text: Chief Information Officer ("CIO") has extensive experience in managing complex IT environments and mitigating cybersecurity risks. The CIO is responsible for overseeing cybersecurity and technology vendors, assessing risks in these areas, and ensuring the effective execution of the information security program.


text: Vice President of Network Security is a Certified Information System Security Professional (CISSP) with over 10 years of experience in managing IT and cybersecurity operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS

secItem: Item 1C


text: The cybersecurity team has several other members with expertise in network security, technology, and administration. The cybersecurity team meets regularly to review and assess the Company's cybersecurity posture, identify potential threats, and implement appropriate measures to mitigate risks. The committee also collaborates with external cybersecurity experts to stay informed about the latest threats and best practices in the industry.


text: Risk Management and Strategy Our policies for Cybersecurity and the Safeguarding of Data, Computing Systems and Confidential Client Information policies establish the administrative, technical, physical safeguards and risk mitigations which are implemented to protect the security and confidentiality of all customer information as set forth by the federal regulatory authorities' interagency guidelines mandated by Section 501 of the Gramm-Leach-Bliley Act of 1999 and Part 364, Appendix B of the FDIC Rules and Regulations. Our objective is to emphasize compliance with all information and cybersecurity requirements, including those detailed in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, FFIEC guidance and regulatory agency guidelines which provide established standards for cybersecurity and the safeguarding customer information and Bank assets.

companyName: River Financial Corp

ticker: RVRF


text: Security Operation and Governance Our Board Chartered, IT Committee oversees implementation, monitoring, and assessment of cybersecurity risks as it relates to the comprehensive Information Systems Security Program (ISSP). In fulfilling its duties, the Committee ensures the development of appropriate policies. The Committee reviews and discusses policies, procedures, and projects with management and after taking into consideration any matters that the Committee may deem advisable, the Committee annually recommends such policies to the Board of Directors for review and ultimately approval.


text: The Board of Directors receives cybersecurity status updates, training and is encouraged to engage with questions. Frequency of these cybersecurity updates are driven by the events in the world, cyber threats, and alerts received by the Bank's ISO, Management, or Technology Administrator.


text: Security Competencies The Information Security Program oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. This level of competency is attained through regulatory examination, scheduled audits, internal risk assessments, security scanning of assets, and annual testing. We participate in annual programs including the FFIEC Cybersecurity Assessment Program which measures and defines our inherent risks and the maturity of our preparedness. This process is overseen by our IT Committee and presented to the Board of Directors.


text: Third-Party Risk Management Any new organization or party that we show interest in establishing a relationship with the Bank will/may require the potential to share or access confidential client information must go through a series of guidelines for qualification prior to releasing information or implementing services. These procedures are in place in order to demonstrate our commitment to safeguarding confidential information while documenting due diligence. New third parties are assessed through our pre- engage ment process. The next level of engagement involves a Risk Dependency Assessment, to determine the vendor's Tier Level and a full due-diligence review of policies and independent audits of Critical Vendors as defined in policy.


text: Security Awareness and Education The Bank provides annual, mandatory, onsite training for personnel regarding security awareness to equip personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Bank's information security policies, standards, processes, and practices. Staff IT training process is monitored, tracked and reported to the IT Committee and Board of Directors. We have also employed a program of staff phishing tests with staff response evaluated and reported to the IT Committee and the Board of Directors. Incident Response Program (IRP)


text: The Bank's ability to respond to security incidents in a planned and coordinated fashion is important to the success of its information systems security program. The IRP has been developed to provide protections for both the Bank and the Bank's customers and to mitigate the negative effects of cybersecurity events or security breaches on the Bank itself. Program also identifies the Bank's Information Security Incident Response Team (ISIRT) Policy and program procedures which are tested annually.


text: A 24/7 monitored intrusion prevention system, internal intrusion detection system, and firewalls to assist in the identification of unauthorized system access is in place. Network and application security reports are reviewed by Bank personnel and used to help in the detection process.


text: Our ISO and Management Committees are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our Information Security Team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our ISO oversees the implementation of and the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the Information Security Incident Response Plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: S enior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 18 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.


text: Risk Management and Strategy We have certain processes for assessing, identifying and managing cybersecurity risks, which are included in our overall risk management program and designed to protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Cybersecurity risks are also periodically reevaluated in additional detail based on our experience and on external information regarding emerging risks. To protect our information systems from cybersecurity threats, we use various security tools, tracking procedures and investigational procedures to identify, investigate, and resolve potential security incidents in a timely manner. We also engage third-party vendors to assist with security management, incident detection and response.

companyName: Mural Oncology plc


text: Our cybersecurity function, which comprises, in part, our Interim Chief Financial Officer and third-party service providers (including our managed security services provider, or MSSP), helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats (including third party threat assessments), using external intelligence feeds, coordinating with law enforcement regarding certain threats, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, network security controls, systems monitoring, and asset management, tracking, and disposal.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Interim Chief Financial Officer, who oversees outsourced IT (including cybersecurity).


