text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission, to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: We engage in regular assessments of our infrastructure, software systems, and network architecture utilizing third-party cybersecurity professions, including annual penetration testing and audits of our information technology systems to identify vulnerabilities and areas for additional enhancement.

companyName: Bank7 Corp.

ticker: BSVN

secItem: Item 1C


text: Employees receive regular virtual and in-person security awareness training through simulated tests, company communications, and in-person training. We also maintain a vendor management program to identify and assess risks of our third-party service providers.


text: Our cybersecurity function is overseen by our COO/ IT Manager who has over 9 years' experience managing such functions. IT functions are also managed through our IT Committee which is comprised of several senior level executive officers and other Company employees and chaired by our COO/ IT Manager. The IT Committee governs all IT functions at the Company and selects, monitors and manages our third-party IT service providers that implement and maintain our cybersecurity functions.


text: We also maintain a Cyber Incident Response Team, which includes a board representative and an executive officer representative and is chaired by our COO/IT Manager. The Cyber Incident Response Team is charged with developing and implementing incident response and recovery plans to guide our employees, management and the Board in their response to a cybersecurity incident.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, including cybersecurity risks. The full Board receives a network health report at each board meeting from our COO/ IT Manager, which addresses our overall network risk including any relevant cybersecurity threats and incidents.


text: Cybersecurity Risk Management and Strategy The operation of our business depends on our information technology systems. We rely on our information technology systems to effectively manage sales and marketing data, accounting and financial functions, inventory management, product development tasks, clinical data, customer service and technical support functions. Our information technology infrastructure and products are vulnerable to cyber-based attacks. Cyber-based attacks can include computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks and other introduction of malware to computers and networks; unauthorized access through the use of compromised credentials; exploitation of design flaws, bugs or security vulnerabilities; intentional or unintentional acts by employees or other insiders with access privileges; and intentional acts of vandalism by third parties and sabotage.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: We have developed and implemented a risk-based program focused on cybersecurity measures to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management is integrated into our overall risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Audit and Risk Committee periodically reviews and discusses with management the Company's policies and internal controls with respect to cybersecurity. Our Senior Group Technology Manager ("SGTM") (who has over 20 years of experience in information technology roles and holds various industry certifications) reports to the Chief Financial Officer and together report to the Audit and Risk Committee periodically on cyber security matters. The Audit and Risk Committee reports through to the Board. In addition to the annual security assessment and penetration test, the SGTM utilizes an Endpoint Detection and Response system which acts as Anti-virus and intrusion prevention system and reports all abnormalities to the SGTM. Essential Eight and Center for Internet Security Control Strategies including patch applications, multi-factor authentication, administrative privileges, application hardening and backups are performed internally via a security consultant with regular updates provided to the SGTM. Reported findings and action items are recorded and assigned to personnel for action.


text: Any failure to protect our information technology infrastructure and our products against cyber-based attacks, network security breaches, service interruptions or data corruption could materially disrupt our operations and harm our business. Our cybersecurity risk management program includes: periodic risk assessments annual security assessment and penetration testing;


text: A third-party Security Operations Center ("SOC") partner to monitor, manage and respond to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cyber risk management process for service providers, suppliers, and vendors that have access to our critical systems and information managed through the selection of typically larger well-known providers, which is supplemented by review of contractual arrangements, insurance and information requests; cybersecurity awareness training and phishing campaigns for specific employee groups; disaster recovery plans/procedures;


text: access control and CCTV systems (where appropriate) for the physical protection of Anteris systems; and incident response and recovery procedures, for cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors - Risks related to our business - Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."


text: The Board, through the Information Technology Steering Committee, works with senior management and other employee committees to oversee the development, implementation, maintenance, and administration of the Information Security Program, which is aligned and integrated into Ohio Valley's overall risk management system and processes. The Information Technology Steering Committee itself is comprised of diverse directors and officers of the Bank with vast knowledge and years of banking experience. The Information Security Officer of the committee has 26 years of banking experience including 25 IT related years as well as continuing education including a BA in Management Information Systems and Network+ and A+ certifications. The purpose of the Information Security Program is to: Identify and analyze cybersecurity risks; Provide the Company with direction on effectively managing such risks; Approve information security plans, policies, and programs; Assess whether the Company's current security programs are effective; and Provide recommendations for corrective action.

