text: In the case of the discovery of a material incident, we have a third-party under retainer to assist with incident containment and response. The third-party company provides forensic and investigation assistance to our incident response team, as needed.


text: Our CISO provides the state-of-the-information security program to the Board annually and as needed. Also, our CISO and CFO meet with the chairman of the Audit Committee on an as-needed basis for a comprehensive analysis of the material risks in information security.

companyName: AdTheorent Holding Company, Inc.

secItem: Item 1C


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: The Nominating and Corporate Governance Committee of the Board of Directors oversees our cybersecurity programs and cybersecurity team, which are led by our Vice President of Information Technology. At least semi-annual reviews are presented by the Vice President of Information Technology to the Nominating and Corporate Governance Committee demonstrating the cybersecurity practices and controls, mitigation activities, current threat levels, emerging cybersecurity threats, training initiatives, breaches, and results from any penetration testing. In addition, cybersecurity risk management is part of the enterprise risk management program and is reviewed by the Audit Committee at least annually.


text: We have developed an information security policy ensuring that our cybersecurity objectives are established and compatible with our strategic direction. The goal of this policy is to protect our informational assets against reasonably foreseeable internal, external, and accidental threats. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes. Cybersecurity risks related to our business, operations, privacy, and compliance are identified and managed through third party assessments, internal IT audits, governance, risk and compliance reviews.


text: Our policies and approach to cybersecurity include several key elements: • Continuous Monitoring and Defense: We work to protect our environments and products from threats through multi-layered defenses. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Operations Center provides comprehensive, around the clock, cyber threat detection and response capabilities. • Third-Party Software Risk Assessment: We complete security audits on all third-party platforms prior to selection. • Incident Response Plan: Our Incident Response Plan includes the investigation steps and notifications required on all actual and suspected information security incidences • Cybersecurity Training Programs: Our training program is multi-faceted and focused on awareness of new techniques that threat actors utilize both in the corporate environment, as well as their personal lives. Employees undergo regular training on information security best practices, including interactive training to confirm understanding and test employee skills. • Compliance Policy: Mandatory compliance with all cybersecurity programs, including applicable legislative and regulatory requirements. • Third-Party Cybersecurity Plan Assessment: We regularly engage with cybersecurity professionals in reviewing our cybersecurity plan.


text: Risk Management and Strategy Our policies for Cybersecurity and the Safeguarding of Data, Computing Systems and Confidential Client Information policies establish the administrative, technical, physical safeguards and risk mitigations that are implemented to protect the security and confidentiality of all customer information as set forth by the federal regulatory authorities' interagency guidelines mandated by Section 501 of the Gramm-Leach-Bliley Act of 1999 and Part 364, Appendix B of the FDIC Rules and Regulations. Our objective is to emphasize compliance with all information and cybersecurity requirements, including those detailed in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, FFIEC guidance and regulatory agency guidelines, which provide established standards for cybersecurity and the safeguarding customer information and Bank assets.

companyName: River Financial Corp

ticker: RVRF


text: Security Operation and Governance Our Board Chartered, IT Committee oversees implementation, monitoring, and assessment of cybersecurity risks as it relates to the comprehensive Information Systems Security Program (ISSP). In fulfilling its duties, the Committee ensures the development of appropriate policies. The Committee reviews and discusses policies, procedures, and projects with management and after taking into consideration any matters that the IT Committee may deem advisable, the IT Committee annually recommends such policies to the Board of Directors for review and ultimately approval.


text: The Board of Directors receives cybersecurity status updates, training and is encouraged to engage with questions. Frequency of these cybersecurity updates are driven by the events in the world, cyber threats and alerts received by the Bank's ISO, Management or Technology Administrator.


text: Information Technology and Cybersecurity Management Our Information Security Officer (ISO) is responsible for overseeing the Bank's strategies necessary to ensure the confidentiality, integrity, and availability of electronic information by communicating risk to senior administration, creating, and maintaining enforceable policies and procedures, and ensuring compliance with regulatory requirements.


