text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for managing the risk inherent to engaging with external service providers, suppliers, and vendors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committee on our cybersecurity risk management program.

companyName: Seer, Inc.

ticker: SEER

secItem: Item 1C


text: The Audit Committee receives regular reports from our VP of Information Technology on our cybersecurity risks. In addition, our VP of Information Technology updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: We have established an internal cross-functional Steering Committee and a leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The Steering Committee is chaired by our VP of Information Technology and is comprised of leaders from Software Development, Research and Development and Data teams. The Steering Committee oversees the cybersecurity program relevance and effectiveness through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment. Updates from the Steering Committee are provided quarterly to an executive leadership committee, which is chaired by our VP of Information Technology and is comprised of the President and Chief Financial Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product Development.


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our VP of Information Technology has over 20 years of experience managing global IT operations, including strategy, information security, applications, infrastructure, support and execution.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our clients' and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the Senior Vice President General Counsel. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes created by artificial intelligence). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework.


text: We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance, including review of past cybersecurity incidents in order to address known vulnerabilities. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks.


text: Cybersecurity Governance Our global cybersecurity and privacy program is managed by our Chief Technology and Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer ("CPO"), and Chief Information Officer ("CIO"). We have also established a Cybersecurity and Privacy Council, which comprises our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs.


text: The Board's Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures. In addition to other written policies and procedures, the Company has instituted an Information Security Incident Response Plan ("IRP") which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents. Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate. These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data. T he objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders. The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks. Such reporting includes updates on the Company's IRP, the external threat environment, and the Company's programs to address and mitigate the risks associated with the cybersecurity threat environment. The IRP and internal controls around cybersecurity are periodically evaluated by external experts and the results of those reviews are reported to the Audit Committee.

companyName: BRUKER CORP

ticker: BRKR


text: Cybersecurity incidents may occur at, or be reported to, any of the Company's facilities worldwide. The Company has an IT Service Desk which acts as the single point of contact for cybersecurity incident reporting. Employees can notify the IT Service Desk of any event that they observe or is reported to them that may constitute a cybersecurity incident. Once notified, the IT Service Desk team conducts an initial classification and escalates, when needed, to the CISO and other members of ISIRT as per the Company's IRP. Financial Ops, in consultation with the General Counsel, CPO and CISO, decide whether to activate the ISIRT in connection with any escalated incident. When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances. As of December 31, 2024, no identified risk has required activation of the ISIRT.


text: In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents. Based upon the assessment of the type of incident and risk presented, the ISIRT engages outside counsel and/or external resources, such as forensic consultants, to conduct or assist with cybersecurity investigations in order to provide advice to the Company. The vendors we engage with are globally recognized companies with expertise in cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards. The Company also conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training on at least an annual basis, which educates our employees on the Company's policies and procedures for handling personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Annual Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team with substantial relevant experience in designing and managing our information technology infrastructure and system, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and conduct vendor risk assessments for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Privacy Officer, Chief Operations Officer (who is also acting as head of our security team), Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Julie Rubinstein, who serves as our Chief Operations Officer, is leading our security team on an interim basis and is supported by a fractional chief information security officer.


text: Led by our Director of Information Technology and Security ("Director of IT") with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: Innovex maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") and the Cybersecurity Framework. Innovex has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST Cybersecurity Framework. Innovex contracts a Cyber Security Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. An annual incident response drill is in place to prepare support teams in the event of a significant incident. Cyber partners are a key part of Innovex's cybersecurity infrastructure. Innovex partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Innovex engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Innovex's environment.

companyName: Innovex International, Inc.

ticker: INVX


text: Innovex's VP of IT reports to Innovex's Chief Financial Officer and is the head of the Company's cybersecurity team. The VP of IT is responsible for assessing and managing Innovex's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Innovex. The Audit Committee of the board of directors oversees Innovex's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The IT department briefs the Audit Committee on the effectiveness of Innovex's cyber risk management program, typically on a semiannual basis. In addition, cybersecurity risks are reviewed by the Innovex board of directors, at least annually, as part of the Company's corporate risk mapping exercise. Innovex faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Innovex has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Innovex's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors—Risks Related to Technology Advancement—We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" and "Item 1A. Risk Factors—Risks Related to Technology Advancement—We have experienced IT system disruptions and cyber attacks in the past, and a failure of our IT infrastructure and cyber attacks could adversely impact us in the future."


text: Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer ("CISO") on cybersecurity risks, industry trends, and best practices.


text: The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.


