text: Risk Management and Strategy As a financial institution, we believe that the risk of cybersecurity incidents is a significant, increasing, and always evolving risk for our business. Federal law and regulations require us to maintain a comprehensive written information security program, and federal banking regulators regularly issue guidance regarding cybersecurity threats intended to enhance our cybersecurity risk management. Accordingly, we have developed and implemented processes for assessing, identifying and managing material risks from cybersecurity threats designed to comply with federal law and regulations and protect against cybersecurity threats to our business. Our program is supported by management and the Company's Board of Directors (the "Board of Directors"). The Company maintains an active cyber insurance policy to enhance protections against material data intrusions or loss of privacy. For an overview of the federal banking laws and regulations that govern our management and oversight of cybersecurity risks, refer to Item 1. Business – Supervision and Regulation – "Financial Privacy and Cybersecurity Requirements," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: The Company's Information Security Program (the "Program") is comprised of five pillars: the Information Security Policy, the Enterprise Information Security Risk Assessment, the Incident Response Plan, a formalized Security Awareness Campaign, and an enterprise monitoring and reporting program.

secItem: Item 1C


text: The Information Security Policy contains numerous distinct administrative and technical controls that govern data security for the organization and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The policy is reviewed and approved by the Board of Directors annually.


text: The Enterprise Information Security Risk Assessment quantifies risk criteria utilizing the same impact measures, including financial, strategic, operational, and reputational, set forth by the Enterprise Risk Committee. The risk assessment is reviewed and approved by the B oard of Directors annually. The Enterprise Risk Committee includes members of management from various departments and members of the Board of Directors and oversees the overall risk management of the Company. The Enterprise Risk Committee meets as often as appropriate to perform its responsibilities, but no less than once per calendar quarter and reports findings and provides recommendations to the Board of Directors on a routine basis.


text: The Incident Response Plan ("IRP") includes procedures for responding to actual or potential cybersecurity incidents, including providing timely notice to customers and our bank regulatory agencies when appropriate. The IRP is based on the NIST Cybersecurity Framework. The plan is tested annually through tabletop exercises.


text: The Security Awareness Campaign is designed with the goal that employees are educated on policy, threats, and best practices from onboarding and throughout their tenure at the Company. This effort includes an onboarding training program, annual attestation and training, and weekly communication designed to help instill in employees a security mindset through repetition.


text: The Company maintains an enterprise monitoring and reporting program, which identifies key risk indicators for tracking and identifying trends. The key risk indicators are presented to the Company's Information Technology Committee ("IT Committee") and th e Board of Directors on a monthly basis.


text: The Program is monitored each year through various internal and external audits, as well as OCC regulatory exams. Vulnerability and penetration testing are also conducted at least annually by an independent third party to supplement the vulnerability and patching program routinely performed by internal staff. Third-party vendors supplement the Company's internal patching program as necessary. The Company also utilizes a third-party "SOC as a Service" to monitor extended detection and response logs and network traffic.


text: Third-party service provider risk is evaluated prior to and throughout the relationship. Third-party service providers must meet a minimum set of baseline security standards prior to being onboarded. During onboarding, the third party and the services they provide are added to the Information Security Risk Assessment, including consideration of inherent risk factors and mitigating controls. Alternative vendors and the effort to transition between vendors are identified during onboarding as well as in the event that the selected provider may fail in providing contracted services at any time. After a third party is onboarded, they are subject to the annual third-party risk management program, specific to their assigned risk criticality. This effort includes the review of service organization controls reports, business continuity and disaster recovery efforts, insurance certificates, and other compliance related concerns when applicable.


text: During the last three years we h ave not experienced any cybersecurity incidents that have materially affected our Company, including our business, strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats may be reasonably likely to materially affect us, refer to Item 1A. Risk Factors – Risks Related to our Business – "We rely on information technology and telecommunications systems, many of which are provided by third-party vendors" and – "Cyberattacks or other security breaches could adversely affect our operations, net income or reputation," incorporated by reference into this Item 1C.


