text: Governance: Our Board of Directors, in coordination with the Audit Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, and ongoing updates regarding any such incident until it has been addressed.


text: Security Leadership and Function Team: Our Chief Information Officer oversees our Security organization, which is a team of people dedicated to keeping company and personal information and systems safe from unauthorized alteration, disclosure, destruction and intrusion. Our CIO has more than 20 years of extensive information technology and cyber security management experience. Our Security Steering Committee is made up of our Chief Information Officer (CIO), Chief Technology Officer (CTO), members of our Information Security Team, and key individuals depending on the risk being addressed. The Security Steering Committee meets quarterly to review security risks and discuss upcoming priorities. The CIO, in coordination with the Security Steering Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats, lower risk of a cybersecurity incident, and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. We continue to invest in enterprise-grade certification of our practices. In the event of an incident, we intend to follow our detailed incident response protocol, which outlines the steps to be followed from incident detection, investigation, mitigation, recovery and communication including notifying functional areas, senior leadership and the Board, as appropriate.

companyName: Matterport, Inc./DE

secItem: Item 1C


text: Collaborative Approach: Our cybersecurity program leverages a defense-in-depth strategy to proactively identify and remediate threats. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Physical, Administrative, and Technical Safeguards: The Company deploys appropriate safeguards that are designed to protect the Company's information systems from cybersecurity threats, including endpoint security, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments, penetration tests, and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We established and maintain comprehensive incident response and recovery policies and procedures that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. We build resilience into our business model and roadmap, and work to avoid cybersecurity incidents. If an issue does occur, we rapidly identify and resolve it through our formalized incident response program designed to help us quickly detect, respond to and recover from any incident.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: All employees must complete mandatory, annual comprehensive security awareness training. Our Security organization updates the training to address emerging threats and trends. We also conduct periodic phishing and other social engineering simulations to test our defenses and offer focused phishing training for those who may require additional education.


text: In addition, we also perform the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including internal validation and external audits, risk assessments, penetration tests, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including SOC2 reporting, SOX IT audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Security Steering Committee and the Audit Committee. The Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and threat intelligence. The Company is unaware of any cybersecurity threats that have materially affected or are reasonably likely to impact it.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See the risk factor, entitled "We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business" in Item 1A - Risk Factors.


text: Security Leadership and Function Team: Our Chief Technology Officer ("CTO") oversees our Security organization, which is a team of people dedicated to keeping company and personal information and systems safe from unauthorized alteration, disclosure, destruction and intrusion. Our Security Steering Committee is made up of our CTO, members of our Information Security Team, and key individuals depending on the risk being addressed. The Security Steering Committee meets quarterly to review security risks and discuss upcoming priorities. The CTO, in coordination with the Security Steering Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats, lower risk of a cybersecurity incident, and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. We continue to invest in enterprise-grade certification of our practices. In the event of an incident, we intend to follow our detailed incident response protocol, which outlines the steps to be followed from incident detection, investigation, mitigation, recovery and communication including notifying functional areas, senior leadership and the Board, as appropriate.


text: Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee. Our cybersecurity policies, standards, processes, and practices have been established as part of our risk management program and are based on recognized frameworks, including as adopted by the National Institute of Standards and Technology (the "NIST"). In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Nerdy Inc.

ticker: NRDY


text: Our cybersecurity program focuses on these key areas: • Governance: The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices. • Cross-Functional Approach: We have adopted a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Third-Party Risk Management: We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments. • Incident Response and Recovery Planning: We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include internal and external activities, including reviews of our information security control environment, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning, and information security maturity assessments.


text: In late 2023, the Board of Directors delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives regular presentations and reports on cybersecurity risks, and prior to the Board's delegation, the Board periodically received such presentations and reports. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.


text: The CTO and Vice President, Engineering and Security in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"), among others, work collaboratively across functions to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communication, we monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CTO has served in various roles in information technology and information security for over a decade, and holds a doctorate in mathematics from the London School of Economics and Political Science. The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. Our CEO, CFO and CLO each hold degrees in their respective fields, and each have experience managing risks, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Depending on their nature, cybersecurity threats in the future may materially affect our business strategy, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this report.


text: Our cybersecurity program focuses on these key areas: • Governance: The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices. • Cross-Functional Approach: We employ a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Third-Party Risk Management: We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments. • Incident Response and Recovery Planning: We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Audit Committee receives regular presentations and reports on cybersecurity risks. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.