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Interim Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Interim Chief Financial Officer. Our Interim Chief Financial Officer and others work with our incident response team (including our MSSP) to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting certain cyber incidents to the audit committee.


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our guests, business partners, associates and other stakeholders, and the processes implemented to address the risks related to cybersecurity threats are an important part of our overall risk management efforts. More specifically, we seek to address cybersecurity risks by focusing on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program focuses on the following key areas: • Governance/Board-Level Oversight: Our Audit Committee is briefed on cybersecurity risks as a standing agenda item at each regularly scheduled quarterly meeting. The Chief Information Officer ("CIO") reports quarterly to the Audit Committee and such report typically addresses an overall assessment of our compliance with our cybersecurity policies and includes topics such as risk management and control decisions, updates on our cybersecurity roadmap and self-assessment, training results, security threats, incidents (if any) and responses, and recommendations for changes and updates to our policies and procedures. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, 24x7 monitoring by a third party security operations center, and antimalware functionality and access controls, which are periodically evaluated through vulnerability assessments and cybersecurity threat intelligence. • Business Continuity and Disaster Recovery: We have established and maintain comprehensive business continuity, incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for our associates regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our information security policies, standards, processes and practices.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Chief Technology Officer, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Vroom, Inc.

ticker: VRM


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy— If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences. "


text: The Chief Technology Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. She has over twenty-five years of experience in the technology industry. In addition, the Vice President of Engineering has involvement in managing cybersecurity risk and has over 30 years of experience in the technology industry.


text: Vroom's Chief Technology Officer reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Chief Technology Officer updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.


text: Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, VP of Human Resources, and Chief Technology Officer, stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, processes, and practices, which are integrated into the Company's overall risk management process. To help protect the Company's information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Risks from Cybersecurity Threats To date, the Company believes that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have no t materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Refer to the risk factor captioned "A failure in the Company's operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company's business, its reputation, and / or cause losses which would have a material effect on the Company's business operations and financial results" in Part I, Item 1A. "Risk Factors" for additional information on cybersecurity risks that could adversely impact the Company's business, results of operations or financial condition.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the CISO. The CISO, has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company's compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.


text: Monitoring Cybersecurity Incidents The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan ("CIRP") supported by a cross-functional cyber incident response team ("CIRT"). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompass detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology and cybersecurity functions. By fully outsourcing our IT environment and placing it within expert third-party software-as-a-service, human resource, and clinical providers our primary means of avoiding cyber risk is not having sensitive data within our enterprise. All third parties are managed by our team, and we review our vendors to ensure that they have risk management procedures in place, including physical, procedural, and technical safeguards (such as: response plans, regular tests on the systems, third-party auditing, incident simulations and routine review of appropriate policies and procedures to identify risks and refine security practices). Our Senior Director of IT Operations and Security is responsible for vendor management regarding our vendor risk experience and reports directly to our Chief Financial Officer. We track security risk as a company and review it annually at the senior management level.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. As needed, the audit committee of our board of directors (the "Board") provides oversight over cybersecurity risk and provides updates to the Board regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Cybersecurity Risk Management and Strategy We recognize the importance of maintaining the safety and security of our critical systems, information, products, services, and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Cybersecurity risks are addressed as a component of our overall enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and to mitigate those cybersecurity threats that are more likely to lead to a material impact on our business. Features of our cybersecurity risk management program include: • Periodic risk assessments designed to help identify cybersecurity risks that could materially impact our Information Systems and Data; • A security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, information security controls, and response to any cybersecurity incident; • A cyber and data security incident response plan that establishes policies and procedures for identifying, managing, and recovering from a cybersecurity incident, including escalating tiers of notification depending on an incident's nature and severity; • Periodic tabletop exercises with management and other employees to discuss, prepare for, and simulate our responses to potential cybersecurity incidents; • The use of third-party service providers, as appropriate, to assess, test, and assist with aspects of our information security controls; • The use of a third-party risk management process for our service providers, suppliers, and partners; • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • Cybersecurity policies and procedures, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices; and • Required annual privacy and cybersecurity training (including spear phishing and other awareness exercises) for employees.


text: Because the techniques used to obtain unauthorized access, disable/degrade service, or sabotage systems change frequently, we have invested and continue to invest in the security and resiliency of our systems and networks to help protect our Information Systems and Data. For a discussion of cybersecurity-related risks that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity, and Intellectual Property" section of this Report.


text: Cybersecurity Governance Our Board is responsible for overseeing our overall enterprise risk management program, and each of its committees assists in this risk oversight role. Our Board has delegated the monitoring and oversight of risks relating to data privacy, technology, information security, and cybersecurity to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to the management of these risks. Our Board also receives periodic briefings from management regarding our cybersecurity risk management program, including presentations on cybersecurity topics from our CTO, our information security team, and other third-party experts.