text: The Board of Directors is responsible for oversight of risks from cybersecurity threats. Oversight of cybersecurity risk management is performed primarily by the Board of Directors and the IT Committee. The IT Committee consists of members of the Board of Directors and key members of management. The IT Committee's primary purpose is to assist the Board of Directors in its oversight of technology and innovation strategies, plans and operations related to cybersecurity, data privacy, and third-party technology risk management. The Chief Information Security Officer ("CISO") provides monthly information security reports on cybersecurity programs, policies and controls, key risk indicators and trends including responses to any cybersecurity events, and efforts to improve security. Annually, the CISO provides security training to the Board of Directors. The CISO also provides the Board of Directors with an annual Information Security Program Summary Report in compliance with federal banking guidelines.


text: The program is managed by the CISO who reports to the Chief Operations Officer and is reviewed by regulators as well as internal auditors. The Chief Information Officer ("CIO") and information technology staff support the CISO in cybersecurity operations as necessary to mitigate risks to the Company's technology infrastructure. The CISO holds two cybersecurity industry leading certifications (CISSP, CCSP) and has more than 20 years of technology experience. Information technology staff are generally subject to professional education, experience, and certification requirements, and receive education and mentoring from the CISO and CIO.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our intellectual property.

companyName: CEVA INC

ticker: CEVA


text: Vigilance: We maintain 24/7 cybersecurity threat operations in order to rapidly detect, contain and respond to cybersecurity threats and incidents.


text: Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.


text: Third-Party Management: We screen venders, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented users of our systems..


text: Education: All of our employees are trained at least annually on cybersecurity threats and our information security procedures, which reinforces our information security policies, standards and practices.


text: Incident Response Planning: We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident.


text: Communication and Coordination: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents.


text: Governance: Our board of directors' oversight of cybersecurity risk management is supported by our Chief Financial Officer and Compliance Officer, who interacts directly with, and is provided relevant information by, our cybersecurity team. While our board of directors has the ultimate oversight responsibility over the management of cybersecurity risk, our audit committee reviews the risk management process relating to cybersecurity on a regular basis.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We regularly engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board receives regular presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. The cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-25 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training. We believe this collective experience allows us to effectively manage risks emerging from cybersecurity threats.


text: The cybersecurity team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our broader management team when appropriate.


text: We have not previously experienced any material cybersecurity incidents. In addition, cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to affect, the Company, including our business strategy, results of operations, or financial condition.


text: Our overall risk management program includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Key aspects of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: cybersecurity awareness training for our employees, incident response personnel, and management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See " Item 1A. Risk Factors – Our business is subject to cybersecurity risks " included elsewhere in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries.


text: Our management team stays informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy Our information security program includes administrative, technical and physical safeguards and is designed to provide an appropriate level of protection to maintain the confidentiality, integrity and availability of our Company's and our customers' information. This includes protecting against known and evolving threats to the security of customer records and information, and against unauthorized access, compromise, or loss of customer records or information.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Our information security program is designed to continuously adapt to an evolving landscape of emerging threats and available technology. Through data gathering and evaluation of emerging threats from internal and external incidents and technology investments, security controls are regularly monitored and adjusted on an as needed basis. We have developed a data security strategy that is integrated within our overall risk management strategy and implemented through layers of controls embedded throughout our technology environment that establish multiple control points between threats and our assets. We test the effectiveness of our controls and data protection processes through internal and independent external audits and assessments, including regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate hacker attacks. Our information security program is supported by regular training of information technology employees and awareness training and activities for executives, directors, and employees companywide through which we communicate our information security policies, standards, processes and practices.


text: Further, our information security program is designed to provide oversight of third parties who store, process or have access to sensitive Company or customer data, and we require similar levels of protection from third-party service providers as are required for the Company. We maintain supplier risk assessment processes to identify risks associated with third-party service providers.


