text: We also maintain business continuity and disaster recovery plans to prepare for and respond to the potential for any disruption in the technology we rely on. Additionally, we maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.


text: Governance Related to Cybersecurity Risks Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: TREVENA INC

secItem: Item 1C


text: Our Senior Vice President, Chief Business Officer and Head of Commercial Operations is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Vice President, Chief Business Officer and Head of Commercial Operations has nearly 10 years of experience overseeing information technology activities.


text: Cybersecurity Risk Management and Strategy In the normal course of business, we may collect and store personal information, customer information, and certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information, and employee information. To protect this information, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Zomedica Corp.

ticker: ZOMDF


text: Our cybersecurity program is led by our Vice President of Technology Innovation and includes a team of information technology professionals. The program is further strengthened through support of our General Counsel. These teams work closely together to support and bolster our cybersecurity program, which incorporates industry-standard frameworks, policies, and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity team informs our Audit Committee on information security and cybersecurity matters as needed.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to our Business" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Cybersecurity risk management and strategy The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to; identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Cybersecurity Governance Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, " We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".


text: The Board and executive team provide regular oversight of the Company's cybersecurity risk management program. The Vice President of Information Technology and Security presents to the Board and the executive team regularly with updates via business review dashboards. The Board and executive team provide guidance, including with respect to any changes to business priorities, risk tolerance, or security initiatives.


text: Risk Management and Strategy We monitor our information systems for potential cybersecurity issues and assess risks from cybersecurity threats as an element of our overall business risks. To protect our information systems from cybersecurity threats, we use various security tools supporting protection, detection, and response/mitigation capabilities. We also alert employees to significant new cybersecurity issues on a regular basis.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. Third-party vendor cybersecurity risks and procedures are evaluated by our Quality Assurance and Regulatory Department during our prequalification process and during subsequent periodic reviews.


text: We do not specifically utilize assessors, consultants, auditors, or other third parties to evaluate or enhance our cybersecurity programs. On an annual basis, our information technology risks, controls and procedures are reviewed by third-party experts as part of our Sarbanes-Oxley review and testing.


text: Board Governance and Management Our board of directors has oversight responsibility for risk management, which it administers directly and with assistance from its committees, primarily the audit committee. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity.


text: The audit committee assists the board of directors by overseeing the steps management has taken to monitor and mitigate cybersecurity threats and risks. The audit committee receives reports annually from management on our cybersecurity strategy and program. Significant changes are reported to the audit committee quarterly. Cybersecurity incidents which are determined by management to be material will be reported immediately to the audit committee.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity procedures designed to address cybersecurity threats and risks. The Director – Information Technology, who has a combination of 15 years of professional experience and education, as well as certifications in cybersecurity, leads the Company's cybersecurity program and is responsible for assessing and managing cybersecurity risk. The Director- Information Technology reviews cybersecurity risks with and reports cybersecurity incidents to the Chief Executive Officer, Chief Operating Officer/Chief Financial Officer, and Senior Director – Financial Reporting.


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for us to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. See "Part I —Item 1A. Risk Factors" for further discussion of these risks.


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and EchoStar's Board of Directors as a whole to ensure accountability.

companyName: DISH DBS CORP


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future. On February 23, 2023, we experienced a network outage that affected its internal servers and IT telephony. We immediately activated our incident response and business continuity plans designed to contain, remediate and recover from the situation. We engaged the services of certain cyber-security experts and outside advisors to assist in the evaluation of the situation, and once we determined that the outage was due to a cybersecurity incident, we promptly notified appropriate law enforcement authorities. In addition, on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems.


text: The DISH TV and SLING TV services remained operational at all times during the incident. As of March 31, 2023, all significant systems had been restored. We have no reason to believe that this cybersecurity incident has not been concluded.