text: Risk Management and Strategy The Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We use these frameworks, together with information collected from assessments, to tailor aspects of our cybersecurity and data privacy practices given the nature of our assets, operations and business. Key features of our cybersecurity and data privacy processes and procedures include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements controls that are tailored based on risk and designed to protect the confidentiality, integrity and access to our information systems and information stored on our networks, including member, customer and employee information, intellectual property and proprietary information. We employ in-depth defense mechanisms throughout our enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and managed security services to monitor, mitigate and/or prevent cybersecurity incidents. • Cybersecurity incident management and response: We have a cybersecurity incident response plan and specified teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, our cross-functional teams lead the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic simulations of common incidents. Further, we work closely with our external managed security services experts to provide ongoing monitoring and to augment our internal cybersecurity team with incident management and response specialists. • Cybersecurity awareness and training: Our employees are required to complete security awareness training and a compliance course annually, which we believe helps our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees in accordance with member or customer requirements and regulatory obligations. Further, we regularly communicate with employees about evolving cybersecurity trends through company-wide cybersecurity alerts, which heightens awareness of cybersecurity events that may be impacting our business, peers and industry. • Our assessments of third parties: We have implemented a third-party risk management process that includes, among other things, periodic cybersecurity assessments on certain third parties on which we rely based on an assessment of their risk profile. We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.

companyName: Wheels Up Experience Inc.

ticker: UP


text: • Third-party assessments of Wheels Up: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity and data privacy processes and procedures, and to assist in identifying and remediating risks from cybersecurity threats. Our third-party assessors regularly conduct penetration testing and measure our processes, procedures and responses against industry standard frameworks. We use the results of these periodic assessments to implement programmatic changes and continuous improvements in alignment with business requirements, industry standards and regulatory requirements.


text: We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, and must be continuously updated and improved. As of the date of this Annual Report, we have not identified material risks from known cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected the Company, including our business strategy, results of operations or financial condition. See Part I, Item 1A "Risk Factors—Risks Relating to Technology, Cybersecurity and Data Privacy" for more information about cybersecurity and data privacy risks.


text: The Board, the Audit Committee and management each actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Audit Committee regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer ("CISO") and other members of management to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.


text: Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity and data privacy matters. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information Systems and Technology, and industry certifications awarded by the International Information System Security Certification Consortium (ISC2); Certified Information Systems Security Professional (CISSP), and Information Systems Security Engineering Professional (ISSEP).


text: Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. Our cyber risk team collaborates with internal stakeholders to identify and analyze cybersecurity risks to the Company, implement appropriate controls and enable leaders to make risk-based business decisions that implicate cybersecurity considerations. Our CISO also reports on our cybersecurity and data privacy processes, procedures and risks to our executive management team when changes or risks are expected to impact other portions of the business, including with respect to the Wheels Up mobile app, website and proprietary pricing algorithms.


text: Risk Management and Strategy The Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We use these frameworks, together with information collected from assessments, to tailor aspects of our cybersecurity and data privacy practices given the nature of our assets, operations and business. Key features of our cybersecurity and data privacy processes and procedures include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements controls that are tailored based on risk and designed to protect the confidentiality, integrity and access to our information systems and information stored on our networks, including member, customer and employee information, intellectual property and proprietary information. We employ in-depth defense mechanisms throughout our enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and managed security services to monitor, mitigate and/or prevent cybersecurity incidents. • Cybersecurity incident management and response: We have a cybersecurity incident response plan and specified teams to respond to cybersecurity incidents. If a cybersecurity incident occurs or we identify a vulnerability, our cross-functional teams lead the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic simulations of common incidents. Further, we work closely with our external managed security services experts to provide ongoing monitoring and to augment our internal cybersecurity team with incident management and response specialists. • Cybersecurity awareness and training: Our employees are required to complete security awareness training and a compliance course annually, which we believe helps our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees in accordance with member or customer requirements and regulatory obligations. Further, we regularly communicate with employees about evolving cybersecurity trends through company-wide cybersecurity alerts, which heightens awareness of cybersecurity events that may be impacting our business, peers and industry. • Our assessments of third parties: We have implemented a third-party risk management process that includes, among other things, periodic cybersecurity assessments on certain third parties on which we rely based on an assessment of their risk profile. We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.


text: We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, which must be continuously updated and improved. As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. See the caption titled "Risks Relating to Technology, Cybersecurity and Data Privacy" in Part I, Item 1A "Risk Factors" in this Annual Report for more information about cybersecurity and data privacy risks.


text: The Board, the Audit Committee and management each actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Audit Committee regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer ("CISO") and other members of management, to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.


text: Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity threats. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information Systems and Technology, and industry certifications awarded by the International Information System Security Certification Consortium (ISC2); Certified Information Systems Security Professional (CISSP), and Information Systems Security Engineering Professional (ISSEP). We also have a U.S. Data Privacy Officer, who reports to our Chief Legal Officer, and a European Data Privacy Officer, who reports to our CISO, each of whom have primary oversight of material risks related to data privacy in their respective territories. Our U.S. Data Privacy Officer, who is a licensed attorney, holds industry certifications awarded by the International Association of Privacy Professionals (IAPP). Our European Data Privacy Officer has a master's degree in public international law and over 10 years of experience working in cybersecurity, data protection and governance.