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. It receives regular updates from our CTO and other members of management on cybersecurity trends and developments, the cybersecurity risks that are most relevant to our business, and our cybersecurity strategy, as well as other updates, as appropriate, regarding certain cybersecurity incidents.


text: A cross-functional management team, including members of our information security, technical infrastructure, engineering, and legal departments, is responsible for identifying, assessing, and managing the risks from cybersecurity threats that are relevant to our business, as well as managing our response to any cybersecurity incident (and, depending on an incident's potential nature and severity, reporting it to our Audit Committee and considering with management whether public disclosure is appropriate or required). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers, and communicates our cybersecurity risk management processes to management, our Board, and our Audit Committee. This team reports to our CTO, who has more than 15 years of experience in the technology sector, and possesses nearly 60 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics, and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager and Certified Information Systems Auditor) and ISC2 (Certified Information Systems Security Professional). This team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats which prioritizes detection and analysis of and response to known, anticipated, or unexpected threats, effective management of security risks and resilience against cyber incidents. The Manager's cybersecurity program is aligned to the National Institute of Standards of Technology (NIST) Cybersecurity Framework. Our Manager's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risk from cybersecurity. Our Manager has implemented and continues to implement procedures to address internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations and information of our shareholders and other third parties who entrust us with their sensitive information.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of our Manager. Our Manager also has annual certification requirements for employees, including employees who provide services to us pursuant to our Management Agreement with respect to certain policies supporting the cybersecurity program including Chicago Atlantic's Information Security and Electronic Communications policy, Data Protection Policy and Privacy Policy. Our Manager undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Manager and our critical third-party vendors and other partners. Our Manager also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: Material Impact of Risks from Cybersecurity Threats As of the date of this report, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Governance and Oversight of Cybersecurity Risks Our cybersecurity program is managed by IT Manager and our IT consultant, which together, are responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by our Manager's IT Manager who has a bachelor's degree in Information Systems from Xavier University and over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures for financial services companies.


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cybersecurity threat landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: We employ and manage various third-party partnerships to help protect us from cybersecurity threats. These organizations provide services such as penetration testing, security assessments, as well as 24 hours per day monitoring, alerting and response, including incident responses, all of which adhere to our overall ERM framework. Our partners evaluate and rank our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats. Our digital infrastructure undergoes both internal and external audits as part of our Sarbanes-Oxley audit process and is designed to address the requirements of applicable information security standards and an evolving cyber landscape.


text: Board Oversight of Risks from Cybersecurity Threats Our Board of Directors has delegated to the Audit Committee oversight of risks from cybersecurity threats. The management team provides quarterly reports to the Audit Committee which cover cybersecurity and other information technology-related risks, based on our ERM framework. These quarterly updates keep the Audit Committee apprised of our ongoing cybersecurity enhancements and any emerging global threats. The Audit Committee keeps the remaining Board of Directors apprised of material risks from cybersecurity threats. The Board and management have made cybersecurity education and training a part of our overall corporate objectives, setting the tone for the organization about the importance of cybersecurity.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Technology and Security team is responsible for the management, maintenance, monitoring and response of our critical internal digital assets. This team is led by our Senior Director of Global Information Technology and Security, who has 25 years of cyber and Enterprise IT management experience. This position monitors current cyber risk trends, engages with third party cyber security experts, and meets with the Infrastructure and Security team regularly to stay apprised of internal cyber risks.


text: Our internal cybersecurity testing and reporting processes allow us to rank our overall risk on a periodic basis so as to enable us to identify and respond to internal risk trends. Further, we follow escalation procedures to support the communication of cyber-related events.


text: As of the date of this report, we do not believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition for the reporting period covered by this report. For information regarding cybersecurity risks, see our discussion above in Item 1A. Risk Factors - Risks Related to Our Business - Our internal computer systems, or those of our third party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our commercial, research and development and other programs.


text: Cyber Risk Management and Strategy We have adopted processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cybersecurity threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and periodic review of our procedures in an effort to identify risks and refine our practices. To support our internal resources, we leverage external tools and resources, including a managed service provider that provides ongoing support for the protection of our information technology infrastructure.

companyName: Upstream Bio, Inc.

