing subsidiary engaged an external consultant to conduct a cybersecurity risk assessment of our business operations. This assessment examined both internal and external threats to our systems and data handling processes, providing a structured framework for evaluating, prioritizing, and enhancing our cybersecurity initiatives. On a going-forward basis, in collaboration with our Audit Committee, management will determine and implement appropriate measures based on these findings.


text: As part of our cybersecurity risk management program, we are working with our crypto-processing subsidiary to develop a cyber training curriculum for our employees. The training may cover topics such as phishing awareness, cybersecurity best practices, and e-mail security.


text: Despite our commitment to cybersecurity, no system can fully eliminate technology risks. As of now, we are unaware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, the increasing volume and sophistication of cyberattacks—including data breaches, ransomware, and similar threats—pose ongoing risks. Incidents that occur could result in reputational, competitive, operational, or financial harm, as well as regulatory consequences. For a more detailed discussion of how cybersecurity threats may affect our business strategy, operations, or financial condition, see Item 1A, "Risk Factors," which is incorporated by reference into Item 1C.


text: Risk Management and Strategy We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, if necessary, we would re-design and implement reasonable additional safeguards to minimize identified risks and address any identified gaps in existing safeguards.


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our third-party IT service provider who reports to our Chief Technology Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and we train our relevant employees on these safeguards, in collaboration with our third-party IT provider and management. Since users are typically the weakest link in any information system, we periodically train all our employees on good cybersecurity practices, including password management, phishing prevention, and other security awareness issues. We have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure including cybersecurity risk, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Our Chief Technology Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from our third-party IT service provider.


text: Our Chief Technology Officer oversees our cybersecurity policies and processes and will provide periodic briefings to the Chief Executive Officer, the Audit Committee and/or the Board of Directors as needed regarding any material cybersecurity risks or activities, including any recent cybersecurity incidents and related responses.


text: Cybersecurity Risk Management and Strategy We maintain a number of processes to identify and respond to cybersecurity threats and incidents including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercise, and recovery and resilience tests. Our information security and third-party risk management programs evaluate cybersecurity threats posed by internal and external factors and support daily operational functions that prevent unauthorized access or compromise.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: The third-party risk management programs report functionally to our overall risk management function, led by our Chief Risk Officer. The information security program, led by our Chief Information Security Officer and our Chief Information Officer, evaluates internal and external cybersecurity threat factors according to a written policy statement approved by the Board periodically. We maintain processes to evaluate third parties whose information systems support our critical operations.


text: The third-party risk management program evaluates cybersecurity risks and information systems of third parties at onboarding and on an ongoing basis. Processes include evaluating reports and/or performing assessments of a third party's information systems leveraging cybersecurity frameworks such as International Organization for Standardization (ISO) ISO 27001, Cybersecurity Framework (CSF) published by the US National Institute of Standards and Technology, as well as evaluating reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants (AICPA). We integrate risk mitigation into additional onboarding requirements to address identified risk factors, such as developing service level agreements and minimum required information security performance expectations to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards. We require contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to us of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.


text: The information security program performs periodic risk assessments of our information systems and cybersecurity threats using industry standard methodologies based on FFIEC Cybersecurity Assessment Tool (CAT), as well as regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and state and federal regulators, including the Federal Deposit Insurance Corporation and the Michigan Department of Insurance and Financial Services. Based on risk, our information security program performs internal engagements to provide assurance to senior management and the Board that our information systems are able to identify, escalate and mitigate cybersecurity threats on a routine basis. We also engage external independent parties to perform independent audit engagements, as well as other assessments of our information security and third-party risk management program and information systems.


text: We are exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third-party service providers. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the two-year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory scrutiny or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations. We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), and harm to customer or third-party relationships or the possibility of litigation or regulatory investigation or actions that could materially adversely affect our results of operations and our reputation. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Cybersecurity Governance An Information Technology Steering Committee was established to assist Management and the Board of Directors in the oversight and risk management of information security. This Committee is responsible for updates which summarize cybersecurity threats and incident monitoring activity, along with details of remediation to address threats and incidents. The summary considers both internal as well as external threat events and outlines management's approach to enable the timely identification and notice of a material incident, should one occur, without unreasonable delay.