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: Under a final rule adopted by federal banking agencies in 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization's ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the Board of Directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs, and many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.


text: Risk Management and Strategy Information security and cybersecurity risk is the risk that the security, confidentiality, integrity or availability of our information and critical information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Cybersecurity attacks and other security breaches can have material adverse impacts on our business. While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. The Bank devotes significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs. However, our facilities and systems, and those of third-party service providers, are still vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. The Company seeks to address cybersecurity risks by implementing a governance structure and processes to assess, identify, manage, remediate, and report cybersecurity risks.


text: Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture. We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable "best practices" and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by have in place a robust incident response process that helps ensure our preparedness for a cybersecurity incident including our ability to detect, analyze, contain, remediate, and recover from a security incident as well as conduct post-incident analysis to avoid future incidents. Incident response process activities are overseen by cross-functional leadership in Risk Management, Operations, Information Security, Compliance, and Information Systems. Security events and incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business, and overall privacy impacts. We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.


text: Our risk management program regularly assesses third party risks (inclusive of fourth-party risk) by conducting activities to identify and mitigate risks from third parties (e.g., vendors, suppliers, and other business partners). Cybersecurity risks are evaluated when selecting and managing applicable third-parties that handle or process employee, business, or customer data, and a review process that includes due diligence over a third-party's information security and technology control environment is conducted at onboarding and periodically throughout the lifecycle of the relationship to ensure that systems of third- parties meet certain security baseline requirements. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.


text: Cybersecurity Gover nance the importance of information security, privacy and data protection to our stakeholders, cybersecurity is a critical part of our risk management program and a key focus area for our Board and Executive Management. The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help manage our risk exposure to meet our strategic objectives. Executive Management and our Information Security Officer ("ISO") regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition; however, cybersecurity threats are pervasive. Despite the capabilities, processes and security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, cybersecurity threats are continuously evolving, which may cause cybersecurity threats to be more difficult to detect in the future. See "Risk Factors - Risks Related to Cybersecurity and Information Technology" in Part I, Item 1A of this Form 10-K, for additional information about these and other risks related to cybersecurity and information technology.


text: Cybercriminals, hackers, and threat-actors are becoming more sophisticated and effective every day. To mitigate threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data that our customers and other stakeholders entrust to us a top priority. We are committed to safeguarding the confidentiality, integrity, and availability of all physical and electronic information assets to ensure that regulatory, operational, and contractual requirements are fulfilled. Our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We have not previously experienced a cybersecurity event that was determined to be material, and our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: VirnetX Holding Corp

ticker: VHC


text: Risk Management and Strategy We have developed detailed policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats as a part of our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications or requirements, however, we do use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our own and our customer's information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding such incidents can be made by management, the Board of Directors, and legal counsel in a timely manner.


text: We conduct cybersecurity risk assessments annually, quarterly and upon certain triggering events. Such risk assessments take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., security incidents that have impacted other companies, industry trends, and recommendations from our IT vendors). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board of Directors and members of senior management.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems and infrastructure from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and management plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and management plans address — and guide our employees, management, and Board of Directors on — our response to a cybersecurity incident. In the event of an incident, we intend to follow our incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as the Board of Directors and senior management, as appropriate.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we encourage our providers to meet appropriate security procedures, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through privacy and security trainings to enhance employee awareness of how to detect and report cybersecurity threats and cybersecurity incidents.


text: The Nominating and Corporate Governance Committee (the "Committee") and senior management oversee our cybersecurity risk processes and policies. The Committee receives regular reports from senior management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including security risks and information security vulnerabilities. The Committee also ensures that procedures for safeguarding the Company's information technology ("IT") systems are documented and implemented, monitors the effectiveness of the Company's cybersecurity program for protecting against internal and external threats as well as disaster recovery and disruption mitigation, and addresses deficiencies as the threat and business landscape continues to evolve. The Board of Directors receives regular updates from the Committee based on such oversight and communications with senior management regarding cybersecurity risk resulting from risk and control maturity assessments, progress of risk reduction initiatives, external auditor feedback and relevant internal and industry cybersecurity incidents.


text: Our Board of Directors has technical and industry expertise in risk management, computer security and information technology matters. Specifically, the chairperson of the Committee has 40 years of experience in the cybersecurity field, was a former sub-chairman of the NIST Board of Assessment for Programs/National Research Council and holds CISSP, CRISC and CDPSE certifications.


text: Management's Role Our Chief Technology Officer ("CTO"), Director of IT (Information Technology), and Vice President of Platform Engineering (collectively, the "Security Team") have primary responsibility for assessing and managing cybersecurity risks. The Security Team reviews security performance metrics, identifies security risks, and assesses the status of approved security enhancements. The Security Team also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Our CTO, holding a Doctorate in Strategic Intelligence, has served in various roles in technology research and military intelligence for 27 years. Our Director of IT, holding a degree in Computer Technology, has served in various roles in information technology for 30 years. Our Vice President of Platform Engineering has served in various roles in information technology and information security for over 33 years.