ticker: UPB


text: We have an employee security awareness program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions. As part of this employee training program, we periodically conduct phishing tests. We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems including, as appropriate, through the inclusion of cybersecurity requirements in our contracts.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors–Risks related to our dependence on third parties–Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business."


text: Governance Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and we have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our Senior Manager of Information Technology reports to our Chief Financial and Operating Officer and oversees the day-to-day implementation and management of our cybersecurity program. Our Senior Manager of Information Technology has approximately 20 years of experience in information technology and regularly reports to executive management, the company's disclosure committee, and the Audit Committee on cyber matters, as appropriate.


text: Risk Management and Strategy Peapack Private Bank & Trust's risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology, our expansion of Internet and mobile banking tools, an increased level of employees working remotely and the potential of cyber threats. Peapack Private's Information Security Officer is primarily responsible for cybersecurity and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Information Technology Steering Committee and Peapack Private's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse Peapack Private systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage information from certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Bank's Information Security Officer and Chief Information Officer, who reports directly to the Chief Operating Officer, along with other key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of the Bank's efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and the Bank's supply chain. We also actively monitor our email gateways for malicious phishing e-mail campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to the Bank's information security program, to assess their design and operating effectiveness and make recommendations to strengthen the Bank's risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Bank's Information Technology Steering Committee as well as the board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of the Bank's organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. The Bank's internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition.


text: Peapack Private's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.


text: The Bank's board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology and cyber-related business impact. This committee provides oversight and governance of the technology program and the information security program. The committee is chaired by managers within the enterprise information technology department and include the Chief Information Officer, Chief Technology Officer, and Information Security Officer. The committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Bank's board of directors.


text: The Bank's board of directors are responsible for overseeing Peapack Private's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Bank's Information Security Officer, Chief Information Officer, and Chief Technology Officer provide reports to the Bank's board of directors regarding the information security program, technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security program, technology budgets, and strategies annually.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management team. We have established a cybersecurity governance framework that encompasses policies, procedures, and controls designed to support cybersecurity risk management practices. Our Senior Information Systems Administrator is responsible for assessing and managing material risks from cybersecurity threats. This position reports directly to our Senior Vice President of Business Transformation. In addition, we have retained Virtual Chief Information Security Officer services to support our cybersecurity risk management and governance practices. Such individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our Managed Security Services Provider and our Board of Directors on any appropriate items. Our Board of Directors oversees the cybersecurity program and receives program metrics as well as information related to identified cyber-related risks when meeting with the company's management.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas:collaboration, risk assessment, technical safeguards, incident response and recovery planning, third-party risk management, education and awareness, and governance.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, and make recommendations to improve processes. Our board of directors and members of management, as appropriate, are presented with any updates we make due to our risk assessment.


text: Our board of directors delegated to our audit committee oversight of cybersecurity and other information technology ("IT") risks. Our audit committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the audit committee as necessary regarding any significant cybersecurity incidents.


text: Our IT team, led by our Chief Information Officer, is responsible for assessing and managing our significant risks from cybersecurity threats and has primary responsibility for our risk management process and overall cybersecurity risk management program. This team includes in-house personnel devoted to these efforts, as well as a third-party IT firm, and they collectively have extensive knowledge of the technologies and applications we have adopted to address our cybersecurity risk.


text: In addition, our Chief Information Officer supports our company by staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.


text: The ISP, which is part of our Enterprise Risk Management Program, is organized in an operating framework that is supported by policies, standards, procedures, and guidelines that establish the information security control environment. The Information Security team collaborates with additional areas of our Enterprise Risk Management Program to ensure comprehensive risk oversight and reporting. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with its policies, controls, and regulatory requirements.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets. Recent investments have ensured the use of innovative technology and services with best-in-class providers.


text: We have a Third-Party Risk Management ("TPRM") Program that includes the comprehensive evaluation of the cybersecurity risks of prospective and existing third-party relationships. The TPRM Program utilizes a risk-based approach to perform third-party onboarding and ongoing due diligence reviews of existing third-party relationships. Third-party risks are identified and evaluated in coordination with period reviews, although threat intelligence monitoring and sound vendor relationships are leveraged to identify third-party risks as announced. TPRM is a function of our Risk Organization overseen by our Chief Risk Officer ("CRO").


text: We have established a dedicated team to manage and execute the ISP. A Chief Information Security Officer ("CISO") has been appointed as a Senior Vice President of the Company. The CISO leads the strategy and execution of the program while ensuring clear lines of communication with executive management, committees, the Board of Directors, and external stakeholders such as regulators and insurance carriers. Our present CISO, Scott Bader, was appointed in August 2023 after serving the Company as a senior officer and technology leader for over 15 years and leads a team of Information Security professionals with diverse security backgrounds including relevant certifications (e.g., CISSP, GSEC, GCTI). As a member of our risk organization, the CISO reports to the CRO, who is a member of the Executive Management Committee. Our CRO, Gary Pacos, joined the Company in February 2023 with over 30 years of progressive risk management experience.