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. The CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, EchoStar's Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: The Technology Advancement Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Technology Advancement Department is managed by the Board-appointed Chief Information Officer (the "CIO") who reports directly to the Company's Chief Executive Officer. The CIO has more than 12 years of experience with the Company and additional years of experience in the information technology ("IT") field. The CIO also oversees the Company's Cybersecurity Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Cybersecurity Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Technology Advancement Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a monthly basis to the Company's Board of Directors.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: As referenced above, the CIO provides information security updates to the Board of Directors at each Board meeting. Additional information security training to the committee is provided through a management Information Security Steering Committee and also through targeted training overseen by the CIO. In addition, as discussed below, the Company has implemented an Incident Response Plan, which is integrated into its Cybersecurity Policy, to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and is subject to annual review and approval by the Board of Directors. Cybersecurity metrics are reported to both management level committees and the Board of Directors on a monthly basis.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Cybersecurity Program.


text: Risk Assessment. On a periodic basis, but not less than annually, the Chief Information Officer, in conjunction with the Board of Directors, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Cybersecurity Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Board of Directors changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. Ensuring that changes to security configurations are documented, approved, and tested. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. Conducting subsequent penetration testing and vulnerability assessments, as warranted.


text: Service Providers. Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Vendor Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive the Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Vendor Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO reports to the Board the overall status of the Cybersecurity Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Cybersecurity Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO is responsible for implementing and maintaining the IRP, which includes:


text: Reviewing the IRP at least annually, or whenever there is a material change in The Company's business practices that may reasonably affect its cyber incident response procedures.


text: Primary responsibility for executing our cybersecurity program rests with our Vice President of Corporate Strategy and Planning, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of related work experience. The Vice President of Corporate Strategy and Planning is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Executive Officer. The Vice President of Corporate Strategy and Planning at times attends meetings of the Board to report on any material developments to our risk management practices, including our cybersecurity program.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: The Vice President of Corporate Strategy and Planning meets regularly with members of our Information Technology team, whose responsibilities are dedicated solely to cybersecurity matters. On a quarterly basis, we hold Information Technology Steering Committee meetings, which are attended by our Information Technology team, Chief Executive Officer and Chief Financial Officer, where we discuss the risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Our Information Technology team also works with our Vice President – General Counsel to oversee compliance with legal, regulatory and contractual cybersecurity requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our Information Technology team. We regularly conduct vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has the primary responsibility to oversee cybersecurity matters. The Board periodically reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board receives reports from the members of our management team responsible for executing our cybersecurity program, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board discusses with such members of our management team our information technology systems and procedures on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We have adopted an Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third-party vendor on retainer to assist in such incidents.


text: As detailed elsewhere herein, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.


text: Risk Management and Strategy The Company has developed and maintained a comprehensive cybersecurity program which is integrated within the Company's enterprise risk management program and encompasses the corporate and operational technology environments, as well as client-facing products and services. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity incidents and risks within an ever-changing threat landscape. We utilize cybersecurity policies and frameworks based on industry and government standards, including the National Institute of Standards and Technology Cyber Security Framework (" NIST CSF "). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Our cybersecurity program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incident. The Company operates a 24 x 7 security operations center (" SOC ") which monitors our global cybersecurity solutions and production environments, and serves as a central location for the reporting of cybersecurity matters. The roles and responsibilities of the SOC and our cybersecurity team in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation.


text: We partner with third parties to support and evaluate our cybersecurity program. Provided third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We also implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We communicate these and other pertinent security issues or compliance changes through our regular internal communications cadence. Additionally, the Company has mandatory security awareness training addressing cybersecurity, privacy and confidential information.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, ETI experienced a previously disclosed network security incident which had material adverse impact and required ETI to, among other things, limit access to its applications and services by its employees and customers. In response, ETI incurred considerable costs to restore the security of its internal systems and networks and adopted various enhancements. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. Please refer to " Item 1A. Risk Factors " for further information about the material risks associated with various cybersecurity threats.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management and compliance programs.


text: Our cybersecurity program is led by our Chief Technology Officer (" CTO "), who has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Our CTO oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions.


text: Our Audit Committee receives periodic reports from our CTO and management on our cybersecurity risks and the current threat landscape trends. In addition, management will update the Board directly, as necessary, regarding cybersecurity incidents. The full Board also receives presentations on cybersecurity topics from our CTO and other security management staff as part of the Board's continuing education on topics that impact the Company.


text: Risk Management and Strategy Our Information and Technology service providers manages the Company's security program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and board of directors, described below under "Governance."

