text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical IT service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes processes for performing due diligence upon on-boarding.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.

companyName: Skye Bioscience, Inc.

ticker: SKYE

secItem: Item 1C


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the our service delivery; however, potential vulnerabilities to known or unknown threats will still remain and we may not be able to prevent security incidents in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: The audit committee (the " Audit Committee ") of our Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the service delivery; however, potential vulnerabilities to known or unknown threats will still remain and we may not be able to prevent security incidents in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: Cybersecurity Risk Management and Strategy As part of our cybersecurity process, we engage external auditors and consultants to assess our cybersecurity program and compliance with applicable practices and standards. To identify and manage the material risks of cybersecurity threats to our business, operations and control environments, we have made significant investments in our technology and have implemented policies, programs and controls, with a focus on cybersecurity incident prevention and mitigation. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed by third-party auditors and consultants, as well as our internal Information Technology and Legal teams, to ensure compliance with applicable practices and standards.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: We mitigate risks from cybersecurity incidents using a multi-faceted approach that includes, but is not limited to: establishing information security policies and standards, implementing information protection processes and technologies, assessing cybersecurity risk through vulnerability assessments and audits on an annual basis, reviewing newly developed cybersecurity standards or legislation, implementing cybersecurity training, monitoring our information technology systems for cybersecurity threats and collaborating with public and private organizations on best practices..


text: We did not experience a material cybersecurity incident during the fiscal year ended December 29, 2023. For more information on risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see "Information technology system failures, cybersecurity incidents or other disruptions to our use of technology and networks could interrupt our operations and adversely affect our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our board of directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, including the Company's risk profile and exposures as they relate to cybersecurity, conducting reviews of policies regarding risk assessment and risk management and major risk exposures, as well as evaluations of risks from potential or actual cybersecurity threats. Our Chief Information Officer, Vice President of Infrastructure, and Security Administrator have responsibility of cybersecurity oversight of the Company and each have 12, 15, and 6 years of cybersecurity experience, respectively. The Security Administrator reports to the Vice President of Infrastructure, who in turn reports to the Chief Information Officer. Members of the Board receive regular quarterly cybersecurity updates from our Chief Information Officer, including updates on existing and new cybersecurity risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: We mitigate risks from cybersecurity incidents using a multi-faceted approach that includes, but is not limited to: establishing information security policies and standards, implementing information protection processes and technologies, assessing cybersecurity risk through vulnerability assessments and audits on an annual basis, reviewing newly developed cybersecurity standards or legislation, implementing cybersecurity training, monitoring our information technology systems for cybersecurity threats and collaborating with public and private organizations on best practices.


text: We did not experience a material cybersecurity incident during the fiscal year ended December 27, 2024. For more information on risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see "Information technology system failures, cybersecurity incidents or other disruptions to our use of technology and networks could interrupt our operations and adversely affect our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our board of directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, including the Company's risk profile and exposures as they relate to cybersecurity, conducting reviews of policies regarding risk assessment and risk management and major risk exposures, as well as evaluations of risks from potential or actual cybersecurity threats. Our Chief Information Officer, Vice President of Infrastructure, and Security Administrator have responsibility of cybersecurity oversight of the Company and each have 13, 16, and 7 years of cybersecurity experience, respectively. The Security Administrator reports to the Vice President of Infrastructure, who in turn reports to the Chief Information Officer. Members of the Board receive regular quarterly cybersecurity updates from our Chief Information Officer, including updates on existing and new cybersecurity risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: Information Security Program Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company's senior leadership team including senior representation from the firm's operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which uses a top-down approach to identify and prioritize key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm's operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company's information security awareness training and testing and assessment program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training, as well as perform monitoring, testing and surveillance activities relating to compliance with the firm's policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic and independent assurance that the firm's internal controls are implemented and operating effectively.


text: With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has 32 years of information technology experience, and reports to our Chief Information Officer (CIO), who has 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has 37 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.


text: Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct monitoring and testing activities, such as phishing simulations.


text: Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.


text: To date, we have not experienced any known material cybersecurity breach or threat that resulted in or is reasonably likely to result in any material loss, or any material impact on our business strategy, results of operations or financial condition.