text: The Company Risk Committee ("CRC") serves as the management committee responsible for Information Security oversight and the CISO is a member of the committee. The Risk Oversight Committee ("ROC") is a sub-committee of the Board of Directors (the "Board") and provides direct oversight of Information Security on behalf of the Board. Director Kim E. VanGelder, the current Chair of the ROC, has served as a member of our Board since 2016, and has held progressive information technology leadership roles at the Eastman Kodak Company, with responsibilities including cybersecurity, global applications, and global technology infrastructure, and has served as its Chief Information Officer since 2004.


text: Key elements of our cybersecurity risk management program include: • overall risk assessment; • a technology team leveraging a third-party Security Operations Center (SOC) partner to monitor, manage and respond to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and regular phishing campaigns; • a cybersecurity incident response policy that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: CARGO Therapeutics, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks related to our business—Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: Our management team, including the Vice President of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats. The Vice President of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of experience leading technology management functions within biotech companies as well as interacting with the Board. Specifically, the Vice President of IT has been leading IT, compliance and security in various biotech companies including presenting and delivering cybersecurity roadmaps and risk management to executive teams and boards.


text: Our Chief Financial Officer provides briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In addition, our Chief Financial Officer provides briefings of any significant cybersecurity matters to the Board of Directors as well as an annual update of cybersecurity risks and activities.

companyName: Allakos Inc.


text: Our organization's cybersecurity program is informed by industry standards and industry-recognized practices, such as the NIST Cybersecurity Framework, ISO 27001, and CIS Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This helps us align with the specific requirements of diverse regulatory environments and industry benchmarks without compromising on security or efficiency.

companyName: StandardAero, Inc.

ticker: SARO


text: Key elements of our cybersecurity risk management program include: • Risk Governance – A structured set of cybersecurity policies, standards and guidelines, including incident response and disaster recovery procedures, to help the organization meet compliance and business goals. We update policies periodically based on evolving regulatory and threat landscapes. • Risk Identification – We leverage a set of tools designed to identify cyber security risks and manage vulnerabilities according to impact and likelihood. • Risk assessments - Designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • Risk Response - A security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents. • External Service Providers - We utilize external service providers, where we consider appropriate, to assess, test or otherwise assist with aspects of our security controls. • Risk Monitoring and Review – Monitoring of threats through threat intelligence feeds and security tools, the use of a Security Information and Event Management (SIEM) system for real-time detection, and periodic reassessments of risks as technology and threat landscapes evolve. • Training and Awareness – A dynamic role-based cybersecurity awareness training of our employees, incident response personnel, and senior management; • Incident Management – Protocols that are designed to respond to cybersecurity incidents, including procedures for response, containment, eradication, and recovery. • Integration with Business Strategy – Cybersecurity risk considerations are factored into key business decisions and strategies, and cybersecurity initiatives are aligned with organizational risk appetite and priorities.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") the oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our VP of Information Security, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The management team, led by one of our Vice Presidents for Information Security and our SVP of Information Technology is primarily responsible for assessing and managing risks from cybersecurity threats.


text: • Our VP of Information Security is responsible for leading the organization's information security program, strategy and ensuring the protection of digital assets. He has over 20 years of information technology experience, including leadership experience managing global information security, IT infrastructure and networking, experience designing comprehensive cybersecurity programs and managing and mitigating high profile cybersecurity incidents to ensure best information security practices and business continuity. Additionally, he has previously served as the CISO for the City of Plano, Texas at municipal government level and as the Information Security Principal performing various strategic and technological tasks with DynCorp International. He holds a Bachelor in Economics from University of San Buenaventura, Cali, Colombia and a Master of Science in Computer Information Systems with a concentration in Security from Boston University. • Our Senior VP of Information Technology is also responsible for oversight of our information security strategy, program, and operations. He has over 20 years of information technology experience, including leadership experience managing global information security, IT infrastructure and engineering. In the past, he has served in roles as Lead Technologist for Hewlett-Packard and as Global Product Manager for the Procter and Gamble Company. He holds a Bachelor of Science degree in Computer Engineering from Universidad Sim n Bol var, Venezuela, an MBA in International Business from Xavier University and a Master of Science degree in Computer Science from University of Southern California.


text: The management team also includes Technology SME's, Legal advisors, Business Unit leaders, HR representatives and Finance representatives to further assist our VP of Information Security and SVP of Information Technology with assessing and managing our material risks from cybersecurity threats.