text: We employ business continuity, backup and disaster recovery procedures for systems that are used for storing, processing and transferring customer information, and we periodically test and validate our disaster recovery plans to validate our resilience capabilities. Additionally, we maintain insurance coverage that, subject to applicable terms and conditions, may cover certain aspects of cybersecurity and information risks. However, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.


text: Our information security program is designed and managed to be consistent with the framework and guidelines of the FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook and FFIEC Cybersecurity Assessment Tool. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur. Along with periodically being examined by our regulators, the Company regularly engages external experts to audit, evaluate and validate our controls against these standard frameworks, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these examinations, audits and evaluations.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company to date. While we are not currently aware of any cybersecurity threats that are reasonably likely to materially affect the Company there is no assurance that we will not be materially affected by such threats in the future. For additional information on our risks related to cybersecurity, see Item 1A, Risk Factors—Operational Risks.


text: Our Board of Directors and executive officers are responsible for oversight of our information technology framework, including cybersecurity, information security, information technology and business continuity. The Chief Information Officer ("CIO") and other members of senior management report to the Board of Directors and executive officers at least annually and on an as needed basis. In the event of an immediate cyber threat to our business operations, the CIO would promptly initiate the Company's incident response plan including notifying executive officers, Board of Directors and regulators.


text: While our Board of Directors provides oversight of our information technology environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. The CIO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. The CIO has served for over 30 years in information technology and various roles within the Company.


text: The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. Our cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Risk Management and Strategy The Company and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our systems, train our employees and generally advise on cybersecurity processes. At least annually, our information technology team make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and employees, and the latest threats that have emerged, including a presentation from the third-party security firm.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our information technology team and a third-party security firm.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: A third-party security firm provides training to our employees, helping our information technology team to maintain a state-of-the-art cybersecurity system and staying up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency MBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives periodic reports from management, the information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate. Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. The Company maintains a comprehensive risk-based cybersecurity program to identify, measure, manage, and disclose material cybersecurity risks. The Company utilizes the Federal Financial Institution Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") as a diagnostic test to help identify the Company's cyber risk level and determine the maturity of our cybersecurity program. The CAT is supplemented by an annual self-assessment and external audits and reviews, the results of which drive the development and implementation of the Company's cybersecurity strategy to ensure that cyber risk management practices are aligned with the risk profile of the Company.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: The Company uses the Center for Internet Security ("CIS") Critical Security Controls framework to balance cybersecurity risk exposure with investment in mitigation strategies. This framework provides a prescriptive, prioritized set of cybersecurity safeguards that fully align with those of the National Institute of Standards and Technology, the International Standards Organization 27000 series, and the requirements and guidance from applicable regulatory authorities, including the Federal Financial Institutions Examination Council.


text: The Company's cybersecurity strategy is enabled by people, processes, and technology that provide multilayered defenses including advanced capabilities for early and rapid cyber threat identification, detection, protection, response, and recovery. The Company employs a team of dedicated, skilled talent to operationalize the cybersecurity strategy. The internal team is supported by arrangements with a third party to provide continuous endpoint monitoring and incident response.


text: The Company's entire workforce receives mandatory cybersecurity training that includes quarterly social engineering exercises and informative online courses assigned based on assessed skill gaps. The Company also provides cyber risk awareness guidance to customers and promotes customer cyber hygiene through periodic communications. The Company conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world cybersecurity incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of the Company's incident response and management programs and provide the basis for continuous improvement.


text: The Company actively monitors and evaluates threats, events, and the performance of its business operations and continually adapts its risk mitigation activities accordingly. To that end, the Company maintains a comprehensive vulnerability management program that includes regular internal scans of the entire network to identify and measure the severity of security vulnerabilities, a team of dedicated network engineers who are responsible for fixing identified vulnerabilities within pre-defined timeframes based on severity, and at least annual independent network penetration testing by a qualified third party.