text: The Company may review System and Organization Controls 1 ("SOC1") or System and Organization Controls 2 ("SOC2") reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cybersecurity and awareness training to our employees to help mitigate the risk of threats posed by bad actors requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: On July 19, 2024, CreditRiskMonitor.com detected unauthorized occurrences within its computer network. Upon detection, the Company immediately activated its incident response plan and took steps to contain, assess and remediate the incident. The incident did not have a material impact on the Company, including its business strategy, results of operations, or financial condition.


text: Board of Directors -- The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee and the full Board of Directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or Chief Technology Officer.


text: Management -- Under the oversight of the Audit Committee of the Company's Board of Directors, the Chief Technology Officer, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Chief Technology Officer are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is everchanging, the Company must make continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup and recovery systems to restore systems and return to normal operations. However, there can be no assurance that the Company's ability to monitor or mitigate cybersecurity risks will be fully effective, and the Company may fail to identify cybersecurity breaches or discover them in a timely way."


text: Risk Management and Strategy The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board of Directors and Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Sarbanes-Oxley & Cybersecurity Steering Committee, which includes the Company's President and Chief Financial Officer ("CFO") and Vice President of Information Technology.


text: Risk Management and Strategy The Company's operations rely on the secure processing, storage, and transmission of confidential and personal identifiable information within various technology platforms. Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats. We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers. Such processes and programs are a part of the Company's overall risk management and compliance programs. The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring. The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness training program for all employees. This training is reinforced through periodic simulated phishing tests to assess our employees' responses to suspicious emails.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data centers. It also includes a comprehensive disaster recovery plan that is continually tested and designed to help enable us to resume business in the event of a disaster or cybersecurity incident. Through recurring internal and external audits, controls are regularly reviewed, tested, and enhanced to promote best practices. The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Security Officer (CISO) duties such as counter-threat intelligence.


text: Our information security program also includes a cybersecurity Incident Response Plan ("IRP") that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders. The Company also maintains dedicated cyber liability insurance for breach event costs including: post breach event remediation costs;


text: cybercrime coverage (including financial fraud, telecommunications fraud, and phishing attacks); and coverage for system failure, bricking loss, and physical damage. The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach.


text: We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security threats. Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board has delegated oversight of the Company's information security program and matters of cybersecurity to the Audit Committee of the board of directors. The Company's senior officers, including its Chief Information Officer, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company's risk mitigation efforts related thereto.


text: In addition, the Company's information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.


text: Risk Management and Strategy We employ a cybersecurity program which we believe is appropriate for the potential of cybersecurity threats faced by us and is built upon a set of policies, procedures and standards supported by training and education. Our information systems employ local and cloud storage and recovery services from various third parties. We have established processes to assess, identify, and manage risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes and engaged third-party consultants to assess and gather threat intelligence and cyber risk trends and conduct assessments and testing of our cybersecurity procedures and protections, which is overseen by our Board of Directors through our Audit Committee, along with our executive management.

companyName: FEMASYS INC

ticker: FEMY


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for unauthorized access to our information technology systems and identify potential security threats through various automated detection solutions. To protect the security of our information infrastructure and protect our systems and information from unauthorized access, we draw on the knowledge and insights of an external information technology consultant who acts as our primary IT administrator and employ an array of third-party tools and technologies.


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "General Risks Governance and Role of Management and the Board Our Chief Operating Officer leads our cybersecurity program and reports, with respect to cybersecurity incidents, to the Company's Chief Financial Officer. Our Chief Financial Officer reports directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversight, including cybersecurity risks. The Chief Financial Officer or Chief Operating Officer briefs the Board and Audit Committee on the effectiveness of our cybersecurity program quarterly. The Chief Operating Officer oversees the operation of our cybersecurity program and has over 20 years of executive experience overseeing risk management and internal controls. The Chief Financial Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Financial Officer's oversight of the Company's information technology function and supervision of the Company's IT administrator. We have not experienced any cybersecurity threats or incidents that have had a material impact on our business to date.


text: Risk Management and assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As we grow, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: cybersecurity program is overseen by our head of human resources, information technology (IT) and facilities, who manages our third-party providers of IT services. We have engaged contractors to provide cybersecurity standards, architecture and processes. As part of our service agreement with our contractors, we receive identification and reporting of risks to our management and board. Our information technology team maintains a security operations center intended to identify anomalous activity.


text: Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.


text: Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: "Our business and operations would suffer, and could be negatively affected, in the event of system failures or cyberattack s. "


text: The CISO reports to the Chief Accounting Officer ("CAO"), who provides the Committee with bi-annual updates about our cybersecurity program and material risks.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our IT processes. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through this process, cybersecurity risks are presented to the executive leadership team, including the Chief Executive Officer ("CEO") and CAO, as well as reported to the Committee.