text: The Board of Directors is also responsible for the approval and oversight of the Information Security ("IS") Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.


text: We depend on third-party service providers to support our business and operational activities and to help us achieve our strategic goals. However, these third parties can introduce various risks to us and our customers. To mitigate these risks, we have established a Third Party Risk Management framework. This framework equips us with the necessary tools and practices for effective oversight of third-party service providers, ensuring compliance with legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.


text: Our vendor risk management practices are robust and include comprehensive risk assessments of suppliers, with a strong emphasis on cybersecurity. We use commercially available services to monitor our vendors, providing security scores for supplier technology services, threat intelligence, financial intelligence, and other cybersecurity-related considerations. Regular reviews are conducted to track changes in our vendors' cybersecurity risk posture, and continuous threat intelligence monitoring helps identify potential cybersecurity incidents involving third parties. We also strive to negotiate appropriate cybersecurity provisions in our vendor contracts.


text: For the 2024 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, see Item 1A. "Risk Factors," including the risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."


text: Risk Management and Strategy We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address the threat landscape, we maintain a cybersecurity risk management strategy that is designed to identify, assess, manage, and address cybersecurity threats that may have a material impact on our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology, or NIST Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.


text: We have established a process to review and assess vendors' security posture and practices prior to their onboarding. Vendors that access, store or process our data are required to respond to a cybersecurity questionnaire and provide applicable security audit reports and certifications. Our process also includes contractual requirements to maintain data protection safeguards for vendors that process data on our behalf.


text: We maintain a security awareness training program for employees, which is provided through digital microlearning assignments. We also provide additional mandatory trainings, including phishing training, throughout the year.


text: We maintain a Written Information Security Program, or WISP, that defines our organization's cybersecurity policies and procedures. This covers all aspects of cybersecurity, including but not limited to risk management, third party security assessments, security awareness training, acceptable use, endpoint security, patch management, log management, backup and recovery.


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by relevant members of our executive leadership team on at least an annual basis.


text: Our executive leadership team meets with our Head of Global Information Technology, along with other members of our IT security team as needed, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments. Senior management is thus kept abreast of the cybersecurity posture and potential risks facing our company. Our cybersecurity incident response process is designed to proactively triage, contain, investigate, mitigate and correct all incidents at the direction of the Head of Global Information Technology. Critical incidents are assessed for materiality, and escalated to the executive leadership team for awareness, direction and approval as needed. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, as needed, to provide oversight and guidance on critical cybersecurity issues.


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has more than two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.


text: In the last three fiscal years, we have no t experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, cybersecurity threats, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation," in Item 1A. Risk Factors, which disclosures are incorporated by reference herein.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Cybersecurity Governance Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our Board delegates to the Audit Committee oversight of certain aspects of our risk management process, including risks related to information technology, data privacy and cybersecurity.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; interruptions to our commercial operations, clinical trials or other operations; harm to our reputation; loss of revenue or profits; loss of sales and other adverse consequences."

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. Commencing in 2024, our Audit Committee, on behalf of the board of directors, provides oversight of our cybersecurity risk management program.


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs, which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.

companyName: West Bay BDC LLC


text: Our risk management team collaborates with our Chief Information Security Officer ("CISO") and our Head of Legal to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.

companyName: iTeos Therapeutics, Inc.


text: Our CISO and Cybersecurity Manager implement processes around security monitoring and vulnerability testing. We also have in place an incident response plan, which incorporates four overarching and interconnected stages: (1) preparation for a cybersecurity incident, (2) detection and analysis of a security incident, (3) containment, eradication and recovery, and (4) post-incident analysis. The plan specifies that security events and data incidents should be evaluated, ranked by severity and prioritized for response and remediation. Our procedures include an evaluation of incidents to determine materiality as well as operational, business and privacy impact. Our team of cybersecurity and information security professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. In addition to implementing technical security measures, we have maintained an ongoing cybersecurity awareness and training program.


text: As part of our risk management process, we engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In addition, we engage outside providers to conduct annual penetration testing.


text: We rely on third parties, including cloud vendors, for various business functions. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including security evaluation. Governance.


text: Our board of directors has established oversight mechanisms to manage risks from cybersecurity threats. The audit committee of our board of directors (the Audit Committee"), has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once a year and following any material cybersecurity incidents. Our board of directors receives periodic updates from our Audit Committee regarding matters of cybersecurity. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives.