text: Under the oversight and guidance of the IT Committee, the Board of Directors, and the HR Department's ISO Job Description, the ISO is responsible for the following: • Overall security/control of the network and computing systems. • For coordinating the education and training of new and existing employees on Network and Physical Security Policies as outlined in the Information Systems Security Policy. • Management of all detection systems directly connected to the Internet/network and subjected to on-going review of generated reports and risk assessments performed by independent auditors and vulnerability identification software. • Management of the audit function, which will periodically review the information security policies, standards, and procedures and ensure the adequacy of information system controls and compliance. • Provide reports to the IT Committee, Senior Management, and the Board of Directors, as needed or required, concerning the Bank's security posture. • Oversight and management of technology vendors and suppliers.


text: Security Competencies The Information Security Program oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. This level of competency is attained through regulatory examination, scheduled audits, internal risk assessments, security scanning of assets and annual testing. We participate in annual programs including the FFIEC Cybersecurity Assessment Program, which measures and defines our inherent risks and the maturity of our preparedness. This process is overseen by our IT Committee and presented to the Board of Directors.


text: Third-Party Risk Management Any new organization or party that we show interest in establishing a relationship with the Bank will/may require the potential to share or access confidential client information must go through a series of guidelines for qualification prior to releasing information or implementing services. These procedures are in place in order to demonstrate our commitment to safeguarding confidential information while documenting due diligence. New third parties are assessed through our pre- engagement process. The next level of engagement involves a Risk Dependency Assessment, to determine the vendor's Tier Level and a full due-diligence review of policies and independent audits of Critical Vendors as defined in policy.


text: Security Awareness and Education The Bank provides annual, mandatory on-site training for personnel regarding security awareness to equip personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Bank's information security policies, standards, processes, and practices. Staff IT training process is monitored, tracked and reported to the IT Committee and Board of Directors. We have also employed a program of staff phishing tests with staff response evaluated and reported to the IT Committee and the Board of Directors. Incident Response Program (IRP)


text: The Bank's ability to respond to security incidents in a planned and coordinated fashion is important to the success of its information systems security program. The IRP has been developed to provide protections for both the Bank and the Bank's customers and to mitigate the negative effects of cybersecurity events or security breaches on the Bank itself. Program also identifies the Bank's Information Security Response Team (ISIRT) Policy and program procedures which are tested annually.


text: A 24/7 monitored intrusion prevention system, internal intrusion detection system and firewalls to assist in the identification of unauthorized system access is in place. Network and application security reports are reviewed by Bank personnel and used to help in the detection process.


text: Our ISO and Management Committees are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our Information Security Team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our ISO oversees the implementation of and the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the ISIRT Plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: We maintain an information security program and governance framework that is designed to protect our information systems against operational risks related to cybersecurity.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Cybersecurity Risk Management and Strategy We utilize third party cybersecurity consultancy firms to manage and execute our cybersecurity programs. These third party firms are led and supervised by our Chief Technology Officer ("CTO"). Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. On a quarterly basis, our third party cybersecurity consultancy firms perform phish testing and on demand information security training. On a yearly basis, our third party consultancy firms perform, among other trainings and assessments, information security awareness training, internal cybersecurity risk assessments, internal and external penetration tests, key vendor risk assessments, incident response tabletop exercises, written information security and business continuity plan policy gap analysis reviews and revisions as well as incident response plan reviews and revisions. The results of the assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, investors, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "Operational risks, data security breaches, loss or leakage of data and other interruptions of our information technology systems or those of our third-party service providers may disrupt our business, compromise sensitive information related to our business, or prevent us from accessing critical information, which may result in losses or limit our growth." in "Item 1A – Risk Factors" of this Form 10-K.