text: Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means. Our cyber risk team collaborates with internal stakeholders to identify and analyze cybersecurity risks to the Company, implement appropriate controls and enable leaders to make risk-based business decisions that implicate cybersecurity considerations. Our CISO also reports on our cybersecurity and data privacy processes, procedures and risks to our executive management team when changes or risks are expected to impact other portions of the business, including with respect to the Wheels Up mobile app, website and proprietary pricing algorithms.


text: Risk Management and Strategy We recognize that our customers have a legitimate expectation of safety and privacy when they do business with us. We deploy considerable resources to protect customer data and privacy because our business depends on our customers' trust. We recognize that there is a cost and risk associated with every piece of data our customers entrust us with, so we take measures to minimize what is collected to only what we need to provide a great experience and meet our legal and regulatory requirements. In addition, we have integrated cybersecurity risk management into our broader risk management framework through our (i) regular enterprise risk management updates to the Audit Committee, (ii) information technology and security related internal controls and (iii) incident response and vulnerability management programs.

companyName: Bark, Inc.

ticker: BARK


text: We actively assess, identify, and manage material risks associated with cybersecurity threats. Our information security, finance, procurement, legal and other cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. All employees are required to complete annual information security training and periodic training specifically related to phishing. We have an enterprise-wide Information Security Incident Response Plan ("Incident Response Plan") which describes the detailed processes and procedures that should be followed in the event of an information security incident. We periodically perform tabletop exercises with management participation to be able to effectively respond to an information security incident and evaluate and improve the Incident Response Plan. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection and vulnerability tools.


text: We also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our information security processes. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: In order to mitigate data or security incidents that may originate from third-party vendors or suppliers, we conduct both privacy and information security assessments to properly identify, prioritize, assess and remediate any third-party risks, and require information security and privacy addenda to our contracts where applicable.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: Our Board of Directors (the "Board") is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise enabling its members to oversee cybersecurity risks effectively. Our Audit Committee's responsibilities include reviewing the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches.


text: At the management level, a management steering committee comprised of our Chief Financial Officer, Controller, and General Counsel is briefed quarterly by our Director of Information Security. Our Director of Information Security also prepares a quarterly Information Security Risk Report, which is provided to the management steering committee in advance of its quarterly meeting and also made available to the members of the Audit Committee. Our current Director of Information Security has 16 years of industry experience leading large-scale security initiatives, enhancing infrastructure defenses and instilling a culture of security awareness across all employee levels. Additionally, our Director of Information Security holds standard industry security certifications, including CISSP (Certified Information Systems Security Professional).


text: The Audit Committee will receive reports, briefings and presentations from senior management, including our Director of Information Security, at periodic committee meetings, including, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates as needed. In addition to scheduled meetings, significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team, including the Chief Financial Officer and the General Counsel, to determine whether further escalation to the Audit Committee and/or the Board is appropriate, ensuring the Audit Committee's and the Board's oversight is timely and responsive. Our Incident Response Plan also includes immediate actions to mitigate the impact and strategies for remediation and prevention of future incidents.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor do we believe they are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: At the management level, a management steering committee comprised of our Chief Financial Officer, Controller, and General Counsel is briefed quarterly by our Director of Information Security. Our Director of Information Security also prepares a quarterly Information Security Risk Report, which is provided to the management steering committee in advance of its quarterly meeting and also made available to the members of the Audit Committee. Our current Director of Information Security has 17 years of industry experience leading large-scale security initiatives, enhancing infrastructure defenses and instilling a culture of security awareness across all employee levels. Additionally, our Director of Information Security holds standard industry security certifications, including CISSP (Certified Information Systems Security Professional).