companyName: Vyome Holdings, Inc

ticker: HIND


text: To proactively manage cybersecurity risk in our organization, our management team has instituted a security policy that is available to all employees.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we stive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Executive Officer or Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings.


text: RISK MANAGEMENT AND STRATEGY Securing Kroger's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our stakeholders. We have adopted enterprise cybersecurity risk mitigation and governance processes, which are set forth in the Kroger Cybersecurity Risk Management program ("CRM"), the Kroger Third-Party Cybersecurity Risk Management program ("TPCRM"), and the Kroger Cyber Incident Response Plan ("IR Plan"). Our approach is guided by the principles of the CRM, which includes monitoring threats and vulnerabilities and assessing and monitoring related controls, supporting the Corporate Information Security function, the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"). Kroger's cybersecurity policies, standards, processes, and practices are integrated into our overarching risk management system in an effort to enhance our ability to safeguard our operations and information, which includes quarterly cybersecurity reporting to the Board, delivered by senior leadership.

companyName: KROGER CO

ticker: KR


text: Kroger Cyber Risk Management Program The CRM was developed in collaboration with third-party consultants and is aligned with the National Institute of Standards and Technology ("NIST"), Risk Management Framework ("RMF"), Cybersecurity Framework ("CSF") and the International Organization for Standardization 27001 ("ISO 27001"). The program includes security and privacy, risk-based controls, and incorporates lessons learned from cybersecurity incidents. Under Kroger's CRM, cyber risks, including cyber threats and cyber events/incidents, are assessed, treated, and monitored on a continuous basis. We integrate lessons learned from incident response and cyber risk mitigation into our cyber risk management strategy, in an effort to improve overall cybersecurity on an ongoing basis. Kroger's CRM program is spearheaded by specific management positions, chosen for their expertise in the field as further discussed below.


text: In line with cyber risk management best practices, we have collaborated with recognized third-party experts as needed to align the CRM's foundational processes, metrics, monitoring, and reporting with common frameworks such as NIST and RMF.


text: Third-Party Cyber Risk Management Recognizing the potential vulnerabilities posed by third-party relationships, Kroger has implemented a comprehensive TPCRM program. The TPCRM program is designed to assess third-party cybersecurity risks by employing third-party risk assessments, vendor tiering, and a dedicated team tasked with recommending holistic improvements to strengthen Kroger's cybersecurity posture, sourcing, and contracting processes. Kroger's Information Security Operations Center ("iSOC") responds to known third-party incidents on a continuous basis. The iSOC is a part of the Corporate Information Security ("CIS") department and is responsible for detecting, responding to, and escalating security incidents. We partner directly with business stakeholders and technology custodians to determine an appropriate response to manage incident risk to minimize the effect to the business. This response process is a regular and critical function of the iSOC and is defined in a separate appendix to the IR Plan. Any material risk identified from these incidents is escalated and communicated using formal severity and impact criteria as defined in the IR Plan.


text: Kroger Cyber Incident Response Plan The IR Plan documents the processes by which information security events are detected, identified, prioritized, and analyzed. The Kroger iSOC, CISO, legal counsel, and corporate affairs stakeholders are then engaged depending on the incident's scope, business effect, and potential material risk. This cross-functional team is responsible for assessing an appropriate response and mitigation pathway. Once security events are identified through the enterprise detection and monitoring ecosystem, the IR Plan sets forth an incident prioritization/decision workflow to determine scope, business effect, and potential material risk. This workflow is implemented through collaboration with the iSOC, CISO, legal counsel, and corporate affairs stakeholders. In addition to the processes outlined above, we have also implemented an information security training program for employees that includes security awareness training related to cyber security risks, simulated phishing emails and regular communication to the enterprise regarding cyber security risks.


text: We experience cybersecurity threats and incidents from time to time. We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, our financial condition, results of operations or cash flows. There can be no assurance that cybersecurity threats will not have a material effect on us, including our business strategy, our financial condition, results of operations or cash flows. Please see "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Protection of our customers' data is a fundamental priority for our Board and management team. Our risk management team is integrated into our CIS function and is led by our CIO and CISO. The risk management team reports to the CISO and has combined experience in information security, governance, and compliance, including domains such as engineering, architecture, cybersecurity, and privacy. This team is responsible for defining the program, cybersecurity governance, and gathering insights related to assessing, identifying, and managing cybersecurity threat risks, their severity, and mitigations.