text: Our Board of Directors and Audit Committee are primarily responsible for overseeing and governing our cybersecurity risk management program. Our Board receives updates on cybersecurity and material cybersecurity risks as needed and at least annually by our Chief Compliance Officer or their designee.


text: Management's Role Our CTO and Chief Compliance Officer have primary responsibility for assessing and managing material cybersecurity risks, including overseeing and identifying cybersecurity risks associated with our use of third party cybersecurity consultancy firms, and are members of management's IT Steering Committee, which consists of management team members and certain employees who drive alignment on technology and security decisions across the Company. The IT Steering Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The IT Steering Committee also considers and makes recommendations to management, the Board of Directors and the Audit Committee on security policies and procedures, security service requirements, and cybersecurity risk mitigation strategies.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Q32 Bio Inc.

ticker: QTTB


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Risk Factors – Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team as part of the Board's continuing education on topics that impact public companies.


text: Our management team, with the assistance of our former Senior Director of Information Technology, now Consultant, and the Company's third-party information technology providers, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our former Senior Director of Information Technology's experience includes over 20 years of experience in information technology management and cybersecurity.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk Management and Strategy Management of cybersecurity risks is an integral part of our overall risk management framework and is essential for safeguarding our business and data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Village Farms International, Inc.

ticker: VFF


text: Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management.


text: We use both external and internal threat intelligence sources to inform our defensive measures, including information from industry vendors and government agencies. We monitor evolving risks and threat events to implement security controls where applicable.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating training programs for our entire workforce. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. • Proactive Reporting and Investigation: As part of our training initiatives, we educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee oversees major enterprise risks, and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by third party consultants. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.


text: Our cybersecurity programs are managed by a team of professionals who monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP), as well as experienced information systems security professionals and information security managers.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize, or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2023 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "We face risks related to cyber security attacks and other incidents."


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks, systems and data. Such processes include physical, procedural, and technical safeguards, employee training and incident simulations. We have the capacity to engage certain external parties, such as consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We also consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: To help manage our material risks from cybersecurity threats and to help protect against, detect, and prepare to respond to cybersecurity incidents, we conduct periodic training for employees involved in our systems and processes that handle sensitive data. We also conduct on-boarding cybersecurity awareness assessments, cybersecurity training for all employees, and regular phishing email simulations for all employees. In addition, we use technology-based tools to help mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: The Audit Committee of our Board of Directors provides oversight of our cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents Our Senior Director of Information Technology's leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help us prepare our employees to address cybersecurity risks. Our Senior Director of Information Technology has over sixteen years of experience in information technology, ten years of experience in information technology for life sciences companies, and a relevant bachelor's degree in information technology. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our bank faces various cybersecurity threats, including unauthorized access, malware, and phishing attacks. These threats could compromise the security of our information systems and the data we store and process. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2023. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: We have established an information security third party risk management program to identify and manage these risks. This program includes regular risk assessments, third party risk provider reviews, and implementation of security measures such as encryption and firewalls, and ongoing monitoring of our systems for potential threats. We also engage with industry consultants to assist with our risk assessments.


text: On a regular basis, the technology steering committee, led by management, receives comprehensive reports summarizing cybersecurity threat monitoring and incident management activities. These reports also include details about remediation efforts to address identified threats and incidents. Additionally, both internal and external assessments of our company's cybersecurity threat monitoring capabilities are shared with the committee. Meeting minutes from these committee sessions are diligently maintained and provided to the Board of Directors.


text: The Board of Directors has responsibility for approving and overseeing management's policies related to information system security and cybersecurity threats and incidents. They also supervise management's overall approach to securing the company's information systems. The Board of Directors delegates the oversight of cybersecurity risk management to the Information Technology Committee of the Board.


text: The Information Technology Committee, in turn, reviews reports on our cybersecurity risk management processes. These reports cover assessments of management's handling of cybersecurity threats and incident management functions. The committee receives periodic updates from the chief information officer, including information on social engineering risks, the effectiveness of cybersecurity training, and results from vulnerability and penetration assessments conducted both internally and by external parties. Audit reports related to information systems and cybersecurity threat monitoring are also part of this reporting process.