text: Integrated Risk Management Management is responsible for the day-to-day management of our risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of our risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, prioritize, manage, monitor and report current and emerging information security related risks, including risks associated with our use of third-party service providers. As part of this framework, we have an Enterprise Risk Management ("ERM") program which is implemented across the Company to promote a strong Company-wide culture of risk management, compliance, and control.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: Our processes for assessing, identifying and managing information security risks and vulnerabilities are embedded across our business as part of our ERM program. As part of ERM program, we perform risk assessments in which we map and prioritizes information security risks identified and addressed through a multi-faceted approach of processes described here, including third party assessments. We execute periodic audits and tests of our information system security controls in-house such as a vulnerability analysis of the information and the infrastructure of our sites. We engage third-party services to assist in designing the ITGC controls and evaluating them periodically either through independent audits or consulting on best practices to address new challenges. These evaluations include both the design and operational effectiveness of the controls. Our risk management program also assesses third party risks, and we perform third party risk management to identify and mitigate risks from third parties such as vendors and suppliers associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers. Among other things, we conduct periodic infrastructure monitoring including assessment of existing technology hardware and software configurations, patches and updates and also implement automated tools. We provide recurrent information security awareness training for employees and carry out periodic campaigns related to safety awareness which include interactive activities involving the employee participation. Additionally, we have also implemented incident management protocols to analyze, remediate, and respond to activities that implicate potential risk to data and information. Through this methodology we remediate information security incidents and comply with potential legal obligations mitigating brand and reputational damage.


text: Impact of Risks from Cybersecurity Threats We have identified a material weakness in our information technology general controls. These controls over user access to certain information technology systems that support our financial reporting process were not properly designed and implemented. We have since made efforts to remediate the identified material weakness. There have otherwise been no risks from cybersecurity threats at the Company to date that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Governance.


text: The board of directors of the Company (the "Board") has oversight responsibility for our risk management framework, including technology and cybersecurity risks facing the Company. The ERM program enables the board to establish a mutual understanding with the management of the effectiveness of its information security risk management practices and capabilities including the division of responsibilities for reviewing its information security risk exposure and risk tolerance, tracking emerging information risks, and reviewing for proper escalation of certain key risks for periodic review by the Board.


text: The Board receives briefings from management and security and technological infrastructure team on enterprise-wide technology, cybersecurity risk management and the overall technology and cybersecurity environment by management. Specifically, the Board receives an Annual Security Information Report which details the plan for cybersecurity management, reviews the result of the implementation of threat control activities and conclusions for the period evaluated.


text: Role of Management In addition to the risk management activities undertaken under the ERM Program, where management assesses and manages material risks from cybersecurity threats, our security and technological infrastructure team led by Technology Infrastructure and Security Manager, is responsible for day-to-day identification, assessment and management of the information security risks we face. Personnel in our security and infrastructure team collectively have decades of experience in information security, information technology and cybersecurity operations. These personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents detected through automated detection and monitoring tools. The team manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes procedures such as: (i) reporting of the incident through a ticket management tool designated by the Company, (ii) identification and analysis, (iii) monitoring, containment, and eradication, (iv) remediation and creation of controls, and (v) lessons learned and preparation for future incidents. The Technology Infrastructure and Security Manager provides regular updates to the Board concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.


text: We continue to make substantial investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed quarterly by our Board of Directors.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: Risk Management and Strategy As of December 31, 2023, we've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our ITGCs are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors. We conduct cybersecurity penetration testing annually to identify and remediate cybersecurity gaps. We also perform cybersecurity assessments of all our third-party providers who have access to our information technology systems and data.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of IT who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. We have a dedicated IT resource with expertise in cybersecurity and risk management who is dedicated to working with our internal IT team on cybersecurity risk management.


text: We also engage other consultants, and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our Board of Directors and Audit Committee are responsible for overseeing our cyber security risk management and strategy.


text: Our Head of IT provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties. Our Audit Committee regularly meets with our Chief Financial Officer and Head of IT about the Company's ongoing compliance and risk management and reports to the Board regularly.


text: Risk Management and Strategy As of December 31, 2024, we've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our information technology general controls are established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors. We conduct cybersecurity penetration testing annually to identify and remediate cybersecurity gaps. We also perform cybersecurity assessments of all our third-party providers who have access to our information technology systems and data.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of Information Technology ("IT") who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. We have a dedicated IT resource with expertise in cybersecurity and risk management who is dedicated to working with our internal IT team on cybersecurity risk management.


text: We also engage other consultants and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.


text: Our Head of IT provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties. Our Audit Committee regularly meets with our Chief Financial Officer and Head of IT about the Company's ongoing compliance and risk management and reports to the Board of Directors regularly.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internet Security (CIS) Critical Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CIS Controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls and (3) response to cybersecurity incidents; • policies, security technologies and safeguards to fulfill overall NIST CSF program goals and key controls established by the CIS; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security program; this includes penetration testing, and assisting internal audit in assessing the effectiveness of our controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Please see the section entitled "Risk Factors –Failure to maintain the security of our information and technology networks, or those of our third-party service providers, or cyber security incidents could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow," for more information.