text: We are cognizant of the evolving risks associated with cybersecurity and recognize a material cybersecurity incident could adversely impact our financial results and condition. We further recognize the importance of maintaining processes to identify, mitigate, and manage those cybersecurity threats. No cybersecurity threats occurred during the year ended December 31, 2024 that have had, or are reasonably likely to have had, a material impact on our business strategy, results of operations, or financial condition. However, if as a result of any future attacks, our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate our business, and our business strategy, results of operations or financial condition could be adversely affected. Such attacks, whether or not successful, could result in significant costs related to, for example, repairing or replacing our IT systems; the loss of critical data; and interruptions or delays in our ability to perform critical functions. In addition, the volume, frequency and sophistication of these threats (including through the use of artificial intelligence) continues to grow and the complexity and scale of the systems to be protected continues to increase.

companyName: FreightCar America, Inc.

ticker: RAIL


text: We utilize the National Institute of Standards and Technology ("NIST") framework with our security program to identify, mitigate, and manage cybersecurity risks. We have implemented controls and a formal security policy following this framework. This security policy functions in conjunction with other policies, such as our acceptable use policy and our mobile device policy. We also maintain a specific incident response policy and procedure document including notification and participation of key workforce personnel and external stakeholders to contain, eradicate, and recover from any security incidents.


text: The Company emphasizes the importance of security awareness to our workforce through the administration of third-party cybersecurity training and prioritizes the monitoring and prevention of unauthorized access to Company information technology ("IT") assets such as networks, computers, mobile devices, applications, and stored information. Our internal IT team considers cybersecurity capabilities of third-party service providers prior to engaging them and on an ongoing basis. Our key external IT vendors provide the Company with system and organizational control reports that are reviewed by our internal IT team and may reveal potential security risks.


text: A third-party managed security services provider ("MSSP") works in tandem with our internal IT team to implement and maintain processes and procedures to detect and handle identified security incidents, including the performance of phishing simulations to evaluate our workforce's ability to recognize malicious emails. Our MSSP team leaders have significant experience working in cybersecurity and employ a trained workforce designed to provide proactive and comprehensive cybersecurity care. Together with our MSSP, we also monitor the frequency and extent of cybersecurity threats and update our processes and procedures as necessary. On an annual basis, our internal auditors conduct penetration testing and other assessments.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee primary responsibility for oversight of our risk management programs, including processes and procedures related to cybersecurity threats and incidents. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Company's cybersecurity risk management program is under the direction of our Director of IT, who reports directly to our Chief Financial Officer and has over two decades of experience in the field of information technology and security. Our Director of IT drives collective focus and central coordination of our cybersecurity risk management program internally and oversees our retained external MSSP personnel. Management reports to the Audit Committee, at least quarterly, and more frequently if needed, on the Company's cybersecurity risk management program, including periodic assessments and tests addressing cybersecurity threats and incidents.


text: Risk Management and Strategy Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis and at least annually.

companyName: PHX MINERALS INC.


text: Our Board has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Accounting Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to the Audit Committee, which consists of 100% independent directors, and ultimately to our Board. Management presents an assessment of our cybersecurity processes, procedures, and results of testing to the Audit Committee at least annually.


text: Our Company recognizes the importance of maintaining the safety and security of our critical systems, information, and broader information technology environment. We have developed a comprehensive cyber, data governance, and privacy program intended to (i) protect the confidentiality, integrity, and availability of our information systems and data, and (ii) assess, identify, and manage materials risks associated with cybersecurity threats In order to protect the Company data - and any other data we manage or handle - we have adopted a number of safeguards and security measures. For example, we have implemented software-as-a-service firewalls, endpoint protection, detection and response solutions, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, software static analysis, dynamic analysis, third-party independent business continuity testing, independent third-party control audits. In addition, we have implemented several policies and programs to improve compliance and reduce risk, ensure appropriate responses in the event of an incident, and reduce the cost and scope of an incident should it occur, including: • a robust Incident Response Plan ("IRP"), • an Information Technology and Information Security Policy ("IT&IS Policy"), • a data governance program to oversee our Records Retention Policy, • a Data Governance Working Group comprised of legal, finance, human resources ("HR"), and third-party privacy and data governance consultants to review policies, programs, and data governance, and make reports and recommendations to management and the Board of Directors, • mandatory cyber and information security training for all employees, and • cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents Our IRP, in conjunction with the IT&IS Policy, is designed to equip our employees and managers with the necessary tools to detect, respond to, and ultimately prevent cybersecurity incidents. It contains detailed processes and procedures to assist employees in managing cybersecurity incidents when they happen, including techniques for detecting/identifying suspicious activity in our data environment, response and escalation protocols to defend against intrusions and contain any potential data leakage, data preservation measures to ensure data integrity going forward, and remediation steps to diagnose root causes and secure gaps to prevent future attacks.