text: Kroger's CIO reports to the CEO and leads technology and digital capabilities for the Kroger Co., including the overall cybersecurity strategy. Kroger's CIO & Chief Digital Officer, has over 20 years of both leading and transforming technology, digital growth, and e-commerce in the retail and food industry. Kroger's interim CISO brings nearly 20 years of experience developing and leading security and risk programs. His experience includes governance, information security, and threat management.


text: The Audit Committee of Kroger's Board of Directors is charged with oversight of data privacy and cybersecurity risks. Kroger's CIO and CISO provide quarterly updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full Board at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the Board on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CIO and CISO discuss and present strategies to address geopolitical threats that may affect operations as well as technological changes, such as AI and quantum computing. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. An independent third party also regularly reports to the Audit Committee and the full Board on cybersecurity, and outside counsel advises the Board on best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.


text: Risk Management and Strategy Exela has developed and maintained a comprehensive cybersecurity program which is integrated within Exela's enterprise risk management program and encompasses the corporate and operational technology environments, as well as client-facing products and services. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity incidents and risks within an ever-changing threat landscape. We utilize cybersecurity policies and frameworks based on industry and government standards, including the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Exela Technologies, Inc.

ticker: XELA


text: Our cybersecurity program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incident. Exela owns and operates a 24 x 7 security operations center ("SOC") which monitors our global cybersecurity solutions and production environments, and serves as a central location for the reporting of cybersecurity matters. The roles and responsibilities of the SOC and our cybersecurity team in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation We partner with third parties to support and evaluate our cybersecurity program including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: The Company has implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We regularly communicate these and other pertinent security issues or compliance across our organization. Additionally, Exela has mandatory security awareness training addressing cybersecurity, privacy and confidential information.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, we experienced a previously disclosed network outage which required us to, among other things, limit access to our applications and services by our employees and customers. In response, we incurred considerable costs to restore the security of our internal systems and networks and adopted various enhancements. Please refer to "Item 1A. Risk Factors" for further information about the material risks associated with various cybersecurity threats.


text: Our cybersecurity program is led by our Chief Technology Officer ("CTO"), who has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Our CTO oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions.


text: Our Audit Committee receives periodic reports from our CTO and management on our cybersecurity risks and the current threat landscape trends. In addition, management will update the Board directly, as necessary, regarding cybersecurity incidents. The full Board also receives presentations on cybersecurity topics from our CTO and other security management staff as part of the Board's continuing oversight of topics that impact the Company.


text: Our approach to managing cybersecurity risk involves a comprehensive program established at each subsidiary. This strategy intends to pinpoint subsidiary-specific risks associated with both our digital and physical assets with the objective of employing effective measures that ensure the security of our infrastructure, systems, data, business partners, customers, and financial information against potential cyber incidents. Corporate management of the holding company oversees the cybersecurity risk program at each of the subsidiaries to ensure the collective cohesively responds to organization-wide risks.

companyName: ARGAN INC

ticker: AGX


text: Administered by security, information technology, and compliance professionals and managed by senior management at each of our subsidiaries, our cybersecurity program integrates into our broader enterprise risk management framework and aligns with recognized frameworks and industry standards, as applicable, and complies with various legal and regulatory requirements.


text: The audit committee of our board of directors oversees cybersecurity risk and ensures timely reporting and management of these threats.


text: Risk Management and Strategy As our business objectives and operational needs change, our cybersecurity professionals continuously evaluate and refine the measures taken to address our identified risks. Our technical measures include firewalls, intrusion detection and prevention systems, anti-malware tools, and access and configuration controls, to shield our information systems from cybersecurity incidents.