text: Oversight of Third-Party Service Providers We engage many service providers in connection with our business operations. Some of these service providers play a minor role, while others perform services that are critical to our operations. We have a service provider oversight committee that oversees and facilitates the management of third-party relationships that are integral to our investment management activities. The committee maintains a written policy and other guidance that set forth our approach to managing and providing oversight of those third-party service providers in a manner consistent with the level of risk and complexity of the services provided. Our approach to oversight, which includes considerations regarding selection, initial and ongoing due diligence, contracting, ongoing monitoring and oversight and compliance with applicable regulatory and service level expectations, is tailored to each such service provider based on the scope of the services provided. Security assessments of those service providers may include questionnaires, meetings and onsite visits. We also consider contingency plans in the event a key service provider is not able to provide its respective services.


text: In addition, our internal audit team periodically tests the firm's management and oversight of certain key third-party service providers, including those overseen by the service provider oversight committee, as well as third parties that support financial reporting.


text: Role of Management Management is responsible for the assessment and management of risk, including cybersecurity risk. The Artisan Risk and Integrity Committee facilitates the annual enterprise risk assessment that identifies and prioritizes the Company's key risks, including cybersecurity risk. The information security governance team also reports to members of senior management the results of its annual cybersecurity risk assessment.


text: Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through these established reporting lines and through its oversight of the information security program.


text: Outside of the normal course of business, in the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company's Chief Legal Officer, Chief Administrative Officer, and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident's potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.


text: Role of the Board of Directors Our Board is responsible for overseeing management in the execution of its risk management responsibilities, including with respect to cybersecurity risk management. In addition, an overall review of risk is inherent in the Board's ongoing oversight of our business, long-term strategies and other matters presented to our Board. Our Board exercises its risk oversight responsibilities periodically as part of actions taken and matters reviewed during its meetings and also through the activities of its standing committees. The Board has delegated responsibility for cybersecurity risk oversight to the Audit Committee.


text: The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events and trends impacting the Company. Annually, our CIO and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company's cybersecurity insurance program on an annual basis in connection with the program's renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.


text: Information Security Program Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company's senior leadership team including senior representation from the firm's operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which identifies and prioritizes key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm's operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company's information security awareness training and testing and assessment program.


text: We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training and perform monitoring, testing and surveillance activities relating to compliance with the firm's policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic independent assurance that the firm's internal controls are implemented and operating effectively.


text: With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has over 30 years of information technology experience, and reports to our Chief Information Officer (CIO), who has over 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has almost 40 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.


text: Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct internal monitoring and testing activities, such as phishing simulations.


text: Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on cyber risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.


text: Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through the established reporting lines of the CIO and CISO and through its oversight of the information security program.


text: In the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company's Chief Legal Officer, Chief Administrative Officer, Chief Operating Officer and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident's potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.


text: The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events or trends impacting the Company. Annually, our CIO, Director of Technical Services and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company's cybersecurity insurance program on an annual basis in connection with the program's renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.


text: As a cloud service provider, Sprout Social believes keeping data secure is important and takes steps designed to do so.

companyName: Sprout Social, Inc.

ticker: SPT


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers ("Information Systems and Data").


text: Sprout Social maintains an overarching security program comprised of several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance. Together, these teams help identify, assess and manage the Company's cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and, evaluating threats reported to us through an external bug bounty program.


text: Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors. Depending on the environment, as part of our security program, we have implemented and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register. Also, the security team works with management to identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program including for example professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and other types of third-party service providers for critical business operations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section of our risk factors titled, "Risks Related to the Use of Technology."


text: Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer. They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports. They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors as applicable and on a regular basis.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management based on predefined criteria, including, for example, to our Vice President of Information Technology, Security, and Compliance, General Counsel, and CTO. Senior managers work with the Company's incident response team to help the Company mitigate and remediate certain cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board of Directors, regulators, and law enforcement for certain cybersecurity incidents.


text: Risk Management and Strategy We implement and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers ("Information Systems and Data").


text: Sprout Social maintains an overarching security program comprising several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance. Together, these teams help identify, assess and manage the Company's cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and evaluating threats reported to us through an external bug bounty program.


text: Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors. Depending on the environment, as part of our security program, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register. Also, the security team works with management to help identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program, including, for example, professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the sections of our risk factors titled "Risks Related to the Use of Technology" and "Legal and Regulatory Risks."


text: Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer. They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports. They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) ("Information Systems and Data").

companyName: Fastly, Inc.

ticker: FSLY


text: Our Chief Information Security Officer ("CISO") and security organization help identify, assess, and manage the Company's cybersecurity threats and risks, including through the use of the Company's security risk register. The CISO and security organization identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: (1) identifying vulnerabilities through automated scans, vulnerability assessments, and subscriptions to threat intelligence feeds and notices; (2) assessing security weaknesses identified through internal security reviews, external penetration tests, and reports on our products and services; and (3) assessing the Company's threat landscape given the industry's risk profile, the results of our enterprise risk assessment, and information technology, privacy, and security audits.