text: The audit committee reports to the full board of directors regarding its risk management activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program from time to time. Members of the board of directors receive presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including the Chief Technology Officer and Chief Information Security Officer, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our current Chief Technology Officer has over 25 years of cybersecurity experience, including past roles as a Chief Information Security officer and with a leading accounting and professional services firm. Our current Chief Information Security Officer has 20 years of relevant information technology and cybersecurity experience.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Please see the section entitled "Risk Factors –Failure to maintain the security of our information technology networks, or those of service providers and other our third-parties, or cybersecurity incidents could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow," for more information.


text: Risk Management & Strategy We have established a risk-based process for assessing, identifying and managing material cybersecurity threats. Our security program utilizes various tools, including physical, administrative and technical safeguards designed to help prevent and respond to cybersecurity threats and incidents. As risks are identified, we implement a variety of measures to manage and mitigate these risks such as firewalls, intrusion detection processes/systems, and vulnerability management. We have a Cyber Defense Center that utilizes incident response plans and various tools such as Splunk and Crowdstrike to respond and recover from cyber incidents. We also have an outside firm on retainer should the need arise to obtain additional assistance.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: In addition, we have established an Information Security Awareness Program focused of several areas: • Formal training on topics such as phishing each month; • During Cyber Security Awareness month we provide additional training on topics like IT Policy, access management, and effective password management; • Company-wide informal training through lunch & learn sessions and department meetings; • Tabletop exercises with key personnel during which we simulate cybersecurity threats to test our capabilities and continually improve our response protocols.


text: We are actively engaged with the Aviation Information Sharing and Analysis Center (ISAC) which gathers, analyzes and shares information to combat cyber-related threats and weaknesses. We use this information to ensure we are aware of possible threats that could occur within our industry.


text: During the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see Item 1A "Risk Factors" in this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is primarily responsible for oversight of the Company's risk assessment and risk management, including cybersecurity risks. The committee meets at least annually with our Head of Information Technology, who provides a report on the Company's current risk assessment as well as mitigation efforts. The Audit Committee also periodically updates the Board of Directors on risk matters.


text: Keith Moss, our Head of Information Technology, oversees our cybersecurity and information security program. He has over 30 years of experience in various CISO and information technology roles, and was previously the IT Director at Ford Motor Company North America. He holds a Master of Science in Computer Engineering and a Bachelor of Science in Computer Science from the University of Michigan and an MBA from Bowling Green State University.


text: During the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see Item 1A "Risk Factors" in this Annual Report.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. In general, the Company seeks to address cybersecurity risks through a comprehensive and cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our enterprise security program has been developed based on industry standards, including those published by the International Organization for Standardization (ISO) and the National Institute of Standards and Technology ("NIST").

companyName: SkyWater Technology, Inc

ticker: SKYT


text: Governance - The Board has designated that the Audit Committee is responsible for overseeing cybersecurity risks, and our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Audit Committee on cybersecurity matters. The SVP of IT & SCM has over 20 years of experience in IT systems, IT infrastructure, fab and manufacturing environments, and site disaster recovery and compliance. Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the Cybersecurity Maturity Model Certification (CMMC) program, ISO 27001, and extensive experience in systems and technology infrastructure management. In addition, our Director of Corporate Security reports to our Chief Legal Officer and is involved in the ongoing compliance with relevant cybersecurity regulations, including with regard to cybersecurity monitoring and incident response (as noted below). The Director of Corporate Security has over 20 years of experience in quality systems, semiconductor manufacturing, and industrial security.


text: Risk Assessment - Our enterprise risk assessment is performed by executives, management, and functional and department-level subject matter experts. This group engages in the ongoing monitoring of identified risks to the Company and risk mitigation efforts. Our enterprise risk management process captures the potential impact and likelihood of cybersecurity risk events by evaluating our current cybersecurity risk environment and our existing cybersecurity controls. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The SVP of IT & SCM, senior leadership, and our internal audit function provide both the full Board and the Audit Committee with periodic updates on the performance of our cybersecurity program.


text: Monitoring and Incident Response - The Company's cybersecurity program protects against threats through use of the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls and remediation practices; implementing a third-party risk management program to evaluate our critical partners' cyber posture; and evaluating our program effectiveness by performing internal and external assessments. The Company engages a third-party service provider to perform annual internal and external penetration testing under NIST special paper (SP) 800-171 requirements to identify potential gaps that require remediation. In addition, the Company utilizes several industry-standard software applications to monitor for cybersecurity threats and alert our Director of Corporate Security and IT administration of any incidents that require escalation to the SVP of IT & SCM and the Audit Committee. Threats and incidents identified are immediately investigated by the IT administration team and appropriate action is taken to mitigate the impact to the Company.