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel identify and oversee material risks from cybersecurity threats associated with our use of such entities. CHICAGO ATLANTIC BDC, INC.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in depth, layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat, creating the possibility of future events. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology based products and services by us and our customers.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers. We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.


text: Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our Board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board receives an Annual Report from the Director of Information Technology on the Bank's Information Technology Systems, including cybersecurity risk.


text: While to our knowledge no previous cybersecurity incidents have occurred, we seek to continuously expand and improve our information technology systems, including implementing new internally developed and/or external industry standard enterprise resource planning systems ("ERP systems"), to assist us in the management of our business. We maintain information technology measures designed to protect us against intellectual property theft, data breaches and other cyber-attacks. The implementation, maintenance and improvement of these systems require significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving and expanding our core systems as well as implementing new systems, including the disruption of our data management, procurement, manufacturing execution, finance and supply chain processes.

companyName: Cenntro Inc.

ticker: CENN


text: Elements our cybersecurity information technology measures include efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through: • Cybersecurity risk assessments for identification of material cybersecurity risks to our critical systems, information, products, and our technology environment; • Security personnel and vendors responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Training and awareness programs for our personnel and senior management to drive adoption and awareness of cybersecurity processes and information technology measures; • A cybersecurity monitoring program responsible for tools that produce alerts and reports of suspicious activity for the prevention of and response to cybersecurity incidents; • Internal testing and assessments, where appropriate, of our cybersecurity information technology measures; • Management of external consultants and services engaged by us, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity information technology measures; and • A third-party risk management process for evaluating cybersecurity threats associated with our use of service providers, suppliers, and vendors.


text: We cannot assure you that any of our new information technology systems or their required functionality will be effectively implemented, maintained or expanded as planned. If we do not successfully maintain our information technology or expand these systems as planned, our operations may be disrupted, our ability to accurately or timely report our financial results could be impaired, and deficiencies may arise in our internal control over financial reporting, which may adversely affect our ability to certify our financial results. Moreover, our proprietary information could be compromised or misappropriated, and our reputation may be adversely affected. If these systems or their functionality do not operate as we expect them to, we may be required to expend significant resources to make corrections or find alternative sources for performing these functions.


text: Our business operations rely on the secure processing, storage, and transmission of certain confidential, sensitive, proprietary, and other information, as well as personal information about our customers and employees.

companyName: CHARLES & COLVARD LTD


text: Risk Management and Strategy We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated with our overall risk assessment process and has been embedded in our operating procedures, internal controls and information systems.


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices consistent with National Institute of Standards and Technology, or NIST and Cybersecurity Framework, or CSF. We have invested and continue to invest in risk management and information security and data privacy measures in order to protect our systems and data, including employee training, organizational investments, incident response plans, and technical defenses. The cost and operational consequences of implementing, maintaining, and enhancing data or system protection measures could increase significantly to overcome intense, complex, and sophisticated global cyber threats.


text: We constantly monitor our cybersecurity environment and coordinate with third-party consultants to provide regular cybersecurity training and promote cybersecurity awareness across the organization.


text: In addition, we and certain of our third-party vendors receive and store certain information associated with our sales operations and other aspects of our business. In connection with our e-commerce business, we rely on encryption and authentication technology licensed from third parties to effect secure transmission of confidential information. Our disclosure controls and procedures address cybersecurity and include elements intended to ensure that there is an analysis of potential disclosure obligations arising from security breaches. We also maintain compliance programs to address the potential applicability of restrictions against trading while in possession of material, nonpublic information generally and in connection with a cybersecurity breach. The breakdown in existing controls and procedures around our cybersecurity environment may prevent us from detecting, reporting or responding to cyber incidents in a timely manner and could have a material adverse effect on our financial position and value of our Company's stock. Despite our implementation of security measures, our IT systems and e-commerce business are vulnerable to damages from computer viruses, natural disasters, unauthorized access, cyber-attack, and other similar disruptions.


text: On or about June 28, 2023, we identified a cybersecurity incident that temporarily disrupted the Company's IT network and resulted in some limited downtime for certain systems. Through investigation, we confirmed that this event was related to an apparent ransomware attack involving the unauthorized encryption of some of our files and the deployment of malware. This incident required us to temporarily implement manual processes to conduct our operations with as little disruption to production as possible. There were no payments made in this cybersecurity incident and no material impact on the operations of our business operating segments.


text: We have not encountered any cybersecurity threats or incidents that have had a material impact on our business. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Risk Factors– Risks Related to our Operations - Our information technology, or IT, infrastructure, and our network has been and may be impacted by a cyber-attack or other security incident as a result of the rise of cybersecurity events."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports on our cybersecurity risks and processes from management. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Board also receives briefings from management on our risk management program, which includes our cybersecurity risk management. Presentations on cybersecurity topics are made as appropriate by our Chief Executive Officer.