text: Acknowledging the dynamic and complex landscape of cybersecurity threats, we engage with various external specialists to evaluate and strengthen our cybersecurity risk management practices. Such engagements differ across our subsidiaries, as they are tailored to the specific risk profile of each subsidiary, ensuring that each entity works with experts most suited to their specific cybersecurity needs. These engagements, which may encompass regular audits, threat assessments, vulnerability testing, and consultations on security enhancements, help us tap into specialized knowledge and stay aligned with industry best practices. Significant results of these assessments are reported to the audit committee and, when necessary, the board of directors, leading to adjustments in our cybersecurity approach based on their findings to ensure our defenses remain robust and effective.


text: Recognizing the importance of human factors in cybersecurity, we provide regular employee training that emphasizes common threats, such as phishing, social engineering, sensitive data exposure, and insider risks. In addition to regular training sessions, we perform phishing simulations, post security bulletins, and provide dedicated means for employees to report attempted threats.


text: To mitigate cybersecurity risks linked to our engagement with third-party service providers, we perform security screening and review for prospective vendors that require access to our information systems. Additionally, to further protect our operations and enhance our cybersecurity risk management process, we maintain cybersecurity risk insurance obtained from industry leading underwriters.


text: Our strategy for responding to cybersecurity incidents involves a well-defined plan at each subsidiary that prescribes dedicated cross-functional personnel to each response team, ensuring a coordinated and premeditated response. These plans, which undergo regular review, assert the ability of system recovery processes and provide response frameworks for escalating issues. The plans are designed to minimize the impact to our operations and stakeholders, initiate appropriate communications both within and outside of the organization, and identify recommendations for improvement.


text: Governance and Oversight While our management team is tasked with the day-to-day handling of risks facing our organization, the audit committee, as delegated by the board of directors and documented in the committee's charter, specifically oversees cybersecurity risk and governance. Management provides the audit committee regular updates covering information security issues, recent organizational developments and IT initiatives, vulnerability assessments, third-party evaluations, and emerging best practices. The audit committee also engages with our internal audit firm and other external specialists about organizational risks related to cybersecurity, as well as the policies and controls designed to mitigate these risks. In January 2024, our board of directors participated in a cybersecurity training session provided by our internal audit firm. Our audit committee or the board of directors is actively involved in strategic cybersecurity decisions, providing guidance and concurrence for significant or pervasive projects. This ensures that cybersecurity is seamlessly integrated into our strategic planning, aligning with our broader organizational goals.


text: Additionally, we have established a cross-organizational IT steering committee, comprising senior and executive leadership, enterprise risk management representatives, and IT management, many of whom have over 15 years of experience and hold professional certifications in their respective fields. In an effort to build a comprehensive cybersecurity strategy across the organization, this committee convenes several times each year to discuss ongoing cybersecurity initiatives, emerging regulatory requirements and industry standards, and results of risk assessments.


text: Cybersecurity incidents are regularly reported to cross-functional teams at each subsidiary through the dedicated means we have in place, and events deemed critical are reported to the Chief Executive Officer and Chief Financial Officer. Moreover, the audit committee and the board of directors are promptly informed of any significant cybersecurity incident, along with continuous updates until resolution.


text: Cybersecurity Risks, Threats and Material Incidents Despite our endeavors to safeguard the security and integrity of our networks, systems, and the sensitive information they contain or transmit, including the adoption of numerous cybersecurity policies and protocols aimed at mitigating the risk of cybersecurity breaches or disruptions as previously outlined, it is impossible to guarantee the complete effectiveness of these measures. There remains a possibility that efforts to thwart cybersecurity threats may not be entirely successful, potentially resulting in successful breaches or disruptions that could be harmful. Refer to "Our failure to protect our management information systems against security breaches could adversely affect our business and results of operations" in Item 1A. Risk Factors.


text: As previously disclosed, we were targeted by a complex criminal scheme in March 2023, which resulted in fraudulently-induced outbound wire transfers to a third-party account (see Note 18 to the accompanying consolidated financial statements). The Company self-discovered the fraudulent activity and promptly contacted the remitting bank, receiving bank, dispute resolution experts, and federal and local law enforcement authorities. Moreover, we quickly informed the audit committee and regularly provided them with updates during investigation and recovery efforts. As a result of the fraud loss, net with funds recovered, and professional fees incurred related to an independent forensic investigation and efforts to recover the funds, we recognized $2.7 million of loss. We are unaware of any other significant security breaches at any of our business locations.