text: Cyber risk monitoring also includes the Company's arrangements with and exposure to third party service providers. We identify the criticality of our third-party service providers, in part, by determining their use of and access to confidential customer information. We conduct comprehensive cybersecurity reviews on all third parties that have access to confidential information. Our third-party reviews make use of technology that provides significant visibility into third party organizations, in real time, to assess third party compliance with a host of globally recognized IT security standards and frameworks and the likelihood of a cyberattack on a third party.


text: The Company also maintains a robust firewall system and firewall management program to restrict inbound and outbound network traffic. A dedicated team of network engineers manages firewall rulesets and monitors firewall health and alerting.


text: The risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. Although the Company has invested substantial resources to manage and reduce cybersecurity risk, it is not possible to eliminate this risk. The Company obtains insurance that protects against certain losses, expenses, and damages associated with cybersecurity risk. See Item 1A, "Risk Factors," for additional information regarding cybersecurity risk.


text: Cybersecurity Governance The Company's Board of Directors devotes significant time and attention to its oversight of cybersecurity risk. Select members of the Board serve on the Information Systems Steering Committee ("ISSC"), which is responsible for approving IT strategic plans and all IT-related policies and for oversight of the information security program, among other matters. To fulfill its responsibilities, the ISSC receives periodic reports on the cybersecurity risk management program, including information security risks and incidents, emerging threats, and both internal and independent audit reports on the effectiveness of the control environment.


text: Executive leadership is responsible for management of the cybersecurity program. The IT Security Director supervises daily operations of the cybersecurity program and reports directly to the Chief Risk Officer ("CRO"). The CRO chairs the Information Security Sub-Committee ("Sub-Committee"), a management committee that meets at least monthly to receive regular updates on the status of the cybersecurity risk management program and strategic cyber initiatives. The Sub-Committee's actions and activities are reviewed by the ISSC at least quarterly. The Company has a management level Change Control Board ("CCB") which is responsible for reviewing and approving actions of the vulnerability management team, changes to hardware/software including the introduction of new hardware/software, and changes to firewall rulesets. The IT Security Director serves as a voting member of the CCB. Additionally, the Company has a Cyber Incident Response Team ("CIRT") which includes key members of management including the CRO and IT Security Director. The CIRT manages significant cyber-specific events with escalation up to executive leadership and the Board.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including but not limited to the following risks: operational, regulatory compliance, reputational, strategic, information technology, data security and privacy, and market risks such as interest rate, credit, liquidity and price risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Board of Directors is responsible for risk oversight over all significant risks facing the Corporation and fulfills this responsibility mainly through its committees. While our Board of Directors takes an oversight role in cybersecurity risk tolerance, we rely to a large degree on management and outside consultants in overseeing cybersecurity risk management. Our Director of Information Security, who reports directly to our Chief Information Officer, is primarily responsible for this cybersecurity component and is a member of management's Operational Risk and IT Steering Committees, and regularly attends and presents to the Risk Committee of our Board of Directors ("Risk Committee").

companyName: FIRST OF LONG ISLAND CORP


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, audits, and threat intelligence feeds to facilitate and promote program effectiveness.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the ability to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including notification of and escalation to the appropriate team members as well as executive management and the Board of Directors. The Incident Response Plan is coordinated through the Director of Information Security and key members of management. The Incident Response Plan facilitates coordination across multiple departments and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyberattacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. To date, the Corporation has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Corporation.


text: The Director of Information Security provides information security updates to the IT Steering Committee and the Risk Committee. Cybersecurity metrics are reported to the IT Steering Committee monthly and to the Risk Committee on a quarterly basis. Security training is provided to all staff through targeted training overseen by the Director of Information Security. All Board members receive cybersecurity training annually.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program. At least annually, the Director of Information Security and the Chief Risk Officer report to the Risk Committee the overall status of the Information Security Program. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Bel employs a full-time Cyber Security Expert who reports directly into our Senior Director of Global IT Services. During 2023, the Company worked with third-party cybersecurity companies to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Senior Director of Global IT Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Senior Director of Global IT Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Senior Director of Global IT Services has more than 15 years of information technology and program management experience which includes information security, and others on our IT security team have years of cybersecurity experience and certifications.