text: Our management team, including our Chief Executive Officer and Chief Financial Officer, whom are supported by our information technology consultant, are responsible for assessing and managing our material risks from cybersecurity threats. This team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team members have relevant experience in risk assessment and management, and our information technology consultant has over 25 years of IT and Cybersecurity experience.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our third - party vendors; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks leveraging sophisticated AI-enabled tools from nation-state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.

companyName: EPLUS INC

ticker: PLUS


text: We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.


text: Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.


text: Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not be discovered, occur, or result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A. "Risk Factors."


text: Management and Strategy Roivant's corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cybersecurity threat and incident detection and response centrally at Roivant and the majority of our Vants. Certain of our Vants, including Immunovant and our healthcare technology Vants, have established and maintain separate cybersecurity functions which are similarly designed to protect their information and assets from cybersecurity threats or incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Roivant and the Vants' cybersecurity programs are informed by industry standards and include periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management and monitoring tools, designed to monitor, identify and manage risks from cybersecurity threats and incidents. In addition, we have implemented employee security and awareness training related to cybersecurity threats and incidents.


text: Governance Related to Cybersecurity Risks Roivant's board of directors oversees our overall risk management strategy, including with respect to cybersecurity risks. Cybersecurity risk management policies and procedures are integrated into our overall risk management strategy, which is overseen by the audit committee of the board of directors ("Audit Committee"). At least annually, the Audit Committee discusses our risk management program, including any information security and technology risks and findings from any audits, with our Chief Accounting Officer and other members of our management team.


text: Immunovant and the healthcare technology Vants that have established and maintain separate cybersecurity functions, governance is similarly overseen in the first instance by the boards of directors of those Vants as part of their overall risk management strategy, with ultimate oversight on a company-wide basis by the Roivant board of directors.


text: the importance of cybersecurity to our business, we maintain a cybersecurity program that is based on a set of cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo periodic evaluations of our cybersecurity program through cybersecurity assessment and cybersecurity incident response tabletop exercises, conducted by our cybersecurity advisors.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: As a result of such assessments and exercises, a number of processes have been established or are being improved upon to support the protection of our data and systems.


text: Management Oversight The existing controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology ("IT") consultant. Our IT consultant leverages its over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents. Our IT consultant reports on its activities to senior management who then assess and manage risks of cybersecurity threats.


text: While our Board of Directors (the "Board") has overall responsibility for risk oversight, the Audit Committee of the Board (the "Audit Committee") oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives periodic updates regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.


text: Cybersecurity Risks maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, evaluate their associated impacts and risk levels, and document them accordingly in the Cybersecurity Risk Register.


text: For additional information, see "Item 1A—Risk Factors." In the last reporting year, we did not experience any material cybersecurity incidents or threats.


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended June 30, 2025. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Third-Party Engagement The Company employs third-party risk security vendors to identify, mitigate, and remediate cybersecurity risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful. The Company employs a third-party vendor to securely host the Company's data in a cloud-based storage system. The third-party vendor conducts quarterly vulnerability scans on both the hosted data environment and the Company's corporate data network. Scans of the Company's firewall are conducted regularly by the third-party vendor. Any necessary remediation would also be provided by the third-party vendor after the scan, but none has been required. The Company uses multiple third-party developed software to continually monitor technology systems for viruses, malicious software, executable harmful files, and other cybersecurity risks. The Company requires the annual submission of SOC 1 security certificates from our third-party vendors which have access to our financial and sales data. The Company also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity related incidents.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: The Company recognizes that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each employee is required to complete information security and data privacy training to build awareness of cybersecurity risks to the organization. The Company has engaged a third-party vendor to periodically send each employee an email that mimics a potentially harmful phishing attempt each month and to report to management the results of the phishing security test.


text: The Bank has implemented an information security program that encompasses the Bank's cybersecurity efforts as part of its risk management process. Risk assessments, including Information Technology and Cybersecurity Risk, are conducted annually by the Chief Risk Officer, Information Technology Officer and Information Security Officer to identify, assess and mitigate risks.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: The Bank recognizes the need for sound physical and internal controls over its critical financial data, confidential information and digital assets to ensure the accuracy, integrity, and confidentiality of the processed information. As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies.


text: Cybersecurity Risk Management and Strategy Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: DevvStream Corp.

ticker: DEVS


text: We have implemented an information security management system in accordance with our risk profile and business that is designed to protect the Company, our employees, and our shareholders from cybersecurity threats. We have also developed an incident response policy and procedure designed to facilitate the handling of cybersecurity incidents.