text: Our cybersecurity program is overseen by our Head of Information Technology ("IT"), and is managed by our CISO and other leaders from our IT and legal departments. Our Head of IT, CISO and Cybersecurity Manager have an average of over 20 years of prior work experience in various roles involving IT, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to senior management and the Audit Committee on any appropriate items.


text: We maintain a Cybersecurity Incident Response Plan, or CIRP, which is designed to guide our response to cyber incidents, including to mitigate and contain any potential cybersecurity incidents that could affect our systems, network, or data. The CIRP identifies the individuals responsible for developing, maintaining, and following procedures related to cybersecurity incident response, including escalation protocols. We also engage external third-party consultants to provide services, such as penetration testing, which is conducted on an annual basis, along with ongoing vulnerability scans. These consultants also perform annual assessments of our cybersecurity program, which involve, among other things, review of our IT security measures and processes for alignment with the NIST Cybersecurity Framework and provision of threat intelligence regarding emerging risks to our information systems.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: We have not been materially affected by cybersecurity threats. We may, from time to time, experience threats to and security incidents related to our data systems but we do not believe they are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information, please see the risk factors entitled "Our internal computer systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer cybersecurity incidents, data breaches or other unauthorized or improper access, which could result in a material disruption of the development programs of our product candidates" and "Cybersecurity incidents, loss of data or modification of information, and other disruptions could compromise information related to our business or prevent us from accessing critical information, result in a significant disruption of our activities and expose us to liability, which could adversely affect our business and our reputation" in Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Our Head of Information Technology and Security, or Head of IT, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of information technology professionals to monitor cybersecurity risks on behalf of TScan. Our Head of IT has over 16 years' experience with information technology and cybersecurity risk management programs.


text: Our board of directors, as a whole and through its committees, is responsible for our overall enterprise risk management program, which incorporates as an element our cybersecurity risk management program. Our audit committee, a subcommittee of our board of directors, has been delegated responsibility for oversight of cybersecurity risk management, which includes reviewing our cybersecurity and other information, technology risks, controls and procedures, including our plans to mitigate and respond to cybersecurity risks. The Head of IT, alongside the Chief Legal and Compliance Officer, and Chief Financial Officer, provide quarterly reports to the audit committee covering cybersecurity and other information technology risks affecting us. These reports may include reviewing our current infrastructure and the status of key cybersecurity initiatives, including the status of ongoing mitigation efforts, providing insights into the latest cybersecurity threats, and discussing any recent security incidents impacting our peer companies. Periodically, or in the event of a critical cybersecurity incident, the Chief Legal and Compliance Officer, and Chief Financial Officer will provide our full board of directors with findings and recommendations from these reports.


text: Board of Directors Our board of directors, in coordination with the audit committee of our board of directors, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our audit committee regularly receives reports and presentations from the Technology Team regarding cybersecurity. The Technology Team also reports to our board of directors at least annually on cybersecurity matters. We have established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, are reported to our board of directors and/or our audit committee.

companyName: Techpoint, Inc.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factors entitled "Our business could be negatively affected by cyberattacks or a deficiency in our cybersecurity system and infrastructure" and "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in Item 1A- Risk Factors.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: Governance Related To Cybersecurity Risks Our cybersecurity process is overseen by our Information Technology department, which is managed by our Head of IT. The Head of IT role is currently held by an individual who has approximately two decades of professional IT management experience. In addition, our Security Leadership Team (SLT), which is comprised of the Head of IT as well as leaders from our operations, finance, and legal departments, is responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to a committee of our executive team (Executive Committee). The Executive Committee, which is led by our Chief Executive Officer, undertakes reviews of our cybersecurity program and assesses any security incident updates from the SLT on a quarterly basis.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Business Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Business Manager's management, and our Board and Audit Committee, as appropriate.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Governance and oversight of cybersecurity risks and strategies form a core component of our risk management framework. Recognizing the critical importance of cybersecurity in protecting our operations and preserving shareholder value, we have established a governance structure that emphasizes risk identification, management, and mitigation across our organization.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Central to our governance approach is the involvement of our Audit Committee, which maintains oversight over the Company's cybersecurity strategy.