text: Risk Management and Strategy Based on the complex and continuously evolving cybersecurity threat landscape, we established, manage and continually enhance an enterprise-wide Information Security Program ("ISP"). The ISP is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The CSF provides guidance for organizations to better manage and reduce cybersecurity risk while helping organizations understand, assess, prioritize, and communicate cybersecurity risks and mitigation. The ISP encompasses critical management components such as risk management, asset management, access controls, cyber awareness training, data security, detection and response, incident response, and business continuity.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: The ISP, which is part of our Enterprise Risk Management Program, is organized in an operating framework that is supported by policies, standards, procedures, and guidelines that establish the information security control environment. Information Security collaborates with additional areas of our Enterprise Risk Management Program to ensure comprehensive risk oversight and reporting. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with its policies, controls, and regulatory requirements.


text: The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets.


text: We have a Third-Party Risk Management ("TPRM") Program that includes the comprehensive evaluation of the cybersecurity risks of prospective and existing third-party relationships. The TPRM Program utilizes a risk-based approach to perform ongoing due diligence reviews of existing third-party relationships and new prospective third parties. Third-party risks are identified and evaluated in coordination with period reviews, although threat intelligence monitoring and sound vendor relationships are leveraged to identify third-party risks as announced. TPRM is a function of our Risk Organization overseen by the Chief Risk Officer ("CRO").


text: We have not experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.


text: We have established a dedicated team to manage and execute the ISP. A Chief Information Security Officer ("CISO") has been appointed as a Senior Vice President of the Company. The CISO leads the strategy and execution of the program while ensuring clear lines of communication with executive management, committees, the Board of Directors, and external stakeholders such as regulators and insurance carriers. The CISO was appointed in August 2023 after serving the Company as a senior officer and technology leader for over 15 years and leads a team of Information Security professionals with diverse security backgrounds including relevant certifications (e.g., CISSP, GSEC, GCTI). As a member of our risk organization, the CISO reports to the CRO, a member of the Executive Management Committee. The CRO joined the Company in February 2023 with over 30 years of progressive risk management experience.


text: The Company Risk Committee ("CRC") serves as the management committee responsible for Information Security oversight and the CISO is a member of the committee. The Risk Oversight Committee ("ROC") is a sub-committee of the Board of Directors (the "Board") and provides direct oversight of Information Security on behalf of the Board. Kim E. VanGelder, the current Chair of the ROC, has served as a member of our Board since 2016, and has held progressive information technology leadership roles at the Eastman Kodak Company, with responsibilities including cybersecurity, global applications, and global technology infrastructure and has served as its Chief Information Officer since 2004.


text: The CISO reports on the status of the ISP including relevant risks, cybersecurity threats, program updates, and program reporting to the CRC and the ROC no less than four times per year. Any material cybersecurity information, including strategic program development, is reported by the CISO to appropriate management and Board representatives to ensure timely awareness and escalation as necessary. Should there be a cybersecurity incident, we have a formal Incident Response plan including escalation processes designed to keep relevant management and committees informed of the mitigation and remediation efforts. The identification of incidents may come through internal monitoring and detection resources, external threat intelligence, third-party risk management efforts or various other event escalation methods. We leverage a Managed Security Services Provider ("MSSP") for supplemental expertise and resources with the management and enhancement of critical threat monitoring solutions. The MSSP also provides industry-leading Security Operations Center services that serve as a critical source for event and incident detection.


text: The Board is actively engaged in the oversight and prudent management of risk, including those relating to cybersecurity and regulatory compliance. A comprehensive program update is delivered to the Board annually by the CISO. The Board annually reviews and approves the ISP and related Information Security policies to ensure alignment with the Company's risk appetite and strategic defense amidst the evolving cybersecurity risk landscape.