text: Our cybersecurity risk management program seeks to proactively identify, assess, and mitigate risks from cybersecurity threats. Key components include informal self-assessments, third-party managed security services, malware protection, and network security controls. We also maintain a cyber insurance policy that provides coverage for certain costs and liabilities associated with cybersecurity incidents, including data breaches and network interruptions; however, such insurance may not be sufficient to cover all losses in every circumstance.


text: We take a risk-based approach to the evaluation and oversight of third-party vendors with access to Company systems or data.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and cybersecurity incidents that could affect our information or systems. For more information, see Item 1A. Risk Factors.


text: Governance Oversight of Cybersecurity Risk Management Oversight of cybersecurity risk is the responsibility of the Board of Directors as part of its broader role in overseeing the Company's enterprise risk management framework. The Board receives periodic updates from management regarding cybersecurity matters, including the Company's information security program, risk assessments, and incident response preparedness.


text: The Board delegates certain aspects of enterprise risk oversight to its committees as appropriate; however, cybersecurity risk management is primarily monitored at the full Board level. The Board regularly reviews management's assessment of cybersecurity risks, key controls in place to mitigate those risks, and the Company's overall cyber readiness.


text: Management is responsible for implementing and maintaining the Company's cybersecurity policies, programs, and controls, and for reporting to the Board on material developments and significant incidents. Updates to the Board occur at least annually and more frequently as needed in the event of notable changes in the threat environment or incidents requiring attention.


text: The Company conducts quarterly meetings of the IT and financial leadership of the Company's segments, including the CFO, and information from those meetings is provided to the Company's Audit Committee, which typically meets on a quarterly basis. At each Audit Committee meeting, the CFO provides an update to the Audit Committee on any relevant current and new IT risks and the general health of the IT risk management program, including cybersecurity risks. The CFO also provides the Audit Committee with a quarterly written cybersecurity brief from IT leadership, including an incident reporting log, a review of emerging cybersecurity risks and developments, an assessment of the overall effectiveness of our cybersecurity programs and recommended updates to our cybersecurity risk assessment program. Management, along with our CFO, is responsible for developing the cybersecurity strategy and supervising our cybersecurity risk management program. Our IT team supports these efforts by managing day-to-day operations, including threat detection, incident response and system monitoring. Our cybersecurity incident reporting and escalation plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior Company management and our Audit Committee and/or Board of Directors, as applicable.

companyName: JANEL CORP

ticker: JANL


text: The Company has established an Enterprise Risk Committee, which is co-chaired by the Company's Chief Financial Officer and Senior Managing Director of Legal Affairs, and under that framework has chartered a Cybersecurity Sub-Committee, chaired by the Chief Technology Officer. Both committees include various other members of key senior management. Our Board of Directors (including our Audit Committee through delegation as described below), along with our Enterprise Risk Committee and Cybersecurity Sub-Committee, are actively involved in providing oversight of our cybersecurity program. The role of the Board of Directors in the Company's risk oversight process includes receiving reports and presentations from the Enterprise Risk Committee or other senior management leaders on areas of material risk to the Company, including operational, financial, legal and regulatory, strategic, reputational, cybersecurity and Environmental, Social and Governance ("ESG") related risks and any measures taken to mitigate such risks. In addition, the Board of Directors regularly reviews and discusses areas of material risk at its meetings. In essence, the Board of Directors oversees a company-wide approach to risk management, carried out by Company management. With respect to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to the Company's cybersecurity and data-protection measures, including related to monitoring, controlling and mitigating against such risks, and the entire Board receives periodic updates on the Company's cybersecurity risk management processes. There have been no material cybersecurity incidents in the periods presented in this Report.

companyName: JOHNSON OUTDOORS INC

ticker: JOUT


text: We have adopted processes, guided by the Center for Internet Security (CIS) Cybersecurity Framework, designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. We have implemented controls, such as Multi-Factor Authentication (MFA) and endpoint detection and response (EDR) solutions, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Furthermore, we maintain a formal, Incident Response Plan (IRP) and conduct mandatory, ongoing security awareness training for all employees. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.

companyName: PHOTRONICS INC

ticker: PLAB


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has ultimate responsibility for the oversight of risk management, including risks from cybersecurity threats. The Board of Directors has delegated primary oversight of cybersecurity risk to the Cyber Security Risk Management Committee. The Committee, in turn, ensures its members either possess or have access to relevant cybersecurity and risk management expertise to effectively challenge and guide management's program. The Committee regularly assesses how management is managing these risks and reports on its activities to the full Board of Directors at least quarterly to promote effective coordination and ensure the entire Board remains apprised of the cybersecurity risk landscape and the program's effectiveness.


text: The day-to-day cybersecurity program is led by the Company's Vice President, IT Infrastructure & Information Security. This role is supported by a dedicated security team and reports directly to the Chief Executive Officer. The Vice President, IT Infrastructure & Information Security provides formal, quarterly updates to the Cyber Security Risk Management Committee. These updates cover cyber risk management governance, the status of ongoing efforts to strengthen cybersecurity effectiveness, key risk metrics and the material outcomes of risk assessments, and significant cybersecurity-related news events impacting the industry. In addition to scheduled reports, the Board of Directors engages in ad hoc conversations with management to discuss any significant updates to our cybersecurity risk management and initiatives, particularly in response to emerging threats.