text: Education and Awareness - We conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action. We install and regularly update antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems. In addition, we have a product security team focused on integrating risk and security best practices into our product development life cycle. Periodically, we are audited by an independent information systems expert to determine both the adequacy of, and compliance with, controls and standards.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks, threats or incidents. The potential consequences of a future material cybersecurity incident may include reputational damage, litigation with third parties, government enforcement actions, penalties, disruption to our systems or operations of our facilities, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in research, development and engineering, increased cybersecurity protection costs and unplanned remediation costs, which in turn could adversely affect our business strategy, results of operations and financial condition. See Item 1A under the caption "A breach of our security systems or a cyberattack that disrupts our operations or results in the breach of confidential information about us, our technology, or our customers could harm our business and expose us to costly regulatory enforcement and other liability." for additional information on cybersecurity risks applicable to the Company.


text: Governance - The Board has designated that the Risk Management Committee is responsible for overseeing cybersecurity risks, and our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Risk Management Committee on cybersecurity matters. The SVP of IT & SCM has over 20 years of experience in IT systems, IT infrastructure, fab and manufacturing environments, and site disaster recovery and compliance. Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the Cybersecurity Maturity Model Certification (CMMC) program, ISO 27001, and extensive experience in systems and technology infrastructure management. In addition, our Director of Corporate Security reports to our Chief Risk and Compliance Officer and is involved in the ongoing compliance with relevant cybersecurity regulations, including with regard to cybersecurity monitoring and incident response (as noted below). The Director of Corporate Security has over 20 years of experience in quality systems, semiconductor manufacturing, and industrial security.


text: Risk Assessment - Our enterprise risk assessment is performed by executives, management, and functional and department-level subject matter experts. This group engages in the ongoing monitoring of identified risks to the Company and risk mitigation efforts. Our enterprise risk management process captures the potential impact and likelihood of cybersecurity risk events by evaluating our current cybersecurity risk environment and our existing cybersecurity controls. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The SVP of IT & SCM, senior leadership, and our internal audit function provide both the full Board and the Risk Management Committee with periodic updates on the performance of our cybersecurity program.


text: Monitoring and Incident Response - The Company's cybersecurity program protects against threats through use of the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls and remediation practices; implementing a third-party risk management program to evaluate our critical partners' cyber posture; and evaluating our program effectiveness by performing internal and external assessments. The Company engages a third-party service provider to perform annual internal and external penetration testing under NIST special paper (SP) 800-171 requirements to identify potential gaps that require remediation. In addition, the Company utilizes several industry-standard software applications to monitor for cybersecurity threats and alert our Director of Corporate Security and IT administration of any incidents that require escalation to the SVP of IT & SCM and the Risk Management Committee. Threats and incidents identified are immediately investigated by the IT administration team and appropriate action is taken to mitigate the impact to the Company.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks, threats or incidents. The potential consequences of a future material cybersecurity incident may include reputational damage, litigation with third parties, government enforcement actions, penalties, disruption to our systems or operations of our facilities, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in research, development and engineering, increased cybersecurity protection costs and unplanned remediation costs, which in turn could adversely affect our business strategy, results of operations and financial condition. See Item 1A under the caption "A breach of our security systems or a cyberattack that disrupts our operations or results in the breach of confidential information about us, our technology, or our customers could harm our business and reputation, and could expose us to costly regulatory enforcement and other liability." for additional information on cybersecurity risks applicable to the Company.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Cipher Digital Inc.

ticker: CIFR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business, Industry and Operations— If we or our third-party providers fail to protect confidential information and/or experience cybersecurity incidents, such as cyber-attacks, data breaches, hacking attacks or malware, there may be disruptions to our operations, triggering significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of the Audit Committee have experience in overseeing and managing cybersecurity and data privacy risks.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts in highly-regulated industries. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.


text: Risk management and strategy We rely on information technology and data to operate our business and develop, market and deliver our services to our customers. Our information technology includes various cloud computing resources, computer networks, third party hosted services, communications systems, software, and our data (which includes confidential, personal, proprietary and sensitive data) (collectively "Information Assets"). We maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.

companyName: Grindr Inc.

ticker: GRND


text: We rely on a multidisciplinary team (including information security stakeholders and management, as described further below in "Cybersecurity—Governance") to help assess how cybersecurity threats to our Information Assets could impact our business. We seek to assess the likelihood that such threats could result in a material impact to our Information Assets, operations, ability to provide our services, our core business functions, personnel, reputation, and identified critical business objectives. We identify, assess, and manage our cybersecurity threats and risks by, among other things, ongoing threat modeling discussions of certain of our applications and infrastructure, reviewing certain weekly security bulletins, monitoring the threat environment using manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain threats and actors, scans of certain threat environment, evaluating our industry's risk profile, evaluating threats reported to us from our public-facing bug bounty program, conducting threat assessments for certain internal and external threats, and conducting vulnerability assessments in some environments and systems aimed at identifying vulnerabilities.