text: Risk Assessment and Strategy Fuel Tech regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our Information Technology Steering Committee on a quarterly basis, or more frequently if deemed appropriate.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks.


text: the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.


text: the deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities.


text: if necessary, the use of third-party security experts if and when an incident is detected We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.


text: Management Oversight Day-to day management of cybersecurity threats is conducted by our Information Technology department which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Information Technology Steering Committee, which is comprised of our Chief Executive Officer, Chief Financial Officer, General Counsel and Head of Information Technology.


text: The Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of management's efforts to eliminate cybersecurity risks.


text: The Company maintains a governance structure to address cybersecurity risk, which involves the Board, the Audit Committee, the Company's Director of Information Technology, and a dedicated Incident Response Team.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: The Company utilizes a cross-functional, multilayered approach risk management to its cybersecurity to identify, prevent, and mitigate cybersecurity threats to the Company designed to preserve the confidentiality, security, and integrity of the Company's information and data. The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape. The Board and the Audit Committee receive regular presentations on cybersecurity-related topics ranging from the results of penetration testing, recent developments, evolving standards, the threat environment, technological trends, and information security considerations facing the Company and its peers. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's Director of Information Technology, and at least annually, or more frequently as necessary, the Company's Director of Information Technology meets with the Audit Committee to discuss cybersecurity risk management. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors, and various regulators.


text: The Company's Incident Response Team is led by our Director of Information Technology and also comprised of various cross-functional members of management. The team is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks and will present regular reports to the Audit Committee and the Board. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a third-party consultant with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's consultant is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also provides annual trainings for all employees designed to reinforce the Company's information technology risk and security management policies, standards and practices, as well as the expectation that all employees comply with these policies. These trainings are supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown and changing cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy, or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information.


text: Risk Management and Strategy We maintain an Information Systems Security Program to safeguard all Summit and Summit Community's information assets against unauthorized use, disclosure, modification, damage, or loss. This is achieved through a collaborative effort involving Operations, Technology, Compliance, Risk, and Senior Management. The Program is designed to: Uphold the security and confidentiality of customer and bank records as mandated by law. Proactively guard against potential threats or hazards to the integrity of these records. Prevent unauthorized access or use of records or information that could significantly harm our Company, Customers, and Employees. Develop and maintain guidelines for Information Technology compliance with external and regulatory demands. Implement and regularly test effective Business Continuity and Disaster Recovery strategies. The Company's Chief Operating Officer (COO) is designated as the program coordinator responsible for coordinating and overseeing the program.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: Risk and Compliance Protocols Annually, our Compliance Department conducts risk assessments to determine the effectiveness of controls outlined in the Information Systems Security Program. This is in alignment with the requirements of the Gramm-Leach Bliley Act ("GLBA") and the Federal Financial Institutions Examination Council ("FFIEC") guidance on securing customer information. Key focus areas include: Evaluating technology systems used for the collection, processing, and storage of information. Assessing both internal and external cybersecurity threats and vulnerabilities. Ensuring that penetration and controls testing are conducted regularly. Gauging the potential impact of compromised information or systems. Assessing the effectiveness of governance structures in managing information security risks.


text: Monthly internal and external penetration testing is conducted and reviewed either by independent third parties or qualified employees not involved in developing or maintaining the security program. An audit is performed annually by qualified internal auditors or contracted independent parties and is overseen by the Company's Audit & Compliance Committee of the Board of Directors ("Audit Committee"). Management promptly reviews test results to initiate necessary remediation, which are then reviewed by the Audit Committee, third-party auditors, and examiners. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers.


text: Cybersecurity Incident Response The Company has established a Cybersecurity Incident Response Testing Plan ("CSIRTP"), integrated into the Business Continuity Plan. This plan outlines a systematic approach to managing information security incidents, supplemented by specific playbooks for various attack types. The CSIRTP requires approval by the Information Technology Steering Committee and is governed by the Business Continuity Plan that is approved annually by the Board of Directors. We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.