text: Key to the Audit Committee's role is its periodic engagement with our cybersecurity team, as further described below, which provides direct communication and alignment on cybersecurity matters between members of our board and management. During these critical meetings, several pivotal areas are reviewed to assess the adequacy and effectiveness of our cybersecurity measures: • Incident Response: Evaluation of our readiness and response strategies to potential cybersecurity incidents. • Cybersecurity Industry Updates: Review of recent industry developments (i.e., new threats/tactics, industry news) to focus on compliance and adaptation of our strategies accordingly. • Acquisition Security Integration: Discussion on the security aspects of recent or upcoming acquisitions, focusing on the integration of their cybersecurity frameworks into our broader security posture. • Employee Security Awareness and Training: Information regarding our regular testing and training of employees is presented and discussed. • Penetration Test Results: Analysis of our regular penetration testing exercises, which help identify vulnerabilities and strengthen our defenses. • Questions and Answers: An open forum for the Audit Committee to seek clarifications and provide guidance on cybersecurity matters, fostering a culture of transparency and continuous improvement.


text: This structured approach to governance and oversight, with an emphasis on receiving feedback allows us to align across the Alta organization. By prioritizing the identification and management of cybersecurity risks, we aim to safeguard our assets and maintain the continuity of our business operations in the face of evolving cyber threats.


text: Our Senior Director of IT and Director of Security and Compliance have primary responsibility for assessing and managing cybersecurity risks. An internal team of cybersecurity professionals execute our cybersecurity program while our VP of Information Services provides executive oversight. Combined, our experts bring multiple decades of cybersecurity experience and have earned cybersecurity-related certifications. Our internal team is bolstered by strategic third-party security partners leveraged to provide 24x7 monitoring and response. Third parties routinely assess our security practices providing tactical assistance or strategic guidance through audits and penetration tests. All members of the team routinely discuss emerging security threats and ways to mitigate risk.


text: We utilize an in-depth layered approach to security. This allows us to respond and mitigate cybersecurity risks, underscoring our commitment to the confidentiality, integrity, and availability of our data and systems. The Company has processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. Our strategy includes the deployment of advanced security products and penetration testing to identify and mitigate vulnerabilities by continuous vulnerability scanning and monitoring by both internal and external teams. This approach is bolstered by backup and recovery protocols, including data resilience, email security measures and endpoint detection and response systems to thwart malicious activities.


text: Additionally, our commitment to security is evident in our security awareness training for all employees, dark web monitoring, and 24x7 threat monitoring.


text: Our incident response plan is designed to address security incidents effectively, supported by stringent information security policies and the implementation of a security information and event manager system for real-time analysis and reporting of security events and incidents. As part of our security commitment, we undergo penetration testing to assess whether our necessary security controls are maintained.


text: The Company faces risks from cybersecurity threats that could potentially have an adverse effect on our business, financial condition, results of operations, cash flows and reputation. Although such risks have no t materially affected our business, to date, we have experienced various immaterial threats to our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Security breaches and other disruptions in the Company's IT systems, including the Company's ERP system, could limit the Company's capacity to effectively monitor and control our operations, compromise ours or our employees', customers' and suppliers' confidential information, or otherwise adversely affect the Company's operating results or business reputation" in Item 1A. Risk Factors.


text: The program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF framework provides the basis to evaluate our program for completeness and helps to ensure that the various components of the program are at a level that reduces cybersecurity risk to levels within the Company's risk appetite, considering the current threat and regulatory environment. Key components of the cybersecurity program include: • A risk assessment process that identifies and prioritizes cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • An incident response plan that outlines establishes a structured approach for the Company's response to a cybersecurity incident. The incident response plan is coordinated through the CISO and key members of management are embedded into the plan by its design. The plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. • A training program that educates employees about cybersecurity risks and how to identify and escalate cybersecurity events. • A third-party risk management program designed to ensure that our key vendors meet our expectations on cybersecurity. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendors' compliance with our cybersecurity requirements.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: The Company engages reputable third parties to conduct various risk assessments on a regular basis, including but not limited to maturity assessments and various security system testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Management Oversight Our CISO is accountable for managing our enterprise information security department and overseeing our information security program. The CISO reports directly to the Chief Risk Officer. The CISO's responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to senior leadership and the Risk Committee and/or Board in a timely manner. The CISO has over 20 years of experience in cybersecurity across the U.S Government, Department of Defense contracting, and financial services industry. Prior to joining the Company, the CISO served as the Deputy CISO for a major domestic financial services institution.


text: Our Senior Vice President of Information Technology has served in his role since January of 2020 and has managed STORE's Information Technology department since joining the Company in January of 2015. In these roles, he has been instrumental in the evolution and implementation of our business systems and technical infrastructure as well as the development and enforcement of Sarbanes-Oxley (SOX) compliance processes and reporting. Prior to joining STORE, he was the Chief Information Officer for Southwest Network, a non-profit organization for mental and behavioral health services serving the greater Phoenix, Arizona community. He has over 35 years of experience in the information technology industry serving in several technical and leadership positions.