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training employees on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.


text: Risk from cybersecurity threats are among those that we address in the Company's general risk management program. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program, and the security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: To operate our business, we rely on third party service providers to perform a variety of functions, such as SaaS platforms, managed services, property management, cloud-based infrastructure, content delivery to customers, encryption and authentication technology, and corporate productivity services. We have a vendor management program designed to help manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for certain vendors; security questionnaires for certain vendors; review of certain vendor's written security program and security assessments; and imposition of information security contractual obligations on the vendor.


text: Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and contractually impose obligations onto them related to the services they provide and/or the information they process.


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we follow our third party vendor review processes involving stakeholders throughout the company. This includes multiple levels of due diligence prior to an engagement to assess what, if any, user data or confidential information the vendor may receive access to, what controls should be implemented around such access, and validating that the contractual rights and obligations conform to our policies and practices.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section titled "Risk Factors—Risks Relating to our Business—Security breaches, unauthorized access to or disclosure of our data or user data, other hacking and phishing attacks on our systems or those of third parties upon which we rely, or other data security incidents could compromise sensitive information related to our business or users processed by us or on our behalf and expose us to liability, which could harm our reputation, generate negative publicity, and materially and adversely affect our business."


text: Our Board of Directors oversees the Company's risk management strategy with respect to cybersecurity threats as part of its general oversight function. The Board of Directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk management strategy relies on input from certain members of management, including our Senior Vice President of Engineering and Chief Information Security Officer (reporting to our Chief Executive Officer) in consultation with our General Counsel and Head of Global Affairs (reporting to our Chief Executive Officer), our Chief Privacy Officer (reporting to our General Counsel) and input from various leaders who participate in our Privacy and Security Council. This team helps us understand cybersecurity threats and risks, establish priorities, and determine the scope, elements, and implementation of a cybersecurity program. The team is also responsible for integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.


text: Every quarter, the Privacy and Security Council meets to discuss certain cybersecurity risks and upcoming changes to our legal obligations that may affect our cybersecurity program, and to review our cybersecurity program. Our cybersecurity team is responsible for preparing for any cybersecurity incidents, responding to any cybersecurity incidents, approving cybersecurity policies and procedures, and reviewing cybersecurity-related audit reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our SVP Engineering and Chief Information Security Officer, General Counsel and Head of Global Affairs, and Chief Privacy Officer, as appropriate. In addition, our incident response plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Board of Directors, through its Audit Committee, holds at least quarterly meetings to discuss the matters within the Audit Committee's scope, including to review and discuss our cybersecurity threat management. The Audit Committee oversees matters related to cybersecurity threats and hears reports from our SVP Engineering and Chief Information Security Officer about our guidelines, policies, and practices regarding cybersecurity risks as well as any updates of certain cybersecurity threats faced by us and steps we are taking to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats risk and mitigation.


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training staff on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—Risks Relating to our Business—Security breaches, unauthorized access to or disclosure of our data or user data, other hacking and phishing attacks affecting our information technology systems or those of third parties with whom we work, or other data security incidents could compromise sensitive information related to our business or users processed by us or on our behalf and expose us to liability, which could harm our reputation, disrupt the availability of our systems and services, generate negative publicity, and materially and adversely affect our business."


text: Our cybersecurity risk management strategy relies on input from certain members of management, including our Senior Vice President of Engineering and Chief Information Security Officer ("CISO") (reporting to our Chief Executive Officer) in consultation with our General Counsel and Head of Global Affairs (reporting to our Chief Executive Officer), our Chief Privacy Officer (reporting to our General Counsel) and input from various leaders who participate in our Privacy and Security Council. This team helps us understand cybersecurity threats and risks, establish priorities, and determine the scope, elements, and implementation of a cybersecurity program. The team is also responsible for integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.


text: Our CISO leads our global information security organization responsible for overseeing the Grindr cybersecurity program which is designed to maintain the confidentiality, integrity and availability of Grindr's data assets. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public and private companies. Team members who support our cybersecurity program have deep educational and industry experience. The CISO attends quarterly meetings with our Audit Committee and meets with Grindr's Board of Directors at least annually to brief them on security matters including ongoing cyber threats and risks.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and SVP Engineering, General Counsel and Head of Global Affairs, and Chief Privacy Officer, as appropriate. In addition, our incident response plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property loss or theft; fraud; extortion; harm to employees or customers; potential litigation, regulatory investigations or other proceedings, and other legal risks; and reputational risks. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Bakkt, Inc.