text: We design and assess our program guided by a number of well-known industry standards, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001, and Center for Internet Security (CIS) Controls V8. This does not imply that we meet all of these standards, specifications, and requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Vroom, Inc.

ticker: VRM


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Senior Director, Information Security, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy—If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Vroom's Senior Director, Information Security reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Senior Director, Information Security updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our Senior Director, Information Security, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies. Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief People and Culture Officer, and Head of Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. Our Senior Director of Information Security, reports to the VP of Engineering and is the head of the Company's cybersecurity team. The Senior Director of Information Security is responsible for overseeing the Company's security team and related initiatives. He has twenty-five years of experience in the technology industry with over ten years of experience in cybersecurity.


text: Our management team stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: Cybersecurity risk management and strategy As one of the elements of the Company's overall risk management program, the Company's cybersecurity program is focused on the following key areas: • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to among other things: • Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures; • monitor Company networks, servers and endpoints to identify vulnerabilities; • perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness; • obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; • determine and execute mitigation and remediation options and plans; and • ensure ongoing compliance with applicable legal and regulatory requirements, including notification to required individuals and regulatory bodies in the event of the discovery of an information security breach as defined under applicable laws, and timely and adequate disclosure under applicable SEC rules. • Education and Awareness: The Company provides annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company maintains an Information Security Committee (the "ISC") which is a cross-functional governance committee comprised of the AVP- Enterprise Information Technology ("IT AVP"), Chief Financial Officer ("CFO") and Chief Executive Officer ("CEO"). The ISC is the focal point for all information security activities throughout the Company and acts as a liaison on security matters throughout our group of affiliates. The ISC, led by the IT AVP works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC is charged with developing and implementing policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC is responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the ISC to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's IT AVP, on behalf of the ISC, reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Internal Audit function also provides quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.


text: Management's Expertise Our IT AVP also ensures he is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents. In addition, the Company's CEO and IT AVP each hold undergraduate degrees and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including events perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, which includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including network and endpoint monitoring, audits, vulnerability assessments, penetration testing and threat modeling to inform our risk identification and assessment. We also work with trusted third-party information security providers to deploy technologies designed to detect any unusual activities in our systems, attempts to access our systems, and guard against other security threats. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Head of Information Technology ("IT").


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • leverage incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of our processes, we regularly engage with consultants, auditors and other third parties, including having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our incident response plan requires that suspected cybersecurity incidents are promptly reported to our Controller and Chief Human Resource Officer and includes an escalation path to our Chief Executive Officer, executive leadership team, and board of directors.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our contract research organizations or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs, and could subject us to liability," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: Our audit committee receives updates from management of our cybersecurity threat risk management and strategy processes. The audit committee receives information regarding current and emerging material cybersecurity threat risks and our ability to mitigate those risks. Our board of directors receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Head of IT. This individual has over ten years of information technology and cybersecurity work experience. This risk management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. This risk management team member reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters.


text: At this time, our cybersecurity risk management program is undergoing an effort to expand and mature our security controls and documentation. Our ongoing efforts include: • A security risk assessment conducted by an external supplier to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. This assessment is ongoing and will be completed in the third quarter of 2024. • The implementation of revised information security program documentation and policies in the first quarter of 2024, including: o revision and implementation of a revised information security policy; o implementation of a revised incident response plan and policy; o implementation of a third-party risk management program that includes update procedures for third party vendor due diligence; o implementation of additional periodic cybersecurity and awareness training for all of our employees.

companyName: scPharmaceuticals Inc.


text: These efforts complement our current cybersecurity risk management program, which include a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. We also conduct employee cybersecurity awareness training upon onboarding to the company. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President Legal Affairs and Chief Compliance Officer, our Chief Financial Officer and internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Director of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes security program development and review, implementation of security tools and software, security risk identification and remediation, incident identification and remediation, as well as managing enterprise risk. In addition, we rely on third party cyber security consultants and legal counsel to supplement our expertise.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BCP Investment Corp

ticker: BCIC


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Business Manager to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us and our Business Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us and our Business Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Business Manager and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Business Manager and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Business Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Business Manager's management, and our Board and Audit Committee, as appropriate.