companyName: STORE CAPITAL LLC


text: Our cybersecurity program is designed to protect our information systems and information against cybersecurity threats that may impact the confidentiality, integrity and availability of our information systems and information. Our program includes policies, processes and technologies to assess, identify and manage risks from cybersecurity threats and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: LandBridge Co LLC

ticker: LB


text: Our board of directors, in coordination with the Audit Committee, oversees the Company's processes for assessing and managing risk. Our board of directors has delegated primary responsibility for overseeing our enterprise risk management process, including oversight of information technology, cybersecurity, and data privacy risks, to the Audit Committee. Despite this delegation of primary responsibility, both the Audit Committee and the board of directors are actively involved in risk oversight. The board of directors and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Management is responsible for identifying and assessing cybersecurity risks, establishing processes to ensure that such cybersecurity risk exposures are monitored, implementing proactive mitigation measures and responding in the event of an incident. We seek to identify and mitigate cybersecurity risks through a comprehensive, cross-functional approach. The Cyber Incident Response Team is headed by the Manager's Senior Vice President of Information Technology (the "SVP of IT") and also includes senior representatives from various corporate and operational functions of the Manager. The Manager's SVP of IT possesses deep experience in technology and cybersecurity, gained over a career of over 20 years managing IT functions for organizations, including network infrastructure, cloud administration, application development and cybersecurity. The SVP of IT possesses a degree in Information Systems and regularly attends educational and professional development seminars on cybersecurity trends and threats. She leads our information technology team, which is responsible for managing our internal IT and cybersecurity processes. The Manager's SVP of IT meets quarterly with the Manager's Risk Committee, which is comprised of senior representatives from various corporate functions and other members of our senior management to provide updates on the Company's cyber risks and threats, cybersecurity incidents (if any), the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. We have processes in place to guide our assessment, response and notification procedures upon the occurrence of a cybersecurity incident. Further, we have partnered with a third-party cybersecurity vendor to provide managed security services in order to supplement our internal IT and cybersecurity processes. Depending on the nature and severity of the cybersecurity incident, this process provides for notifying and escalating the incident to our board of directors.


text: Risk Management and Strategy Our business operations rely on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data. Our information and operational technology networks, those of our operators and managers, and those of third parties on whom we rely, are important to our ability to perform day-to-day operations of our business. As a part of our cybersecurity risk management program, we review the various different Company policies that cover cybersecurity on an annual basis and have implemented procedures for responding to cybersecurity incidents. We provide training and awareness programs for all employees of Manager that includes periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls. We have implemented network monitoring, containment and incident response tools, vulnerability management processes and penetration testing. We also actively engage with key vendors and third-party advisors and consultants that assist us with identifying, assessing and managing cybersecurity risks to our business and employ processes to detect and monitor unusual network activity. In connection with our use of third parties, we employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at such vendor or service provider.


text: Material Cybersecurity Risks, Threats and Incidents The oil and gas industry has become increasingly dependent on information technology and operational technology to conduct certain processing activities. At the same time, cybersecurity incidents, including deliberate attacks or unintentional events, have increased. Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: As detailed elsewhere in this Annual Report, we rely on information technology to manage our business and support our operations, including our secure processing of proprietary and other types of information. Despite ongoing efforts, our systems for protecting against cybersecurity risks may not be sufficient, and a cyber attack or security breach could result in liability under data privacy laws, regulatory penalties, damage to our reputation or loss of confidence in us, or additional costs for remediation and modification or enhancement of our information systems to prevent future occurrences. As of the date of this report, we have not experienced any material cybersecurity incidents and are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. This does not guarantee that future attacks, incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. For additional information on cybersecurity risks we face, see "Risk Factors—Risks Related to Our Business and Operations—Cyber incidents or attacks targeting systems and infrastructure used by the oil and natural gas industry may adversely impact our operations, and a cyber incident or systems failure could result in information theft, data corruption and operational disruption and our results of operations, cash flows or financial position may be adversely impacted."


text: Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • artificial intelligence based managed detection and response system that provides 24 7 monitoring of our networks, endpoints, and cloud environments; alerts from this system are handled by an external 24x7 staff that reviews the alerts and acts where necessary; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management evaluation process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – "Our internal information systems, or those of any of our CROs, contract manufacturers, service providers, other contractors or consultants or potential future collaborators, may fail or suffer cybersecurity incidents or breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management is required to update the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Our information technology team, led by our Vice President of Information Technology, is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Vice President of Information Technology reports to our Chief Financial and Business Officer. The Vice President of Information Technology has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. The Vice President of Information Technology has over 25 years of experience in information technology.