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; vulnerability management policy; disaster recovery plans; risk assessments; implementation of security standards and certifications; encryption of data; network security protocols; data segregation; access controls; physical security; asset management, tracking and disposal; systems monitoring, vendor risk management program; employee training; penetration testing; cybersecurity insurance; and a dedicated CISO and security organization.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) the security organization is engaged in all major changes to the Company's environment or products to conduct a risk assessment and identify potential cybersecurity risk; (2) cybersecurity risk is a component of the Company's enterprise risk management program and managed within the Company's risk register; (3) the security organization works with senior leadership across the Company to prioritize our risk management processes and mitigate cybersecurity threats that are most likely to lead to a material impact to our business; and (4) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports the results to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, including legal counsel; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing cloud-based infrastructure, hosting third party applications, and delivering content to customers, as well as data center hosting. We have a formal vendor management program to manage cybersecurity risks associated with our use of these providers. The security organization conducts a risk assessment to determine the criticality of the vendor prior to onboarding. Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our vendor security review process involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example: (1) a vendor security questionnaire; (2) results of audit reports and certifications; and (3) policies and standards detailing the third-party's security program. Based on the results of the vendor security review, a decision is made on whether the third-party can be engaged. We review our most critical providers' audit reports and certifications on an annual basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial review that may warrant re-evaluation. The Company generally engages reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CISO, Mr. Marshall Erwin. Our CISO has experience in the technology and government industries, including through his previous roles as CISO for a major Internet company and an analyst in the US intelligence community. He also served as the cybersecurity and counterterrorism advisor on the Senate Homeland Security and Government Affairs Committee and as the intelligence specialist at the Congressional Research Service.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents, including breaches, to members of management depending on the circumstances, including our CISO, general counsel, and other members of leadership when appropriate. The security incident and response team works with relevant subject matter experts across the organization when necessary to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the board of directors for cybersecurity incidents the Company's disclosure committee determines are material. The disclosure committee, which includes members of management such as our Chief Financial Officer and general counsel, meets quarterly. The CISO acts in an advisory capacity to the Company's disclosure committee on an as-needed basis.


text: Our board of directors receives periodic reports at least annually from our CISO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We have implemented and maintain various cybersecurity processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) ("Information Systems and Data").


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; vulnerability management policy; business continuity plan; risk assessments; implementation of security standards and certifications; encryption of data; network security protocols; data segregation; access controls; physical security; asset management, tracking and disposal; systems monitoring, vendor risk management program; employee training; penetration testing; cybersecurity insurance; and a dedicated CISO and security organization.


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing cloud-based infrastructure, hosting third party applications, and delivering content to customers, as well as data center hosting. We have a formal vendor management program designed to manage cybersecurity risks associated with our use of these providers. The procurement organization conducts an initial risk assessment to determine the criticality of the vendor prior to onboarding. Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our security organization conducts our vendor security review process, which involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example: (1) a vendor security questionnaire; (2) results of audit reports and certifications; and (3) policies and standards detailing the third-party's security program. Based on the results of the vendor security review, a decision is made on whether the third-party can be engaged. We review our most critical providers' audit reports and certifications on a regular basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial review that may warrant re-evaluation. The Company generally attempts to engage reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If we or our third-party providers fail to protect our IT Systems or Confidential Information, and/or experience a data security incident our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function. The board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • regular cybersecurity training programs for employees, management and directors; conducting annual customer data handling training for all our employees; • conducting annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • comparing our processes to standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and Center for Internet Security ("CIS"); • leveraging the NIST cybersecurity framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to model and research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • undertaking regular reviews of our consumer facing policies and statements related to cybersecurity; • proactively informing our customers of substantive changes related to customer data handling; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • maintaining a risk management program for suppliers, vendors, and other third parties, which includes conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident. These approaches vary in maturity across the business and we work to continually improve them.