companyName: ContextLogic Inc.


text: The Incident Response Team ("IRT") coordinates and aligns key resources and team members during a security incident to minimize impact, restore operations as quickly as possible, and assess and fulfill the Company's legal and contractual obligations. The IRT is also responsible for centrally managing internal and external communications to ensure that disclosures are accurate and complete. The IRT is led by our Chief Compliance Officer, legal team, and Cybersecurity Response Leader, and is supported by a multi-tier team comprised of key stakeholders across the business including finance, HR, our dedicated IT provider, and other external response partners, including cybersecurity consultants, cybersecurity insurance providers, and outside legal counsel. The IRT and external response partners operate under the supervision of our executive management team with oversight from the Audit Committee of our Board of Directors.


text: Finally, the IRP is also supported by a full curriculum of training for employees that is drafted and administered under the supervision of our Chief Compliance Officer. Importantly, these training sessions include several modules and quizzes for both technical and non-technical employees to assist our employees in comprehensively understanding the importance of data security to our stakeholders and our business and the various ways they can promote a security environment throughout our company.


text: Risk Management and Strategy Incident Response Lifecycle - Assessing and Responding to Cyber Incidents Our IRP sets forth the Company's process for assessing cyber threats. The IRP serves as the incident response plan to effectively manage, mitigate, and contain the risk of a security incident or data breach and it applies to all ContextLogic personnel, including employees, contractors, consultants, and any other individuals acting for or on behalf of the Company. The IRP incident response lifecycle is comprised of four phases: (1) Preparation, (2) Detection and Analysis, (3) Incident Response, Investigation, and Notification, and (4) Post-Incident Analysis and Lessons Learned.


text: The preparation phase of our IRP includes maintaining protective measures to minimize the likelihood and impact of a security incident, regularly reviewing and updating our policies and procedures to maintain alignment with industry standards and guidance, and periodic training of all Company personnel on information security, data privacy, and the procedures to reporting suspected incidents.


text: The detection and analysis phase addresses the responsibility of Company personnel to notify our IRT Leader and IT provider upon noticing, suspecting, or being notified of any actual or suspected security incident which will prompt our IT provider to perform an initial investigation of the issue and determine whether the event is a security incident and whether the Cybersecurity Response Leader needs to be notified.


text: The incident response, investigation, and notification phase of our IRP addresses the distinct but simultaneous workstreams that occur internally once an event has been determined to be a security incident. This includes technical response such as technical evidence collection and preservation, thread containment and eradication, and system and data restoration. Additionally, incident investigation efforts begin to determine the scope and severity of the security incident with legal and finance stakeholders. If appropriate, further measures are taken to comply with disclosure obligations as required by governance guidelines, committee charters, and applicable laws and contracts.


text: The post-incident analysis phase includes evaluating the internal security policies, preparedness, posture, and technical environment, allowing the Company to conduct a holistic assessment and identify and remediate shortcomings and gaps.


text: As part of our IRP, we conduct regular testing to ensure that the IRP is functional and effective. Tests may include tabletop exercises, verbal walkthroughs with relevant stakeholders, or responses to actual security incidents.


text: We also engage third-party services from time-to-time to conduct evaluations of our security controls, including the IRP, whether through business continuity testing, or consulting on best practices to address new challenges and risks.


text: Board and Management Oversight The Company's management is involved in overseeing our cyber, data governance, and privacy program as members of our Data Governance Working Group, and assessing security incidents with the IRT to the extent discussed in the IRP above. The Board and Audit Committee actively oversee our enterprise risk management, including cybersecurity risks, and are notified and updated on any security incidents on a regular basis. The Audit Committee is responsible for overseeing our cyber, data governance, and privacy program and receives regular updates from management and the IRT leader about the Company's ongoing compliance and risk management and reports to the Board regularly.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us.


text: Cybersecurity Risk Management and Strategy The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on Diameter and other service providers to protect the Company's information from cybersecurity threats. Diameter has processes in place to assess, identify, and manage material risks from cybersecurity threats, including pursuant to its Written Information Security Policy ("WISP") and Cyber Incident Response Plan ("CIR Plan", and together with the WISP, the "Plans"). Diameter utilizes a third-party managed service provider to support and manage its information technology framework.

companyName: Diameter Credit Co


text: The Plans promote the Company's cybersecurity infrastructure through policies and procedures relating to, among others, employee responsibilities, data loss prevention, access controls, cyber risk assessments and management, reporting requirements, and electronic communications. Pursuant to the Plans, Diameter also engage s external parties as it deems appropriate, including cybersecurity consultants to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the expertise of legal, information technology and compliance personnel of Diameter and external cybersecurity consultants when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Since the Company's inception, it has not experienced a cybersecurity incident that has materially affected the Company, its business strategy, its results of operations, or its financial condition.