text: Our information technology team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal IT environment.


text: Our information security function, led by our Director of Information Technology, helps identify, assess and manage the Company's cybersecurity threats and risks. Our Director of Information Technology helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, monitoring provided by a third-party security operations center, deploying manual and third-party service provider automated tools in certain environments, subscribing to reports and services that identify cybersecurity threats (and analyzing such reports), conducting scans of certain environments, evaluating our industry's risk profile and threats reported to us, conducting internal audits and threat assessments for certain threats, conducting vulnerability assessments using third-party tools to identify vulnerabilities, engaging third parties to conduct threat assessments, using external intelligence feeds and monitoring the dark web.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of the third parties whom we work with, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: We have an employee security awareness training program that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: ImageneBio, Inc.

ticker: IMA


text: Cybersecurity Governance We leverage the support of third-party information technology and security providers for the maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. These third-party providers directly report to, and meet periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.


text: Our board of directors has delegated oversight of our company's cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing our company's information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our company and our company's strategy to mitigate cybersecurity risks and potential breaches. We have a process for our Senior Vice President of Finance and Administration and/or our Chief Financial Officer, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program and on an as needed basis.


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. Key aspects of this risk management program include, but are not limited to: • Identifying the source of a cybersecurity threat; • Assessing the severity of a cybersecurity threat; • Implementing cybersecurity countermeasures and mitigation strategies; • Providing our employees with regular training on cybersecurity and the protection of our information systems; • Maintaining and testing a business continuity and disaster recovery program; • Maintaining insurance coverage intended to address cybersecurity and data breach risks; and • Informing and updating management and, as needed, the Audit Committee and our Board of Directors of cybersecurity incidents that may pose a significant risk for the business.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, as well as a description of an event that occurred in March 2023, see "Risk Factors—Risks Related to Our Business—Security breaches, loss of data, and other disruptions could compromise sensitive business or patient information, cause a loss of confidential patient data, employee data, personal information, or prevent access to critical information, and expose us to liability, litigation, and federal and state governmental inquiries and damage our reputation and brand."


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the Audit Committee. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Information Officer (CIO).


text: Our CIO is a member of our executive management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. Our CIO has over twenty-five years of extensive experience in information technology and security, and works in coordination with other members of the management team, including, among others, the Chief Financial Officer and Chief Compliance Officer and their designees. We believe our business leaders have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats.


text: Our CIO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CIO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.


text: As of December 31, 2024, and 2023, GlobalX remains proud to report that it has no t encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Risk Management and Strategy In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank's systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors."

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: The Chief Risk Officer is responsible for overseeing the assessment and management of the Company's information security program. The Chief Information Officer is responsible for execution, management, and administration of the information security tools and defenses of the program.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information and utilize outside contractors to assist us in building and supporting our program.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: Key elements of our cybersecurity risk management program includes but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Our Director of Information Technology Infrastructure and Operations, who reports to the Chief Financial Officer, is primarily responsible for assessing and managing material risks from cybersecurity threats. Our Director of Information Technology Infrastructure and Operations has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity resources. Our Director of Information Technology Infrastructure and Operations' experience includes information systems architecture, operations, cybersecurity, and data privacy protection.


text: Cyber Risk Management and Strategy The Company relies on electronic systems and information technologies to conduct its operations. We have adopted and maintain a cybersecurity risk management program, in accordance with our risk profile and business, that is informed by industry standards. The risk management program and the security policies that have been established as part of it, are reviewed annually as part of our overall risk management procedures.

companyName: Adicet Bio, Inc.

ticker: ACET


text: We leverage the support of third-party information technology and security providers, including to perform penetration testing, threat intelligence analysis and remediation, when necessary. We have previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we have endeavored to adapt our cyber risk strategy to mitigate emerging cybersecurity risks. We implement a multi-layered approach to cybersecurity that includes, for example, employee security awareness training, various security tools and technologies, and incident response planning and remediation.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" as well as Item 9A in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Executive Director of Information Technology (IT) reports directly to our Chief Financial Officer (CFO) and is responsible for the strategic leadership and direction of our cybersecurity program, with support from our Associate Director of Information Security and Associate Director of IT. With over 20 years of experience in IT and cybersecurity risk management, our Executive Director of IT works alongside individuals across other Company management functions to establish and implement our cybersecurity risk management strategy. Our Executive Director of IT is informed of and monitors cybersecurity incidents through communications with system users as well as monitoring our intrusion detection systems and firewalls.