text: Oversight of Cybersecurity Risks The board and our audit committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our board and/or our audit committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Business Manager and the measures we, and the Business Manager are taking to mitigate such risks. In addition to such reports and updates, our board and/or our audit committee receive updates from management as to changes to our and the Business Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the board or audit committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, General Risks" for more information regarding cybersecurity risks.


text: Risk Management and Strategy Talkspace recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats as a vital component to the success of our business. We have established policies and processes for assessing, identifying, and managing the material risk from cybersecurity threats which may include, among other things, operational risks; fraud; extortion; harm to our business, employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: Talkspace, Inc.

ticker: TALK


text: We routinely assess material risks from cybersecurity threats, which include unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing therein. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. We have adopted the HITRUST CSF Assurance Program for Cloud assessment to inform this risk assessment process. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.


text: As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk: • Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • Running simulated cybersecurity drills, which are performed both in-house and by the third-party service provider, including vulnerability scanning, penetration testing and disaster recovery exercises; • background checks prior to hire; • encryption of data at rest and in transit; • logging and event monitoring; • threat detection to monitor for malicious activity and anomalous behavior; • malware protection and restricting connections to malicious websites; • data loss protection mechanisms; • third party penetration testing; • cybersecurity risk assessments of our third-party vendors; • reviews by internal and external audit of the effectiveness of information security-related internal controls; • closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan, as effected by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.


text: We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide system-wide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers and we continually monitor cybersecurity threat risks identified through such diligence.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, and more frequently as relevant, the Audit Committee receives an overview from management covering topics such as security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters. Management or the Audit Committee will provide a comprehensive update to the Board on cybersecurity threats and risk mitigation generally at least annually, and more frequently as relevant.


text: The Company's information security and cybersecurity program is managed by our Chief Information Security Officer (CISO) and our Chief Technology Officer (CTO). The CISO and the Senior Director Information Security are responsible for our overall network security and assessing and managing cybersecurity risks and threats. The CISO has over 20 years of information security, privacy, auditing and compliance experience and holds numerous certifications. The Senior Director of Information Security has over 15 years of experience in information security, and holds numerous certifications. The CTO has over 20 years of experience and has been a leader of our Company's information systems and technological advancements for the past nine (9) years. The SVP of Engineering has over 20 years of experience in IT and has specialized knowledge in systems and network infrastructure. The Director of SRE and Security has eight (8) years of experience and has principal responsibility for our network operations and system administration.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to ensure the security of our information systems and networks and the confidentiality, availability, and integrity of our data.

companyName: Turtle Beach Corp

ticker: TBCH


text: Risk management and strategy Turtle Beach uses a risk-based approach to cybersecurity, utilizing industry-standard frameworks and methodologies to assess and manage risks. The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes have been integrated into the Company's overall risk management processes and include an incident response plan to assess and remediate cybersecurity attacks.


text: The incident response plan provides guidance in identifying, assessing, investigating, remediating, and reporting any confirmed or suspected: (i) compromise of physical, network or system security; (ii) unauthorized access or acquisition of personal information or proprietary information; or (iii) material noncompliance with Company information privacy and security policies and procedures. The plan and associated processes have flexibility to ensure a tailored response based on the circumstances of the incident.


text: From time to time, the Company engages third party experts to assess the Company's cybersecurity controls and processes. For example, in 2021, the Company engaged an information security consultant to conduct and external, design-focused assessment using the National Institute of Standards and Technology framework to evaluate the Company's cybersecurity controls. The Company's management used the assessment to assist them in evaluating the Company's cybersecurity controls, and its Company's policies and procedures to further align them with industry standards.