text: Governance and Oversight The Information Systems Security Program, reviewed and updated annually by the Board of Directors, is our benchmark for protecting the Company's confidential information. The COO, with over 30 years of experience in operations and information security, reports security incidents and updates to the Board as needed.


text: The Board and Senior Management are tasked with comprehensively understanding the Company's risk environment. Incident management and response teams are in place to execute response protocols and strategies, mitigating business risk and supporting recovery initiatives. This team adapts based on the nature of incidents, ensuring a flexible and effective response.


text: The CSIRTP framework ensures timely reporting of cybersecurity incidents to the Executive Management Team. Incident severity is judged based on potential impacts, including damage, compromise, loss, and the likelihood of further exploitation. The Chief Risk Officer is informed of all incidents that are determined to be significant. The Chief Executive Officer and the Board of Directors are notified of these incidents as necessary.


text: For further information on risks to the Company from cybersecurity threats, see "Our information systems may experience failure, interruption or breach in security" under Item 1A. Risk Factors.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including the Chief Executive Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: Third parties with which the Bank does business, that facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.


text: Bank customers are also sources of cybersecurity risk to the Bank and its information assets, particularly when their activities and systems are beyond the Bank's own security and control systems. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.


text: The security program is commensurate with the size and complexity of the Bank. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities. Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents.


text: The Chief Information Security Officer ("CISO") reports to the Chief Information Officer ("CIO") and Chief Risk Officer ("CRO"). The CISO leads the Information Security team, which is responsible for identifying and assessing information security and cybersecurity risks, and for implementing and maintaining controls to manage information security and cybersecurity threats. The CISO is responsible for the Bank's Information Security and Cybersecurity Program, which is designed to prevent, detect and respond to cybersecurity threats and incidents in order to help safeguard the confidentiality, integrity and availability of the Bank's information systems and information.


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. The training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.


text: Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding our information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor our information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of our systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.


text: The Bank has an incident response program designed to enable the Bank to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Bank's operating environment.


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including, but not limited to: consultants who assist with assessing risks, assess of our systems alignment with NIST Cybersecurity Framework, FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.


text: The Bank maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.


text: The IT Committee and Audit Committee are the principal board committees that oversees the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and CISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The CISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and CISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The CISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets eight times a year. The IT and Audit Committees assist the Board of Directors in its oversight.


text: As part of its oversight of management's implementation and maintenance of the Bank's risk management framework, the Bank's Board of Directors receives regular updates directly from both IT and Audit Committees concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Bank's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Bank's efforts to address those incidents.


text: Notwithstanding our efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our information technology policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and engage external resources and advisors as needed. All employees are required to complete cybersecurity trainings each month through online trainings and simulations.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations would suffer in the event of a significant computer system failure, cyber-attack or deficiency in our cyber-security" in Item 1A- Risk Factors.


text: The full Board receives updates periodically or as needed during the year from the Company's Chief Information Officer and actively participates in discussions with management and amongst themselves regarding cybersecurity risks. Updates delivered to the full Board typically include discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. These updates also typically include a review of any recent enhancements to the Company's defenses and management's progress on its cybersecurity, as well as reports on key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our program to best practices, as well as by engaging experts to attempt to infiltrate our information systems (as such term is defined in Item 106(a) of Regulation S-K). We test and review the result on a semi-annual basis.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: monitor emerging data protection laws and implement changes to our processes designed to comply; conduct regular cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care;


text: leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident;


text: maintain multiple layers of controls, including embedding security into our technology investments, multi-factor authentication tools, apply policy of least privilege to data and systems access, monitor logins both at network perimeter and within, segment and firewall system access within the network perimeter not solely at network edge or perimeter;


text: perform annual system access audit with all departments and personnel review access logs on all perimeter, security and sensitive data areas We perform periodic internal assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our board when found. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Security breaches and other disruptions to the Company ' s information technology infrastructure could interfere with the Company ' s operations, compromise information belonging to the Company and our customers and suppliers and expose the Company to liability, which could adversely impact the Company ' s business and reputation " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K which disclosures are incorporated by reference herein.


text: In the last fifteen fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. Annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials, including current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our IT Manager.