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program pursuant to the audit committee's charter. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities from our Executive Director of IT or CFO. The audit committee may update the full board of directors on matters relating to cybersecurity risk management as needed.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Legal, Human Resources and IT. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and company-wide communications.

companyName: IGM Biosciences, Inc.


text: Our SVP of Group Operations and our Cybersecurity Steering Committee, which includes a cross-functional leadership team, are primarily responsible for assessing and managing our material risks from cybersecurity threats. As part of our risk identification, assessment, and mitigation activities, we leverage the experience of our external cybersecurity advisor/consultant (CISSP, CISA, CISM, CRISC, QSA) who has extensive cybersecurity expertise across various industries. Our SVP of Group Operations, who manages our cybersecurity program, has over 25 years of experience in the Life-Sciences IT space, with over 8 years in IT security and cybersecurity functions.


text: Cybersecurity Risk Strategy and Management Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. The Company maintains safeguards, including training, incident response reviews, cybersecurity insurance and business continuity mechanisms to protect the Company's assets. The Company also leverages a third-party cybersecurity program with the goal of minimizing disruption to the business and production operations, strengthening supply chain resilience in response to cyber-related events. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology ("NIST") cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business effect, threat context, and vulnerability severity.


text: Risk management and strategy The Company has implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and its critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient data ("Information Systems and Data").

companyName: TerrAscend Corp.

ticker: TSNDF


text: The Company's cybersecurity function, led by its Chief Information Officer ("CIO") and Senior Director of Information Technology ("IT"), as well as its Enterprise Security Architect and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. The Company's CIO has over twenty-five years of technology leadership experience including infrastructure design and management, software development, system implementation, cybersecurity, and network design administration. The Company's CIO also has experience in data protection for systems and has supported a complex global public enterprise environment with operations in over 200 countries. The Company's Senior Director of IT has over 11 years of experience developing and leading healthcare solutions and has led the development in web and infrastructure design, serverless architecture, database integrations, SMS, mass-email and mass phone notification solutions and holds a Sarbanes-Oxley Act (SOX) certification. The Company's Enterprise Security Architect has over seven years of experience in assessing risk and protecting data in various technologies from client/server software to cloud based solutions and holds a Certified Information Systems Security Professional designation, a GIAC Certified Incident Handler Certification, and Sarbanes-Oxley Act (SOX) certifications. The Company's Senior Director of IT and the Enterprise Security Architect also have experience dealing directly with numerous cyber security threats, breaches, detection and containment activities and strategies under strict requirements and expectations for HIPAA covered entities. The Company's cybersecurity function works, in certain circumstances, in partnership with its managed security service provider ("MSSP") and managed service provider ("MSP") to help identify, assess, and respond to risks from cybersecurity threats, including by monitoring and evaluating its threat environment using various methods including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating the Company's and its industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal and/or external audits, conducting threat assessments for certain internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds. The Company's Security Incident Response Team leverages a cybersecurity managed detection and response partner, which monitors certain of its endpoints, cloud infrastructure, and networks for irregular activity.


text: Depending on the environment and system, the Company implements and maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to its Information Systems and Data, including, for example: an incident response plan, incident detection and response measures, monitoring and response services, network and system access controls, physical security measures, an employee cybersecurity training program, dedicated cybersecurity personnel, asset management and recovery processes, encryption of certain data, segregation of certain data, implementation of security standards/certifications, a vendor risk management program, penetration testing, dark web monitoring, monthly environment risk reviews, external threat intelligence reports, regular digital infrastructure scans, internally reported threats, data back-up measures, and cybersecurity insurance.


text: The Company's assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is identified in the Company's risk register detailing certain known and potential risk items; the Company's IT operations department works with its MSSP/MSP vendor partners to review certain identified threats and its cybersecurity practices in an effort to prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact on its business; and its CIO regularly presents to senior management, the Board and Audit Committee to evaluate material risks relative to its overall business objectives.


text: The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats including, for example, managed cybersecurity service providers, cybersecurity software providers, penetration testing firms, threat intelligence service providers, cybersecurity consultants, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.