text: Board Oversight of Cybersecurity Risks Diameter's Chief Compliance Officer, or a designee, reports to the Board periodically, and at least annually, an overview of the Adviser's cybersecurity structure and any material cyber incidents that occurred with respect to the Company or the Adviser since the last report. Diameter's Chief Compliance Officer may, in his or her discretion, update the Board regarding Diameter's cybersecurity program in addition to those periodic reports, including providing notice of material cybersecurity incidents that have occurred.


text: Management's Role in Cybersecurity Risk Management Diameter's Chief Compliance Officer and Chief Operating Officer oversee Diameter's cybersecurity operations, with the assistance of additional personnel and Diameter's external managed service provider. Employees that support Diameter's cybersecurity infrastructure have relevant educational and industry experience, including in technology and cybersecurity risk. Assessment of Cybersecurity Risk Diameter conducts annual cyber risk assessments, and penetration tests are conducted by third-party service providers.


text: All network environment alerts are reviewed by the third-party SOC team then relayed to Diameter's appointed technology infrastructure employee and its external managed service provider. Pursuant to the CIR Plan, cyber threats will be assessed for their threat level and the appropriate parties will be alerted.


text: Cybersecurity Program Overview AGL Private Credit Income Fund has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of AGL US DL Management LLC (the "Adviser") and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: AGL Private Credit Income Fund


text: The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: Board Oversight of Cybersecurity Risks The board of trustees of the Company (the "Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Adviser's Chief Technology Officer ("CTO"), internal information technology team and a managed virtual security operations center are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The Adviser's CTO has 20 years of experience in technology, with 10 years advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Adviser's CTO works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents (of which there were none), that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature such as data about our research and clinical trials (the Information Systems and Data).

companyName: SCYNEXIS INC

ticker: SCYX


text: We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.

companyName: Talkspace, Inc.

ticker: TALK


text: As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk: • Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • Background checks prior to hire; • Encryption of data at rest and in transit; • Logging and event monitoring; • Threat detection to monitor for malicious activity and anomalous behavior; • Malware protection and restricting connections to malicious websites; • Data loss protection mechanisms; • Third party penetration testing and internal vulnerability assessments; • Cybersecurity risk assessments of our third-party vendors; • Reviews by internal and external audit of the effectiveness of information security-related internal controls; • Closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and • Carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan, as implemented by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.


text: We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during separate Board meeting discussions of important matters like risk management, and other relevant matters. Management or the Audit Committee will provide a comprehensive update to the Board on cybersecurity threats and risk mitigation generally at least annually, and more frequently as relevant.


text: The Company's information security and cybersecurity program is managed by our Chief Information Security Officer (CISO) and our Chief Technology Officer (CTO). The CISO and the Senior Director Information Security are responsible for our overall security and assessing and managing cybersecurity risks and threats. The CISO has over 20 years of information security, privacy, auditing and compliance experience and holds numerous certifications. The Senior Director of Information Security has over 15 years of experience in information security, and holds numerous certifications. The CTO has over 20 years of experience and leads our Company's information systems and technological advancements. The SVP of Engineering has over 20 years of experience in IT and has specialized knowledge in systems and network infrastructure. The Director of Site Reliability Engineering and Security has nine years of experience and has principal responsibility for our network operations and system administration.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, together with external consultants it engages, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: The Company relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's Cybersecurity Program.


text: The Company depends on and engages various third parties, including service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its reliance upon such third parties.


text: Third-party information security service providers, subject to the Investment Adviser's Technology Risk and Information Security Committee (the "Committee") and Company CCO's oversight, have been engaged to monitor and support the Investment Adviser and Company information security control environment and breach notification processes. The Investment Adviser's Committee, subject to the Company CCO's oversight, monitors developments in data privacy and security.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, as well as the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Investment Adviser's Committee, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's Chief Financial Officer, CCO, General Counsel, Chief Operating Officer, and Director of Information Technology. The CCO has been responsible for oversight of the Company's overall SEC compliance program, since the Company's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and overseeing controls regarding risks applicable to the Company.


text: The Company's Senior Management team, including the CCO, is regularly informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats posed to the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize, or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2024 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "We face risks related to cyber security attacks and other incidents."

companyName: Village Farms International, Inc.

ticker: VFF


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10K for more information.

companyName: Vigil Neuroscience, Inc.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a security incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors who have access to our critical systems and information; and • cybersecurity insurance to cover us for costs and expenses we may incur due to a cybersecurity incident.

companyName: Seres Therapeutics, Inc.

ticker: MCRB