companyName: Mechanics Bancorp

ticker: MCHB


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third parties, to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Information Technology" included as part of our risk factor disclosures in Item 1A of this Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Board Enterprise Risk Management Committee ("ERMC") is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the ERMC receives an overview from management and the management steering committee of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer and Chief Information Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions. The Board engages external cyber security experts, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities and transformation designed to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer, Chief Information Officer, and our management technology steering committee. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant certifications, including Certified Information Security Manager and Certified Information Systems Security Professional.


text: These members of management and the management technology steering committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Boa rd Enterprise Risk Management Committee ("ERMC") is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the ERMC receives an overview from management and the management steering committee of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, describing the company's ability to mitigate those risks, and discussing such matters with our Chief Information Security Officer and Chief Information Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions. The Board engages external cyber security experts, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities and transformation designed to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer, Chief Information Officer, and our management technology steering committee. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant certifications, including Certified Information Security Manager, Cisco Certified Network Administrator-Security, CompTIA Secure Infrastructure Specialist, and many others.


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Matador Resources Co

ticker: MTDR


text: Managing Material Risks and Integrated Overall Risk Management The Company has integrated cybersecurity into our broader risk management framework. Our risk management team works closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. The Company requires the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, penetration tests and consultation on security enhancements.


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party vendors, service providers and business partners, we have implemented processes to oversee and manage these risks. We conduct initial risk assessments of third-party providers before engagement. These assessments include due diligence reviews of third parties that have access to our networks, confidential information and information systems in order to assess the risks from cybersecurity threats. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Company is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms at the Board and management levels to ensure effective governance in managing risks associated with cybersecurity threats.


text: The Board has oversight of cybersecurity risks and, specifically, the Audit Committee of the Board is charged with the oversight of the Company's guidelines and policies to govern the process by which risk assessment and risk management are undertaken by management, including with respect to cybersecurity risks. Our Board is composed of members with diverse expertise, including risk management, technology and finance, which experience provides them with the skills needed to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Company's IT Committee, which includes senior executives and other members of management, meets regularly to monitor and discuss cybersecurity issues. The Senior Vice President of Information Technology, the Executive Vice President and Chief Accounting Officer ("CAO") and the Co-Chief Operating Officer ("COO") play a pivotal role in informing the Board on cybersecurity risks. They provide comprehensive briefings to the Board on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board, Senior Vice President of Information Technology, CAO and COO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Vice President of Information Technology. With over 35 years of experience in the information technology field, he brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Senior Vice President of Information Technology tests our compliance with standards, remediates known risks and leads our employee training program.


text: Reporting to the Board The Senior Vice President of Information Technology regularly informs the Chief Executive Officer and COO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Monitor Cybersecurity Incidents The Senior Vice President of Information Technology monitors the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Senior Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Senior Vice President of Information Technology is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risks from Cybersecurity Threats As of February 18, 2025, we were not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial standing. However, there can be no assurance that our cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that our efforts will always be successful. For further discussion regarding our cybersecurity risks, see "Risk Factors—General Risk Factors—A cyber incident could occur and result in information theft, data corruption, operational disruption or financial loss."


text: Management's Role Managing Risk The Company's IT Committee, which includes senior executives and other members of management, meets regularly to monitor and discuss cybersecurity issues. The Senior Vice President of Information Technology, the Executive Vice President and Chief Accounting Officer ("CAO") and the Executive Vice President, General Counsel and Head of M&A ("GC") play a pivotal role in informing the Board on cybersecurity risks. They provide comprehensive briefings to the Board on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board, Senior Vice President of Information Technology, CAO and GC maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.


text: Reporting to the Board The Senior Vice President of Information Technology regularly informs the Chief Executive Officer and GC of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company's information security program is managed by its CEO, who is responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: MIAMI BREEZE CAR CARE INC

ticker: MIBE


text: The Company's Board of Director oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually. In the event of a cybersecurity incident determined to be significant, management will notify the Board.


text: Globally, organizations are encountering cybersecurity incidents with growing frequency, and the nature of these threats is becoming more sophisticated and constantly changing. We recognize the importance of developing, implementing and maintaining strong cybersecurity policies and processes to protect our information systems and the confidentiality, integrity, and accessibility and availability of our data.

companyName: FingerMotion, Inc.