text: The Board of Directors receives periodic training related to cyber security and is responsible for approval and oversight of management's policies governing information system security and cybersecurity threats and incidents, as well as oversight of management's approach to secure our information systems. The Board of Directors delegates the primary oversight of risk management to the Bank's Audit Committee.


text: The Audit Committee receives, and reviews reports on our risk management processes, which include assessments of management's cybersecurity threats and incident management functions. The committee receives periodic reporting of certain cybersecurity risks from the Chief Information Security Officer, including reports related to social engineering, effectiveness of cyber security training, as well as vulnerability and penetration assessments performed on the Company's information systems by internal and by external parties and audit reports of information systems and cybersecurity threat and incident monitoring.


text: P otential cybersecurity incidents are reviewed by the Chief Information Security Officer and the Information Technology Steering Committee. The evaluation of reported events by the committee includes reporting of any mitigation or remediation determined necessary to address the threat posed by the reported event. If any event rose to the level of a material incident, management maintains an incident response plan to mitigate the impact, maintain business continuity and provide for internal and external communication, including required notifications.


text: Our Chief Information Security Officer has over 25 years of relevant experience and formal training in the areas of cybersecurity, risk management, and data privacy in the financial services industry. The Chief Information Security Officer holds a Master of Science in Computer Information Systems and appropriate professional certifications. Our Chief Information Officer has over 20 years of executive level technology leadership experience in the financial services industry.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors—Risks Related to Our Business" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: In addition, our management team, comprised of senior staff and executives from multiple departments within the Company, including IT, finance, legal, and operations, leads all efforts for our overall cybersecurity risk management program and supervises both our internal information security personnel with prior work experience in cybersecurity and our retained cybersecurity consultants.


text: The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, and customer data. As an advanced electric vehicle manufacturer, the Company's operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks. This approach is informed by industry best practices, including the NIST Cybersecurity Framework ("CSF") and Risk Management Framework ("RMF"). The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act ("CCPA"), the General Data Protection Regulation ("GDPR"), and the Securities and Exchange Commission ("SEC") cybersecurity disclosure requirements.


text: The following disclosure outlines the Company's cybersecurity risk management strategy, governance structure, incident response procedures, regulatory compliance efforts, and ongoing investments in cybersecurity.


text: 1. Cybersecurity Risk Management The Company employs a structured cybersecurity risk management program that aligns with NIST CSF's five core functions: Identify, Protect, Detect, Respond, and Recover. The approach includes: • Risk Assessments: Regular evaluations of cyber risks across IT infrastructure, production systems, and cloud-based platforms. • Threat Detection and Monitoring: Deployment of Security Information and Event Management (SIEM) tools, intrusion detection systems, and endpoint security solutions to monitor cyber threats in real-time. • Third-Party Risk Management: Continuous evaluation of vendors and partners who have access to the Company's sensitive data and operational networks. • Access Controls and Encryption: Implementation of multi-factor authentication (MFA), data encryption protocols, and network segmentation to reduce attack vectors.


text: The Company integrates cybersecurity into its enterprise risk management (ERM) framework to ensure cyber threats are regularly evaluated as part of its business strategy and operational resilience efforts.


text: 2. Governance and Oversight Cybersecurity oversight is a shared responsibility between the Company's Board of Directors, senior management, and IT security leadership. The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.


text: The Company's Senior Cybersecurity Engineer leads the execution of cybersecurity programs, including: • Developing and maintaining security policies. • Conducting periodic risk assessments and audits. • Managing incident response and recovery plans. • Providing reports to senior executives on security trends, vulnerabilities, and ongoing mitigation efforts.


text: The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.