text: As a Company selling some products and performing engineering services for defense applications, we may be the target of cyber-attacks from a variety of threat actors. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure.

companyName: Vuzix Corp

ticker: VUZI


text: Our Cybersecurity Program Our products and services are normally classified as EAR 99 (items not designated under the control) by the U.S. government, but our defense customers may ask us to make some alterations for the environments in which the products will be used. Moreover, our products sold for defense applications are integrated with our customers' products. Given the nature of our business and the cybersecurity risks we face, we have instituted a cybersecurity program for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats to our internal systems, our products, services and programs for customers, and our supply chain.


text: Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operations. We, or third parties we contract with, monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications. Incident Response.


text: Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage an incident response team based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis. Third Party Service Providers.


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery. Our main external service provider is US-based and utilizes a 24 x 7 x 365 Service Operation Center (SOC). Program Assessment.


text: We regularly evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program. Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.


text: Risk Management and Strategy In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STARTENGINE CROWDFUNDING, INC.


text: Our Board has oversight of our strategic and business risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our Board also oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.


text: Risk Management and Strategy Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks. During fiscal 2023, we made significant investments in people and technology to detect, respond, and recover from security incidents. We have developed and are executing our cybersecurity roadmap which provides the framework to continually strengthen our capabilities.

companyName: Citi Trends Inc

ticker: CTRN


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. During fiscal 2023, we partnered with an external cyber security firm to leverage their expertise and guidance in fortifying our systems from evolving threats. We also have third-party risk management processes in place used to address the risks involved with engaging third parties in our cybersecurity programs. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.


text: We provide routine awareness training for associates regarding cybersecurity best practices and their role in protecting the Company from cybersecurity attacks and testing to measure the effectiveness of our information security program.


text: As previously disclosed, we experienced a cybersecurity disruption at the end of Fiscal 2022, which did not result in a material impact to our business strategy, results of operations or financial condition. We have not experienced any material cybersecurity incidents in Fiscal 2023, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Management's Role Management is responsible for implementing our cybersecurity program on an ongoing basis to identify, assess and manage cybersecurity risks. Our cybersecurity program is led by our Vice President of Information Systems with support from our Senior Manager of IT Security & Compliance and various other team members. Our Vice President of Information Systems has over 25 years of industry experience, including more than 10 years as the leader of the Company's technology function. On a bi-annual basis, or more frequently as needed, management informs the audit committee of material aspects of our cybersecurity program, including updates on key strategic and operational goals, assessments of cybersecurity risks, updates to any incidents, and the status of our ongoing investments in cybersecurity governance.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Our audit committee oversees management's policies, programs and procedures related to cybersecurity risk management and reports to the board regarding these efforts. In addition, the audit committee receives briefings from management bi-annually, or more frequently as needed, on material aspects of our cybersecurity program.


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: XCel Brands, Inc.

ticker: XELB


text: The program is managed by our executive management team, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receives periodic updates on cybersecurity and information technology matters and related risk exposures from management.


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have an annual assessment performed by a third-party specialist of our cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Scorpius Holdings' management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Executive Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Under the oversight of the Audit Committee, our management and the INFOSEC team have established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. We continually evaluate our information technology systems to identify new and monitor existing cybersecurity risks based on observed activity on the systems. We evaluate the nature and severity of identified risks, and whether changes to the system are necessary. We perform annual cybersecurity training for all employees with access to our systems and conduct regular test phishing campaigns. We engage a third-party to assist in monitoring, preventing and detecting potential cybersecurity vulnerabilities and incidents, including performing scans of our information technology systems and penetration testing. We use the results of the various tests to inform our response plan, update our systems, and train employees.


text: Upon the identification of a cybersecurity incident, the Incident Response Team (IRT) initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT communicates with the appropriate stakeholders, which may include the Audit Committee. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.


text: Our third-party vendors and service providers also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party vendor risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."