ticker: FNGR


text: We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management company wide. These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is monitored and tracked by our Risk and Information Security Committee, as well as through a separate cybersecurity assessment of the China IT platform opearated by our contractually controlled subsidiary, JiuGe Technology, which is required under PRC laws. The lead information technology manager (the "IT Manager")


text: of JiuGe Technology oversees this assessment, which is performed by a third party hired by JiuGe Technology and includes some government oversight, called the Multi-Level Protection Scheme ("MLPS"), the objective of which is to protect data and information systems from security threats. The assessment stratifies IT systems based on the risk and severity of potential security breaches related to the data handled and assesses the effectiveness of the systems in safeguarding against cyber threats. The MLPS includes attributes such as physical security, network security, host security, application security, and data security. The final MLPS report is submitted to the appropriate authorities, and the IT Manager also reviews this report with our CFO.


text: Our CFO and the IT Manager report directly to the Risk and Information Security Committee to review the Company's information security and cybersecurity risks, including but not limited to, the MLPS report. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will prevent every attack or timely detect every incident.


text: Company currently engages third parties in connection with our China cybersecurity annual assessment overseen by our IT Manager, which is driven by risk ranking and assessment. Cybersecurity considerations for operations outside of China, which includes a small proportion of core functions as well as administrative functions, are incorporated in the Company's overall risk assessment and will be considered in the overall SOX/controls management testing going forward when appropriate. Recognizing the importance of cybersecurity from both an operational and disclosure perspective, as well as the complexity and evolving nature of cybersecurity threats, we plans to revisit the link between China cybersecurity testing and FingerMotion's consolidated cybersecurity risk assessment and consider potential enhancements. FingerMotion will consider resource and capital constraints when determining the nature and timing of enhancing our cybersecurity infrastructure.


text: We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third party service providers. We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.


text: We do not currently identify any major cybersecurity threats that have materially affected or are reasonably likely to materially affect us (including our business strategy, results of operations, or financial condition).


text: Our Board of Directors recognizes the importance of information security and mitigating cybersecurity and other data security threats and risks as part of our efforts to protect and maintain the confidentiality and security of our customers, employee and vendor information, as well as non-public information about our Company. Although our full Board of Directors has ultimate responsibility with respect to risk management oversight, the Risk and Information Security Committee of our Board of Directors is charged with and bears primary responsibility for, among other matters, overseeing risks specific to the identification and mitigation of cybersecurity risks.


text: The CFO and CEO play a pivotal role in informing the Risk and Information Security Committee on cybersecurity risks. The CFO will immediately notify the Risk and Information Security Committee and Board of Directors of any cybersecurity incident that is determined to be material. The CFO and CEO deliver focused updates to the Risk and Information Security Committee annually, or more frequently as needed, in response to specific incidents or emerging threats. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: As we progress in the assessment and enhancement of our cybersecurity program, we plan to consider the following areas for enhancement and incorporation into the cybersecurity risk management and governance program in the future:


text: Oversight of Third-Party cybersecurity risk Engaging/ outsourcing Risk management Personnel Monitoring system/ procedures for cybersecurity incidents Reporting to Board of Directors regarding cybersecurity risks and incidents


text: Risk Management Personnel and managing our cybersecurity risks rests with the CEO, Mr. Martin Shen, and the CFO, Mr. Yew Hon Lee, working in close coordination with Mr. ShenJian, the IT Manager of our China Operations. Messrs. Shen and Lee have experience in overseeing IT Functions, including cybersecurity. Mr. ShenJian (the IT Manager) has 24 years of experience in technical work since graduating from Jiaotong University in June 2000 with a major in technology. His expertise is critical in designing, implementing, and executing our cybersecurity strategies.


text: Our IT Manager oversees our governance programs in partnership with our CEO and CFO, oversees testing of our compliance with government standards in China, remediates known risks, and leads our employee training program around cybersecurity.


text: We maintain an information technology and security program appropriate for a company our size, taking into account our operations and risks. The Company recognizes the critical importance of maintaining the trust and confidence of our investors, employees, and vendors. The Company's cybersecurity policies and processes are integrated into the Company's enterprise risk management program and are informed by recognized frameworks established by the National Institute of Standards and Technology, and other applicable industry standards.

companyName: BIOVIE INC.

ticker: BIVI


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein.


text: These processes are managed and monitored by an outside information technology vendor under the supervision of our Chief Financial Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with our outside information technology vendor on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: In the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incidents are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. The Company's Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Board receives updates from the Company's management on cybersecurity risks on at least an annual basis.