text: 3. Management's Role in Cybersecurity Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company's security posture.


text: Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.


text: 4. Cybersecurity Strategy and Resilience The Company has established robust cybersecurity resilience measures to ensure that cyber incidents do not materially impact operations. These include: • Backup and Redundancy: Critical business systems are backed up and replicated to prevent data loss and operational disruptions. • Incident Containment and Recovery: Automated security responses, real-time malware detection, and forensic analysis capabilities enable the Company to respond swiftly to threats. • Proactive Threat Intelligence: Continuous monitoring of emerging cyber threats and industry trends, allowing for adjustments to the security strategy.


text: The goal is to maintain business continuity, protect proprietary technology, and safeguard customer and employee data in the event of a cyber incident.


text: 5. Material Cybersecurity Incidents During the reporting period, the Company experienced a cybersecurity incident related to employee interactions with suspicious websites. The incident was promptly contained, and a forensic investigation confirmed that no material impact occurred to operations, financial position, or customer data.


text: 6. Impact of Cyber Incidents Cybersecurity incidents, if material, could affect the Company's financial condition, operational stability, and reputation. Risks include: • Direct financial losses from remediation costs, potential ransomware payments, or legal expenses. • Operational disruptions affecting vehicle production and supply chain logistics. • Regulatory fines and penalties for non-compliance with data protection laws. Reputational damage impacting customer trust and investor confidence.


text: The Company regularly assesses its financial exposure to cybersecurity risks and has contingency plans in place to mitigate these impacts.


text: 7. Board Expertise in Cybersecurity N o Board members currently hold formal cybersecurity certifications or direct experience in cybersecurity risk management. The Company continues to enhance Board education on cybersecurity trends and governance practices.


text: 8. Use of Third-Party Services The Company partners with third-party cybersecurity firms to support penetration testing, threat monitoring, and risk assessments. Vendors are required to adhere to stringent security controls to minimize risks associated with third-party data access.


text: The Company has implemented a Third-Party Risk Management ("TPRM") framework that evaluates cybersecurity controls in vendor contracts, ensuring compliance with security policies.


text: 9. Regulatory and Legal Compliance Risks The Company is subject to global cybersecurity regulations, including: • SEC cybersecurity disclosure requirements for material incidents and risk management. • Data privacy laws such as CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation). • Automotive cybersecurity standards for protecting connected vehicle systems.


text: Failure to comply with cybersecurity regulations could result in financial penalties, legal liabilities, and reputational harm. The Company conducts regular compliance reviews to ensure alignment with evolving regulatory requirements. •24/7 monitoring for cybersecurity threats. • Real-time threat detection and forensic investigation tools. • Collaboration with third-party security firms for penetration testing. This plan ensures that cyber threats are identified, contained, and mitigated efficiently.


text: 11. Cyber Insurance and Risk Transfer The Company maintains cyber insurance coverage to mitigate financial risks associated with cybersecurity incidents. This insurance covers: • Incident response and recovery costs. • Legal fees and regulatory penalties. • Business interruption expenses. The risk management team regularly evaluates the adequacy of coverage based on evolving cyber threats. 12. Historical Cyber Incidents No material cybersecurity incidents were recorded in prior reporting periods.


text: As part of the nation's critical infrastructure network, we are subject to certain mandatory reliability standards, which include cybersecurity requirements. We have a formal compliance program to establish, monitor and maintain compliance that includes comprehensive cybersecurity elements designed to protect and preserve our critical information and energy infrastructure systems. We reference industry and government frameworks and best practices to continuously improve our cybersecurity program and we participate in industry groups and information sharing exchanges to understand emerging cybersecurity trends and threats.

companyName: OGLETHORPE POWER CORP


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity to assess and enhance the effectiveness of our security programs. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support and audit our cybersecurity preparedness. We have also adopted cybersecurity incident response guidelines. As required by these guidelines, teams and plans are in place to respond to any cybersecurity incident, including internal and external communication responsibilities.