text: Risk Management and Strategy We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes, which we rely on information technology systems and networks managed and maintained by independent third parties. Our information technology personnel, responsible for cyber security, monitors daily and weekly backups of our system to protect against data loss and minimize disruption to our operations in the event of a cybersecurity incident. Our data is accessible by our assigned personnel and third parties as necessary and appropriate, to perform services or otherwise do business with us, and we have implemented two-factor identification for access to our third party systems to submit relevant data to our IND.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: Our information technology personnel and our senior management lead the operational oversight of the company-wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of cybersecurity in upholding the safety and security of our systems, services and data and maintaining the trust of our customers. Cybersecurity risk management is an important part of, and is integrated into, the Company's overall enterprise risk management program. We maintain a cybersecurity risk management program that is designed to identify, assess, manage and mitigate cybersecurity risks and provides a framework for responding to cybersecurity threats and incidents. We continually assess and enhance our cybersecurity risk management program and our cybersecurity posture to protect the confidentiality, integrity and availability of the Company's infrastructure, resources and information and the information that our customers entrust to us.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: We designed a multi-faceted risk-management approach based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and informed by other industry standards and industry-recognized practices to identify and address cybersecurity risks. Our key cybersecurity processes include the following:


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, servers, applications, data and cloud solutions and the data that our customers entrust to us.


text: Cybersecurity incident response plan and testing – We have a global incident response process and a dedicated team responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, coordinating across multiple functions, periodically testing our protocols and regularly communicating and providing reports to our CISO.


text: Information sharing and collaboration – We utilize threat intelligence and security information collected from various sources, including but not limited to partners, suppliers, governments and information sharing and analysis centers, to identify, protect against, detect and respond to potential cybersecurity threats and events.


text: Training and awareness – We use a combination of online training, including mandatory annual cybersecurity and privacy courses, educational tools, videos and other ongoing awareness initiatives, including phishing simulation exercises, throughout the year to foster a culture of security awareness and responsibility among our workforce.


text: Third-party supplier risk assessments – Recognizing that our suppliers can be subject to cybersecurity incidents which may impact us and our customers, our procurement process includes security and risk assessments to identify and evaluate risk associated with certain key suppliers, including reviewing relevant cybersecurity certifications and third-party audit results, assessing technical and organizational controls and evaluating their risk profile.


text: We periodically engage third-party security consultants to conduct evaluations of our cybersecurity controls and procedures, including through penetration testing, third-party audits or consulting on best practices to address new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls and procedures. Our internal audit function conducts additional reviews and assessments of our cybersecurity controls and procedures. Certain results of such assessments and reviews are reported to the Audit Committee and the Board of Directors as appropriate. We use the findings from these efforts to improve our practices, procedures, and technologies.


text: Cybersecurity Risk Oversight and Governance Our Board of Directors is responsible for the overall oversight of our enterprise risk management. The Audit Committee semi-annually reviews the Company's enterprise risk management framework, including enterprise risk management processes, and assists the Board of Directors in its oversight over certain key areas of risks, including overseeing cybersecurity, data governance and privacy risk and regularly reporting on such matters to the Board. The Audit Committee and full Board of Directors receive periodic updates from our CISO about Kyndryl's cybersecurity policies and practices, cybersecurity developments, trends, risks, notable incidents, mitigation strategies, maturity initiatives and other developments throughout the year, as well as periodic updates from our CIO, Security & Resiliency global practice leader and other senior leaders on cybersecurity-related matters.


text: Our information security program is led by our CISO, who reports to the CIO. Our CISO organization collaborates closely with key stakeholders across the businesses, including our Security & Resiliency and other global practice organizations, in developing and implementing our cybersecurity strategy, policy, operations, threat detection and incident response and remediation. Our information security teams that support these efforts are comprised of cybersecurity professionals with many years of experience in cybersecurity across multiple sectors, including heavily regulated industries such as financial services and defense, and many of them hold relevant industry certifications.


text: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and significant incidents are escalated as appropriate to senior executive leadership. In addition, we have a risk-based escalation process outside of our regular reporting process to promptly notify the Board of Directors in the event of any material cybersecurity incident impacting the Company.


text: Based on the information we have as of the date of this Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Kyndryl, including our business strategy, results of operations or financial condition. For additional information about cybersecurity risks, s ee Item 1A. "Risk Factors."