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: ESG Inc.

ticker: ESGH


text: We have developed and maintained policies, procedures, and controls to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents. Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management company wide. These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is monitored and tracked by our Risk and Information Security Committee, as well as through a separate cybersecurity assessment of the China IT platform operated by our contractually controlled subsidiary, JiuGe Technology, which is required under PRC laws. The lead information technology manager (the "IT Manager")


text: We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third-party service providers. We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.


text: We do not maintain sensitive financial information or client data within our digital marketing tools or within our information technology platforms. We do not have a large or complex data environment or systems that process sensitive information and as such we maintain an information security and cybersecurity program and a cybersecurity governance framework that is appropriate for an operation of our size. As a digital marketing services provider, we utilize social media and other marketing platforms to build client marketing campaigns and direct marketing services. The vast majority of market data and analytical tools we use are developed and supported by large technology companies and as such rely on their infrastructure to ensure their web-based solutions have the appropriate cybersecurity protections to ensure our digital marketing services are secure. We leverage our proprietary digital analytical tools to develop more target marketing plans for our clients. We utilize PCI compliant merchant processors to ensure that client payments for services and ad spend are securely processed and cybersecurity risks minimized for us and our clients.

companyName: SPECIFICITY, INC.

ticker: SPTY


text: Aptiv has a risk-based cybersecurity program, dedicated to protecting our data, products and information technology systems as well as data belonging to our customers, suppliers and employees. Our ability to keep our business operating effectively depends on the functional and efficient operation of information technology capabilities, both internally and externally. Our capabilities, as well as those of our customers, suppliers, partners and service providers, are crucial to our operations and may contain confidential personal information, sensitive business-related information or intellectual property. These capabilities are also susceptible to interruptions (including those caused by systems failures, cyber-attacks and other natural or man-made incidents or disasters), which may be prolonged or go undetected.

companyName: Aptiv PLC

ticker: APTV


text: Risk Management and Strategy Our cross-functional cybersecurity teams are responsible for addressing both enterprise and product cybersecurity risks. These teams, which are comprised of experts both within the organization and externally, utilize a defensive cybersecurity strategy with multiple layers of cybersecurity controls to protect our data (and data of others in our possession), systems and products.


text: Enterprise and product cybersecurity are incorporated into the Company's overall risk management process. On a monthly basis, the Company's cross-functional Enterprise Risk Management Committee meets to discuss short-term and long-term enterprise-wide risks and necessary action plans to mitigate those risks. The Chief Information Security Officer (the "CISO") regularly presents to the Company's Enterprise Risk Management Committee on key cybersecurity risks, threats and developments, as well as the Company's strategies to mitigate those risks.


text: Enterprise Cybersecurity The Company's Enterprise Cybersecurity team, led by the Chief Information Officer ("CIO"), is responsible for identifying, assessing the severity of, managing and remediating cybersecurity risks to the Company's information technology infrastructure. Risks are identified through vulnerability hunting, infrastructure penetration testing, threat intelligence activities and other processes defined by the infrastructure Governance, Risk and Compliance ("GRC") assessment program utilized by the Company. Furthermore, this team seeks to reduce cybersecurity risks through a number of activities, including annual cybersecurity training for the majority of the Company's employees, phishing tests, compliance assessments, vulnerability and noncompliance remediation and the implementation and maintenance of new cybersecurity technology.


text: Third-party service providers are also utilized by the Enterprise Cybersecurity team to play a supporting role in incident response, threat intelligence, firewall management, vulnerability management and endpoint management and detection.


text: Aptiv is also exposed to cybersecurity risks at third-parties, such as suppliers, customers, service providers and consultants. Third-party risk to the Company is identified through an internal third-party risk management process, which involves analyzing third parties for cybersecurity risk at onboarding and throughout the duration of their relationship with the Company. For third-parties with a high cyber risk, we also utilize external firms to monitor such third-parties for threats and to provide remediation support as needed.


text: Product Cybersecurity The Company's Product Cybersecurity team, led by the Chief Technology Officer (the "CTO"), is responsible for assessing and managing the Company's cybersecurity risk as it relates to Aptiv's product portfolio. Risks are identified through threat intelligence, security testing, including penetration testing, audits and other processes defined by the Company's product cybersecurity GRC program. The processes by which the Product Cybersecurity team manages automotive product security risks have been audited, assessed and certified as compliant with various applicable international regulatory standards by independent third-party auditors.