text: The Company also has processes to identify and oversee cybersecurity threats associated with its use of third-party service providers. These processes include diligence of third-party cybersecurity risk through SOC-2 audits and use of independent vendors who provide cybersecurity ratings. In addition, the Company maintains an insurance policy which specifically provides coverage for qualifying information security breaches.


text: The Company has not experienced a material information security breach in the last five years, nor has it incurred any expenses or penalties or paid any settlements related thereto. The Company is not currently facing any cybersecurity threats reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.


text: Cybersecurity is an important part of the Board's risk oversight. Although the full Board retains responsibility for cybersecurity oversight, the Audit Committee of the Board (the "Audit Committee") has authority to immediately assess and manage a cybersecurity incident if one were to occur. The Company's senior management briefs the Audit Committee and the Board periodically on cybersecurity matters and would promptly brief the Audit Committee if a cybersecurity incident occurred.


text: The Company's management has day-to-day responsibility for managing cybersecurity risks. The management team includes our Chief Financial Officer, who has cybersecurity expertise through prior leadership positions in networking and software businesses, and our Senior Director of Information Technology, who has formal data security training and certifications. In addition to using industry-standard tools to monitor cybersecurity risks, management receives direct reporting of cybersecurity threats from our employees, who are trained annually on cyber security risks and reporting.


text: Risk Management and Strategy We continue to make significant investments in our information technology systems pursuant to our operations. We believe that these investments, including additional technology changes to implement our strategic plan, are essential to enhance our overall customer experience, to support our compliance, internal controls and efficiency initiatives, to expand our capabilities to offer new products, and to provide scale for future growth and acquisitions. Our program ensures that we operate with greater efficiency.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: The Company is actively engaged in identifying and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. The Company has an enterprise-wide Information Security Program ("Security Program"), which is designed to protect the confidentiality, integrity and availability of customer non-public information. The Security Program was also designed to protect our operations and assets through a continuous and comprehensive cybersecurity detection, protection and prevention program. This program includes an information security governance structure and related policies and procedures, security controls, protocols governing data and systems, monitoring processes, and processes to ensure that the information security programs of third-party service providers are adequate. Our Security Program also continuously promotes cybersecurity awareness and culture across the organization.


text: The Company also has a business continuity/disaster recovery plan (the "BCP"), which it actively manages to prepare for any business continuity challenges it may face. Our BCP provides for the resiliency and recovery of our operations and services to our customers. The plan is supported and complemented by a robust business continuity governance framework, a life safety program as well as an enterprise-wide annual exercise and training to keep the program and strategies effective, scalable and understood by all employees. We believe both the Security Program and BCP adhere to industry best practices and are subject to periodic testing and independent audits.


text: Cybersecurity Risk In 2018, the United States Securities and Exchange Commission (the "SEC") published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal laws and regulations. If we fail to observe this regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments where our customers are located.


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us.


text: The risks from cybersecurity threats are monitored and managed by the Company's information systems team members who have relevant expertise with such potential threats, and who operate in collaboration with other Company functions. The Company's Audit Committee is responsible for overseeing cybersecurity risk and are informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our vendors, partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach. The Company's cybersecurity standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: Risk Management and Strategy As one of the critical elements of the Company's overall risk management approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading below titled, "Governance", the Board's oversight of cybersecurity risk management is supported by the audit committee's regular interactions with the Company's Head of Information Technology, and other members of management or a subcommittee thereof. • Collaborative Approach: The Company has developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity managed detection and response. • Incident Response and Recovery Planning: The Company has developed a comprehensive incident response and recovery plan that addresses the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company has various controls relating to cybersecurity threats originating from third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with tools to address cybersecurity threats, and to communicate the Company's information technology policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures. The results of such assessments are reported to the audit committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments.