ticker: BKKT


text: To provide for the availability of critical data and systems, address regulatory compliance requirements, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake these activities: • undertake an annual review of our policies and statements related to cybersecurity; • conduct cybersecurity awareness training for all employees annually; • conduct privileged access and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable), require employees, as well as applicable third parties who provide services on our behalf, to treat customer information and data with care; • conduct tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the National Institute of Standards and Technology incident handling framework as the foundation of our incident response plan to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the certain potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take in our efforts to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We regularly engage with independent third parties to review our cybersecurity program and assess the effectiveness of our controls. These third parties include our Internal Audit department as well as external reputable and well-known firms, all of which review various aspects of our cybersecurity program, processes, and controls throughout the year.


text: We also maintain processes to address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our systems or data or facilities that house such systems and data. Cybersecurity considerations affect the selection and oversight of these third-party service providers. We perform diligence on these third parties and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that we believe could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and be subject to certain obligations related to their cybersecurity practices.


text: Like other technology companies, we have faced cybersecurity incidents in the past. As of the date of this Annual Report on Form 10-K, however, we have not assessed any risks from prior cybersecurity incidents as having materially affected or being reasonably likely to materially affect us. We face risks from cybersecurity threats, including those associated with cyberattacks and security breaches and incidents, in the future. For additional information regarding whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in "Item 1A. Risk Factors" and "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board's Audit and Risk Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the entire Board receives an overview from management of our cybersecurity program and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board discusses such matters with our Chief Risk Officer (CRO) and Chief Information Security Officer (CISO). Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our enterprise risk management and strategy processes are led by our CRO. Cybersecurity program management and strategy processes are led by our CISO. Such individuals have collectively over 40 years of prior work experience in various roles involving managing enterprise risk and information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, and Certified Information Systems Security Professional. The CRO and CISO provide regular updates to the executive management team. The executive management team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the CRO and CISO report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.


text: Risk Management and Strategy Our commercial success depends on developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Managing Material Risks & Integrated Enterprise Risk Management We are working to strategically integrate cybersecurity risk management into our broader enterprise risk management program to promote a company-wide culture of cybersecurity risk management. Our enterprise risk management project team is working closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs while building out a framework to monitor those risks and integrate objectives into our broader strategic plan.


text: Engaging Third Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we have engaged a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating, testing, and improving our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and includes regular audits, threat assessments, and consultation on security enhancements.


text: Overseeing Third Party Risk The need to govern third party service providers and vendors poses significant challenges, and as a result we have implemented processes to oversee and manage these risks. Our procedures contemplate conducting security assessments of all third-party providers that are proportional to the risks present, ideally before or soon after engagement, and periodically thereafter, in order to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, although we cannot rule out that a cyber attack in the future could materially affect our ability to operate.


text: Our Board of Directors (the "Board") is aware of the critical nature of managing risks associated with cybersecurity threats. In recognition of the significance of these threats to our operational integrity and shareholder confidence, the Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight The Nominating and Corporate Governance Committee of the Board bears primary responsibility for oversight of cybersecurity risks. The Nominating and Corporate Governance Committee is briefed on cybersecurity risks at least once each year and any material cybersecurity incidents by the Chief Information Officer ("CIO") and the Chief Legal Officer ("CLO"), as further described below. The Nominating and Corporate Governance Committee is composed of directors equipped with diverse skills needed to oversee the difference facets of cybersecurity risks effectively, including risk management, public company leadership, innovation and technology, corporate governance and finance.


text: Management's Role Managing Risk The CIO and the CLO are responsible for updating the Nominating and Corporate Governance Committee on cybersecurity risks and the Company's mitigation strategies. They provide quarterly updates to the Nominating and Corporate Governance Committee, as well as comprehensive briefings at least once per year and appropriate briefings during any potentially material cybersecurity incident. These briefings encompass a broad range of topics, including: • results of internal assessments and audits by third parties; • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • incident reports and lessons learned from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to regular scheduled meetings, the Nominating and Corporate Governance Committee, CIO and Chief Executive Officer ("CEO") maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive periodic updates on significant developments in the cybersecurity landscape to support proactive and responsive Board oversight. The Nominating and Corporate Governance Committee actively participates in strategic decisions related to cybersecurity, reviewing and offering guidance on major initiatives and any potentially material cybersecurity incident. This involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CIO, Jovan Kangrga. Mr. Kangrga has managed cybersecurity and information security at Array for the past four years and has over 13 years of total experience as an information technology executive for publicly listed companies. Mr. Kangrga holds B.S. degrees in finance and computer science from Arizona State University as well as a M.B.A. from Western International University. He manages a team with over 40 years of combined experience in cybersecurity. Our CIO reports to our CLO, and both our CIO and CLO are responsible for updating the CEO, the Nominating & Corporate Governance Committee, and the Board on cybersecurity issues.