text: Enterprise Cybersecurity The Company's Enterprise Cybersecurity Security Operation's Center ("SOC"), which is supervised by the CIO, is responsible for identifying, assessing and managing the Company's risks from cybersecurity threats, as well as for responding to cybersecurity incidents. The SOC management team carries a diverse array of applicable cybersecurity and information technology credentials and generally has over twenty years of experience in cybersecurity. When an infrastructure cybersecurity incident occurs, the SOC initiates communications to the appropriate groups within the Company, which may include various members of the Company's management, including the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Operating Officer.


text: Depending on the severity and the nature of the incident, an investigation and impact mitigation protocols may be triggered. External experts or agencies may also be engaged in accordance with the Company's policies and procedures. Upon conclusion of the active investigation of an incident, the SOC is required to identify the cause of the incident, formally report to Company leadership, and initiate changes to protect against a recurrence of the incident, among other procedures.


text: Table top exercises are also held annually and are designed to practice and validate existing incident response plans, as well as to identify the plans' respective strengths and weaknesses. These exercises test the response capabilities of both technical and executive level resources, including key vice presidents, senior company leaders and cross-functional capabilities, such as with the Product Cybersecurity team as well as with the Legal, Privacy and Sales teams.


text: Product Cybersecurity The Product Security Incident Response Team (the "PSIRT"), which is supervised by the CTO, is responsible for responding to product related cybersecurity incidents, which at times involve collaborating with the Enterprise Cybersecurity SOC. The PSIRT team regularly analyzes vulnerabilities reported by threat intelligence and public vulnerability reporting databases and determines whether any of those vulnerabilities are present in the Company's products. Vulnerabilities identified are reviewed by the Vice President of Product Security on a weekly basis with involvement from the CTO and the Company's legal staff as necessary. For all vulnerabilities identified, the PSIRT reviews whether adequate mitigations are already in place. In situations where adequate mitigations are not present, the PSIRT works with the customer to address the concern which may involve adding additional mitigations to the product.


text: Board of Directors Oversight The Company's Board of Directors (the "Board") takes an active role in risk oversight related to cybersecurity matters, primarily through the Audit Committee (the "AC"), which covers enterprise cybersecurity risk, and the Innovation and Technology Committee (the "ITC"), which covers product cybersecurity risk. The Board, individually and through the AC and ITC, regularly reviews relevant information technology and cybersecurity matters and receives periodic updates from information technology and cybersecurity subject matter experts as part of its risk assessment procedures, including analysis of existing and emerging risks, as well as plans and strategies to address those risks. In connection with the Board's risk management oversight responsibility, the entire Board receives a full briefing from management annually on cybersecurity matters, as well as periodic briefings based on specific requests or current events. On a regular basis, the Board also reviews the Company's enterprise risk management program, within which the Company's cybersecurity processes have been integrated, as described above.


text: The Board and AC regularly review the identification and management of enterprise cybersecurity risks and review regular reports from management on system vulnerabilities and security measures in effect to deter or mitigate breaches or hacking activities. The AC also reviews our guidelines and policies with respect to risk assessment and management of our major financial and information technology risk exposures, including enterprise cybersecurity, along with the monitoring and mitigation of identified exposures.


text: The Board and ITC regularly review the identification and management of product cybersecurity risks and review regular reports from management on risks and mitigation strategies in effect to reduce product cybersecurity risk. The ITC also reviews our guidelines and policies with respect to risk assessment and management of product security risks, including both our approach toward a secure systems development lifecycle and product security incident response.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K — "We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation."


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K — "We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation."


text: Cybersecurity Risk Management and Strategy As an externally managed, closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Directors. As such, we rely on the cybersecurity policies and procedures implemented by Prospect Capital Management for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of Prospect Capital Management's cybersecurity program that are relevant to us.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: In accordance with the Prospect Capital Management Information Technology Operations and Procedures, the cross-functional Change Advisory Board ("CAB") governs and oversees the advancement and implementation of policies and procedures to reasonably prevent security incidents. Prospect Capital Management's cybersecurity program also includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Prospect Capital Management's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping to identify areas for continued focus and improvement.


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process. Prospect Capital Management, also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Adviser, or our Administrator are detected.


text: Prospect Capital Management conducts regular phishing tests in which educational materials are provided in each test for those who fail. Prospect Capital Management is implementing security awareness training which will be conducted annually for staff with a high failure rate on the phishing tests.


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business and Structure."


text: Board of Directors Oversight of Cybersecurity Risks Our Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, manage our cybersecurity program. The CCO supervises our oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as our CCO for more than five years and has worked in the financial services industry for more than 20 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business and Structure. "