text: The audit committee of the Board oversees the Company's risk management program, including the management of risks arising from cybersecurity threats. The audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. When necessary, the Board receives prompt and timely information regarding any material cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a semi-annual basis, the audit committee of the Board discusses the Company's approach to cybersecurity risk management with the Company's Head of Information Technology.


text: The Company's Head of Information Technology, in coordination with the Board and audit committee, works collaboratively across the Company to implement and execute a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery approach. To facilitate the success of the Company's cybersecurity risk management program, the Company's Head of Information Technology and his team monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and, when necessary, report such threats and incidents to the Board. The Head of Information Technology has served in various roles in information technology and information security for over 20 years, including serving as the Head of Information Technology of another clinical-stage biopharmaceutical company. The Head of Information Technology holds undergraduate and graduate degrees in mathematics and computer information systems, respectively.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We also have a process for newly-hired employees to participate in security awareness training, and we conduct periodic phishing email simulations. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our Head of Information Technology ("IT"), with the support of our third-party information technology service providers and a team of IT professionals, is responsible for the strategic leadership and day-to-day management of our cybersecurity program. The individual serving as Head of IT has more than twenty-five years of experience in information technology and information security.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our Head of IT provides quarterly updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, and provides the Audit Committee with status updates on various projects intended to enhance the overall cybersecurity posture of the Company, as applicable.


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including but not limited to cybersecurity assessors, consultants, and auditors to evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaborations with these third-parties includes regular audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all third-party providers before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Executive Director of IT, who oversees the Company's cybersecurity function. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Company's Board of Directors (the "Board"). This ensures that The Board has oversight and effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight The Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Executive Director of IT or the Chief Legal Officer as described below in "Management's Role Managing Risk."


text: Management's Role Managing Risk The Executive Director of IT and the Chief Legal Officer ("CLO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Executive Director of IT and the Associate Director of IT Infrastructure and Security. Our IT Leadership team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Executive Director of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Executive Director of IT, the Associate Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Executive Director of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Executive Director of IT, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues. See Item 1A "Risk Factors" – "Risks Related to Business Operations and Industry."


text: Management's Role Managing Risk Aveanna's cybersecurity program and related policies are managed by a dedicated Assistant Vice President ("AVP") of Cybersecurity who reports to our Chief Information Officer ("CIO"). The AVP of Cybersecurity and his team is responsible for assessing, identifying and managing enterprise-wide cybersecurity needs. The AVP of Cybersecurity and his team monitor breach attempts and other cyber-related incidents, both directed at the Company and those impacting other industry participants, to identify new and emerging risks to be added to our Vulnerability Management Framework, which is discussed below.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: The AVP of Cybersecurity works directly with the CIO to create and maintain cyber policies, standards, and processes that support the Company's overall strategy and the current cyber environment. We believe our cybersecurity program and policies are aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The AVP of Cybersecurity and CIO are experienced technology and cybersecurity professionals, with over 10 and 20 years of experience in information security and technology, respectively. The AVP of Cybersecurity leads periodic meetings of our chartered Cybersecurity Steering Committee, which cover key cyber threats, policy changes, and project updates. The Cybersecurity Steering Committee includes our CIO, other executive-level leaders, and key members of management. Further, the Cybersecurity Steering Committee engages an external expert to prepare a formalized evaluation on the design of, and adherence to, the Company's current cybersecurity policies.


text: Board of Directors Oversight The Audit Committee of the Board of Directors is tasked with providing oversight related to cybersecurity topics. At least quarterly, the Audit Committee receives a report of any cybersecurity incidents and other key monitoring metrics from a representative of the Cybersecurity Steering Committee. For each incident, the Audit Committee is briefed on the nature of the incident, points of vulnerability, scope of the incident, and the Company's response. The Audit Committee will then communicate cyber-related issues with the Board as needed. Our Board is currently reviewing our existing cybersecurity program and related policies, including, among other things, the Board's role within our cybersecurity risk management infrastructure.