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers.


text: We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.


text: As one of the largest global pharmaceutical sourcing and distribution services companies engaged in helping both healthcare providers and pharmaceutical and biotechnology manufacturers, we are exposed to various cybersecurity threats. These threats include both those typical of companies operating in many industries, like ransomware and denial-of-service attacks, as well as more sophisticated and persistent threats from highly organized adversaries that specifically target the healthcare sector and other critical infrastructure. Our suppliers, third-party vendors, service providers, customers, and other business partners (collectively, our "third-party business partners") are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations. In light of these risks, cybersecurity is a priority for the Company, management, and our Board of Directors (the "Board"), and we believe that it is essential for us to invest substantial resources in our cybersecurity efforts.

companyName: Cencora, Inc.

ticker: COR


text: Risk Management and Strategy Cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and advisors, and oversight from our Board, regularly performs an enterprise-wide risk assessment to identify key existing and emerging risks.


text: To oversee cybersecurity risk at the management level, we employ a Chief Data and Information Officer ("CDIO") and a Chief Information Security Officer ("CISO"). The CDIO is responsible for the global data landscape and IT systems across our business units, including information security. The CISO leads our Information Security team. The CISO and his team are responsible for administering our comprehensive, company-wide information security program, which includes strategy, regulatory intelligence, IT risk management, policy development, security engineering, cyber threat detection, response, and operations. Our information security program is based upon, informed by, and responsive to industry best practice frameworks such as HITRUST CSF and ISO 27001. Our program undergoes an internal annual review that is conducted by our CISO, as well as an annual third-party external review. Additionally, we leverage a diverse array of internal and external assessors, consultants, auditors, and other third parties to identify opportunities for improvements to our information security program through methods such as penetration testing, independent audits, and consulting on best practices to address emerging risks and challenges. These assessments encompass evaluations of both the design and operational effectiveness of our security measures. Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto. We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.


text: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board's Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a detailed and comprehensive framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company's senior management, including our ECCRT (as defined below), and the Board. Under the guidance of our CISO, the Response Plan is routinely evaluated and updated as appropriate. In addition to our Response Plan, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents. For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction. Accordingly, we require employees to complete periodic access-based and role-based privacy and cybersecurity training. These trainings are routinely updated to reflect changes in the threat environment, assessment, and/or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.


text: We recognize that our cybersecurity risk profile extends beyond our organization. As such, we strive to manage cybersecurity risks associated with our third-party business partners and external users of our systems. Our third-party business partner risk management program is built upon, informed by, and responsive to industry best practices. This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners. Specifically, to evaluate third-party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.


text: Our information systems have been subject to cybersecurity incidents in the past, including the incident disclosed in February 2024 relating to certain exfiltrated data. The incident has not had a material impact on the Company's operations and, as previously disclosed, we do not believe that the incident is reasonably likely to materially impact our financial condition or results of operations. However, there is no guarantee that future cybersecurity incidents will not have a material impact. Despite our comprehensive approach to cybersecurity, we may not be able to prevent or mitigate a cybersecurity incident that could materially impact our business, results of operations, or financial condition. While we hold cybersecurity insurance, the expenses associated with cybersecurity threats or disruptions may not be completely covered by our policy. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Board Governance and Management As described above, our CDIO leads management's assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance. The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Executive Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters. Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 25 plus years of IT and relevant cybersecurity experience.


text: Additionally, we have established the Extended Cyber Crisis Response Team ("ECCRT"). The ECCRT is a cross-functional incident response team comprised of senior leaders from across the various departments of the organization that, in the event of a cyber incident, helps lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.


text: Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight. While the full Board retains overall oversight over cybersecurity, the Board has delegated to its Audit Committee oversight of the Company's information technology security program and the controls around cybersecurity and to its Compliance and Risk Committee oversight of an enterprise risk management program that is designed to assist with monitoring and mitigating operational risks. The Audit Committee and Compliance and Risk Committee meet every quarter. The Audit Committee is updated as needed on cybersecurity threats, incidents, and programs, and the Compliance and Risk Committee is updated as needed on new developments in our cybersecurity risk profile. After each such meeting, the respective chairs of the Audit Committee and Compliance and Risk Committee provide a report to the full Board on the committee meeting.