text: Risk Management and Strategy Juniata's risk management program is designed to identify, assess and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Juniata's Information Security Officer ("ISO") and SVP/IT Manager are primarily responsible for this cybersecurity component and are key members of the organization, both of which have a clear line of reporting directly to the board of directors and involved with the Information Technology ("IT") Steering Committee. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act 12 CFR 364, Appendix B, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Juniata's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The cybersecurity program is built upon a foundation of advanced security technology, its internal employee team, and operations based on industry best practices recommendations from the Federal Financial Institutions Examination Council ("FFIEC") Guidelines and Cybersecurity Assessment Tool ("CAT"). This consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. Juniata's SVP/IT Manager and ISO, who report directly to the Board of Directors, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. Juniata engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also actively monitors its email gateways for malicious phishing email campaigns and remote connections as some of its workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Management Policy, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the FFIEC guidelines for third-party risk management. The Vendor Management Policy is audited periodically in accordance with the board of directors approved Internal Audit plan.


text: Juniata leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: The Company maintains a Business Continuity Plan (the "Plan") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate board of directors-approved management committees, as discussed further below, and to the IT Steering Committee. The Plan is coordinated through the SVP/IT Manager and ISO and key members of management are embedded into the Plan by their design. The Plan facilitates coordination across multiple parts of the Company and is evaluated at least annually.


text: Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents.


text: Coordinating Incident Response or Crisis Management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents.


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plan.


text: Reviewing the Plan at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Notwithstanding Juniata's defensive measures and processes, the threat posed by cyber-attacks is severe. Juniata's internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while it has experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company.


text: The Company's ISO is accountable for managing enterprise information security and delivering the information security program. These responsibilities include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 22 years of cybersecurity experience, 18 of which was spent at a CPA firm specializing in banking industry financial and information technology audits.


text: The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors.


text: The Company has established the IT Steering Committee, which focuses on technology and business impact, and the Audit Committee of the board of directors, which focuses on the identification, monitoring, assessment, and management of risk associated with its cyber and information security programs. These committees provide oversight and governance of the technology program and the information security program and include the ISO and SVP/ IT Manager, respectively, and other key departmental managers throughout the entire company. The IT Steering Committee meets at least quarterly, and the Audit Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan (part of the Plan) to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity incidents, discussed at committee meetings and the actions taken to the IT Steering Committee on at least a quarterly basis, or more frequently as may be required by the Incident Response Plan, and the board of directors on at least an annual basis.


text: The IT Steering Committee is responsible for overseeing the Company's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The ISO and SVP/IT Manager provide quarterly reports to the IT Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The IT Steering Committee reviews and approves the information security and technology budgets and strategies annually. Additionally, the Audit Committee reviews key metrics summarizing the Company's cyber security risk profile on a quarterly basis. The IT Steering Committee and Audit Committee each provide a report of their activities to the full board of directors at least annually.


text: Lastly, at least annually, the ISO reports directly to the board of directors the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: We have established a robust framework for the assessment, identification, and management of material risks arising from cybersecurity threats. Our approach to cybersecurity risk management includes ongoing assessments of potential threats and vulnerabilities, coupled with the implementation of safeguards and controls to mitigate these risks. We maintain vigilance over the cybersecurity landscape to identify emerging threats, adapting our strategies accordingly. Our cybersecurity risk management process includes: Regular risk assessments to systematically identify and prioritize cybersecurity risks; Implementation of advanced technical controls, encryption, and intrusion detection systems to safeguard sensitive data; Employee training and testing programs designed to enhance awareness about cybersecurity best practices;

companyName: URBAN ONE, INC.

ticker: UONE


text: Collaboration with third-party cybersecurity experts for conducting penetration testing; vulnerability assessments and providing support in the triage of any cybersecurity event; and Select processes to review and manage the risks associated with third-party service providers.


text: We acknowledge the potential material impact that cybersecurity threats and incidents can have on our operations, financial condition, and reputation. While we did not experience any significant cybersecurity incidents during the reporting period, we recognize that such incidents could include: Disruption of our operations, potentially leading to revenue loss;


text: Unauthorized access to or theft of sensitive customer information, resulting in legal and regulatory implications; and Damage to our brand and reputation, which could affect customer trust and investor confidence.