text: The Company uses third-party service providers to perform a variety of functions throughout its business, such as enterprise resource planning, point of sale, eCommerce, wholesale sales, application providers, and web hosting. The Company has a vendor management program to manage cybersecurity risks associated with its use of these providers. The Company's vendor management program includes completion of a cybersecurity questionnaire and review of the vendor's security program for certain vendors designed to help us evaluate the potential cybersecurity risks associated with its use of the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, its vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the risk factors under Item 1A. "Risk Factors" in this Annual Report, including "The Company (and the third parties with whom it works) faces physical security risks, as well as risks related to its information technology systems, data, potential cyber or phishing-attacks, and security incidents."


text: The Company's cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CIO and the Senior Director of IT. The CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Board receives regular reports from the CIO concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. These reports also include materials related to certain cybersecurity trends the Company has identified, potential cybersecurity threats and risk, and proposed mitigation measures.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: EyePoint, Inc.

ticker: EYPT


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.


text: Our team leverages over 25 years of experience in various IT leadership roles, including oversight of cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.


text: In 2024, we were a SPAC with no business operations other than that following our Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We assess and identify the possibility of risk from cybersecurity threats considering both our operations and the nature of our assets, which consist solely of the funds in our Trust account managed by a third-party Trustee and the funds in our operating bank account. To date, we have not experienced any cybersecurity attacks. In light of the nature of our operations in identifying and evaluating suitable acquisition transaction candidates, we believe that cybersecurity threats are not reasonably likely to materially affect these business operations. In addition, the procedures in place with third parties that maintain our assets are such that it also should not be reasonably likely for cybersecurity threats to materially affect our financial condition. But we recognize that a penetration of our systems or a third party's systems could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: GigCapital7 Corp.

ticker: GIG


text: We have not adopted any specific cybersecurity risk management program or formal processes for managing risks from cybersecurity threats. However, in our overall risk management processes, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations and assets. These include, but are not limited to, engaging a third-party information technology consultant who maintains and monitors our information technology network, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.


text: Our management is generally responsible for assessing and managing risks from any cybersecurity threats, including through the use of the third-party information technology consultant who reports to our management on actions that he is undertaking and the cybersecurity threats that he sees to our information technology network. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to the Audit Committee of our Board of Directors (which is the committee of the Board of Directors to which oversight of cybersecurity matters and management of cybersecurity incidents has been delegated by the Board of Directors) for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Audit Committee or the Board of Directors deems appropriate to take. In addition, our management reports to the Audit Committee on a regular basis on the potential for risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors provides oversight of our cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: Our Senior Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help us prepare our employees to address cybersecurity risks. Our Senior Director of Information Technology has over seventeen years of experience in information technology, eleven years of experience in information technology for life sciences companies, and a relevant bachelor's degree in information technology. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy. We recognize the critical role that cybersecurity plays in protecting our operations, customers, and digital assets. As part of our broader technology and information security risk management framework, our cybersecurity strategy is designed to safeguard the confidentiality, integrity and availability of our systems and data. We continuously assess, strengthen and refine our cybersecurity practices to adapt to an evolving threat landscape.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Our cybersecurity risk management program is built on a foundation of monitoring, proactive risk mitigation and adherence to industry best practices. Over the past year, we have implemented several key enhancements to further bolster our cybersecurity defenses. A security awareness training program has been introduced across our company to educate employees on cybersecurity threats and best practices. Additionally, we have expanded our asset management capabilities, improving visibility into our technology infrastructure and evaluating advanced solutions for more comprehensive oversight.


text: To protect against unauthorized access, our identity and access management framework continues to evolve, incorporating multi-factor authentication and single sign-on to enhance access security. In parallel, our vulnerability management program is actively managed to identify, assess, and remediate security risks before they can be exploited. To further secure our infrastructure, we have deployed an advanced endpoint security solution, ensuring that all company devices are protected against malware and other cyber threats.


text: A core component of our security framework is our threat detection and response capability. We have implemented an extended detection and response system that provides continuous monitoring, real-time threat detection and automated response mechanisms to mitigate cybersecurity risks. Our governance, risk and compliance initiatives have also advanced, with ongoing efforts to standardize security policies and align with regulatory and industry standards. Penetration testing is conducted to assess our security posture and identify potential vulnerabilities, ensuring that our defenses remain resilient against emerging threats.


text: Understanding the risks posed by external partners, we have strengthened our third-party risk management program. This initiative focuses on evaluating and monitoring the cybersecurity practices of our vendors, service providers, and business partners to mitigate potential supply chain risks. Additionally, our incident response plan has been enhanced to support swift detection, containment, and remediation of cybersecurity incidents, ensuring operational continuity and minimal disruption with the addition of an incident response retainer.