text: Senior leadership, including our CDIO and CISO, routinely update and report to the Board, the Audit Committee, and the Compliance and Risk Committee, as applicable, on our cybersecurity and information security risks and the management of such risks, our data governance and usage, our technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.


text: As one of the largest global pharmaceutical sourcing and distribution services companies engaged in helping both healthcare providers and pharmaceutical and biotechnology manufacturers, we are exposed to various cybersecurity threats. These threats include both those typical of companies operating in many industries, like ransomware and denial-of-service attacks, as well as more sophisticated and persistent threats from highly organized adversaries that specifically target the healthcare sector and other critical infrastructure. The emergence of artificial intelligence has provided additional tools for those who perpetrate these attacks, including through social engineering, the development of customized malware, and an enhanced ability to evade detection. Our suppliers, third-party vendors, service providers, customers, contractors, those who work for our contractors, and other business partners (collectively, our "third-party business partners") are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations. In light of these risks, cybersecurity is a priority for the Company, management, and our Board of Directors (the "Board"), and we believe that it is essential for us to invest substantial resources in our cybersecurity efforts.


text: To oversee cybersecurity risk at the management level, we employ a Chief Data and Information Officer ("CDIO") and a Chief Information Security Officer ("CISO"). The CDIO is responsible for the global data landscape and IT systems across our business units, including information security. The CISO leads our Information Security team. The CISO and his team are responsible for administering our comprehensive, company-wide information security program, which includes strategy, regulatory intelligence, IT risk management, policy development, security engineering, cyber threat detection, response, and operations. Our information security program is based upon, informed by, and responsive to industry best practice frameworks such as HITRUST CSF and ISO 27001. Our program undergoes an internal annual review that is conducted by our CISO, as well as an annual third-party external review. Additionally, we leverage a diverse array of internal and external assessors, consultants, auditors, and other third parties to identify opportunities for improvements to our information security program through methods such as penetration testing, independent audits, and consulting on best practices to address emerging risks and challenges. These assessments encompass evaluations of both the design and operational effectiveness of our security measures. They also consider the evolution of different cybersecurity threats, including through artificial intelligence. Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto. We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.


text: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board's Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company's senior management, including our ECCRT (as defined below), and the Board. Under the guidance of our CISO, the Response Process is routinely evaluated, tested and updated as appropriate. In addition to our Response Process, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents. For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction. Accordingly, we require employees to complete periodic access-based and role-based privacy and cybersecurity training. These trainings are routinely updated to reflect changes in the threat environment, assessment, and/or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.


text: We recognize that our cybersecurity risk profile extends beyond our organization. As such, we strive to manage cybersecurity risks associated with our third-party business partners and external users of our systems. Our third-party business partner risk management program is built upon, informed by, and responsive to industry best practices. This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners. Specifically, to evaluate third- party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.


text: Our information systems have been subject to cybersecurity incidents in the past. To date, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect us. However, there is no guarantee that future cybersecurity incidents will not have a material impact. Despite our comprehensive approach to cybersecurity, we may not be able to prevent or mitigate a cybersecurity incident that could materially impact our business, results of operations, or financial condition. While we hold cybersecurity insurance, the expenses associated with cybersecurity threats or disruptions may not be completely covered by our policy. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Board Governance and Management As described above, our CDIO leads management's assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance. The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Enterprise Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters. Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 20 plus years of IT and relevant cybersecurity experience.


text: Additionally, we have an Extended Cyber Crisis Response Team ("ECCRT"), which is a cross-functional team comprised of senior leaders that, in the event of a cyber incident, help lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.


text: Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight. While the full Board retains overall oversight over cybersecurity, the Board has delegated to its Audit Committee oversight of the Company's information technology security program and the controls around cybersecurity, and to its Compliance and Risk Committee oversight of an enterprise risk management program that is designed to assist with monitoring and mitigating operational risks. The Audit Committee and Compliance and Risk Committee meet every quarter. The Audit Committee is updated as needed on cybersecurity threats, incidents, and programs, and the Compliance and Risk Committee is updated as needed on new developments in our cybersecurity risk profile. After each such meeting, the respective chairs of the Audit Committee and Compliance and Risk Committee provide a report to the full Board on the committee meeting.


text: How management is informed of and monitors incidents Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity programs. Our cybersecurity programs are under the direction of our CSO (in coordination with our Chief Privacy and Data Responsibility Officer, Chief Data Officer, among others), who receives reports from our cybersecurity teams and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our management, including the CSO and our cybersecurity teams, follow a risk-based escalation process to notify the Risk Committee outside of the regular reporting cycle as appropriate when they identify an emerging risk or material issue.

companyName: Mastercard Inc

ticker: MA