text: As of the date of this annual report, we have not experienced any cybersecurity incident that has materially affected our business. See "RISK FACTORS" for a discussion of cybersecurity risks that may affect us.


text: Our cybersecurity risks and associated mitigations are evaluated by our IT team, including our VP of Technology Operations and Information Security, as part of our enterprise risk assessments that are reviewed by our management team. Our VP of Technology Operations and Information Security serves as the Company's designated Chief Information Security Officer and is responsible for developing and implementing the cybersecurity risk management program, including reporting on cybersecurity matters to the Board of Directors. The VP of Technology Operations and Information Security has more than 19 years of experience leading cybersecurity oversight.

companyName: Intellicheck, Inc.

ticker: IDN


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, which include: internal briefings from relevant personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. In addition, the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management and the Chief Information Security Officer to monitor and mitigate cybersecurity risks. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: BKV employs a comprehensive cybersecurity strategy to protect against threats that could compromise sensitive information, disrupt data or systems, or jeopardize the security of facilities and infrastructure, including third-party processing plants and pipelines.

companyName: BKV Corp

ticker: BKV


text: Managing Material Risks & Integrated Overall Risk Management BKV has strategically integrated cybersecurity risk management into its broader enterprise risk management framework to promote a company-wide culture of cyber risk awareness. BKV's Chief Information Officer ("CIO") and Manager of Cybersecurity work closely with its information technology ("IT") department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the Center for Internet Security (CIS) Critical Security Controls and National Institute of Standards and Technology (NIST) frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining and regularly updating a defined and practiced incident response plan ("IRP"); • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Executing scheduled, recurring server and infrastructure patching processes; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; and • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, BKV engages with external experts, including, but not limited to a managed security service provider ("MSSP"), the Cybersecurity Operations Center ("CSOC") team to evaluate, monitor, and test BKV's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, IRP testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements. Third-party experts have assisted BKV in conducting cross-functional tabletop exercises and quarterly strategic meetings as well as developing comprehensive remediation plans following cybersecurity assessments.


text: Managing Third Party Risk BKV's cybersecurity approach also assesses the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures as well. BKV also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards, and regularly updates and patches third-party applications and tools when vulnerabilities are discovered.


text: Risks from Cybersecurity Incidents As of March 31, 2025, BKV has not been subject to any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company, its operations, or financial standing. For additional information about cybersecurity risks associated with our business, see Item 1A, " Risk Factors."


text: Risk Management Personnel We have an enterprise risk committee that includes our executive leadership team and other senior members within our legal, IT, finance and accounting, and operational departments, which oversees BKV's operational, strategic, and corporate-level risks, including risk management.


text: Our comprehensive cybersecurity risk management is led by our CIO who brings over 30 years of extensive experience in information technology with a specialization in cybersecurity. Her expertise spans global information systems and data, cybersecurity operations, security management strategies and tools, security assessment and remediation, as well as the design and implementation of controls to prevent and detect cybersecurity threats. BKV's cybersecurity risk management program is overseen by management at multiple levels. The CIO and Manager of Cybersecurity play key roles in assessing, monitoring, and managing the Company's cybersecurity risks. The CIO Cybersecurity governance also is supported by our IT department and CSOC. These stakeholders meet monthly to review the monthly cybersecurity assessment and remediation report. The IT department conducts extensive reviews of our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities and implements systems and tools to remediate perceived risks. These tools are designed to prevent and detect activities or events that could pose a cybersecurity risk to our business. Our third party CSOC team provides 24-hour monitoring to detect and respond to suspicious activity in real time.


text: Monitor Cybersecurity Incidents The CIO and Manager of Cybersecurity are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the 24/7/365 monitoring of our information systems as well as ongoing threat assessment monitoring. The deployment of advanced security measures, regular system audits to identify potential vulnerabilities, and periodic cyber assessment exercises support these programmatic efforts. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced IRP. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.