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management process, which is discussed in greater detail above, is led by our IT Manager. Such individual has over twenty five years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.


text: Our IT manager skills are further enhanced by MCSA and MCSE certifications and a foundation in Computer Engineering studies at university. Our IT manager has a strong track record of working with major vendors' security, firewall, identity management, and other platforms, ensuring robust and resilient IT infrastructures.


text: Information, unlike other assets such as cash, facilities, equipment, and products, is highly volatile in terms of its value and many people can use it simultaneously. It leaves no obvious indicators when it is stolen, and it is in constant motion across our internet, intranet, extranet, and computer systems. It is often stored in many locations in different formats at the same time. These characteristics make it much more difficult to manage, control, and protect than other types of assets and therefore a risk management process is required. Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information ("Information Assets"). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical. Information Assets may be classified as Low, Medium, or High Risk based on the potential impact of its unauthorized disclosure.

companyName: Clene Inc.

ticker: CLNN


text: Device and Network Security Our device and network security policies and procedures are designed to mitigate risk by ensuring our network and computing devices ("Computer Equipment"), electronic systems, and resources used in our business ("Information Systems"), whether owned or leased by us, our employees, or third parties, and the Information Assets contained therein, are protected from security threats.


text: To mitigate risk, we utilize (i) firewalls to protect our network perimeter and additional perimeters within the network as required, (ii) anti-malware software to protect all Computer Equipment, including but not limited to desktops, laptops, workstations, and servers, (iii) device scanning, alerts, and reporting, (iv) physical security, (v) security and application lifecycle security, (vi) security updates and backups, and (vii) vulnerability and risk assessments.


text: Firewalls. Our network and Computer Equipment is protected by one or more authorized firewalls, with any changes to firewall hardware, operating system, or rules requiring approval from authorized personnel including the review and approval of an IT change control document. Administration of firewalls is restricted to a minimum number of authorized personnel as necessary. We also employ intrusion detection at critical points of our network. All external access to our network, or to any computing resource on our network connected to a non-Clene network (including, but not limited to the internet) must pass through a hardware firewall, appliance, or equivalent device, where all traffic between our network and external networks can be continuously controlled, monitored, and examined for any access violations.


text: Anti-Malware Software. Our Computer Equipment is protected by anti-malware software. The management and administration of anti-malware software is restricted to a minimum number of authorized personnel as necessary.


text: Real-Time Monitoring. We engage a third-party security operations center that actively monitors our environment and detects and remediates security threats in real-time.


text: Device Scanning, Alerts, and Reporting. We reserve the right to monitor, scan, screen, and quarantine/confiscate all Computer Equipment that accesses our network, in compliance with applicable laws and government regulations. We also reserve the right to scan information systems, monitor or screen content and traffic patterns, block e-mail, quarantine and/or confiscate any Information Systems that may post a threat to us, and if such activities reveal possible evidence of criminal activity, to take any appropriate action which may include providing evidence to law enforcement officials.


text: Physical Security. We control physical access to our facilities, areas within our facilities, data centers, server rooms, and equipment. Manufacturing and research and development is conducted out of our Maryland facility that employs badging, visitor registries, escorts for visitors, exit/removal procedures, and physical locks/access controls as appropriate and necessary. Our corporate office in Utah is equipped with physical security including locks/access controls to the facility and to secure all IT-related equipment and personnel files. Installation, maintenance, and repair of equipment is restricted to authorized personnel. We protect our Computer Equipment from power failure, surges, and other electrical anomalies, and cabling is protected from unauthorized access or damage. Access to our network services is restricted to authorized individuals and granted only following individual identification and authentication. Local wireless access is limited to authorized entry points, with various forms of authentication required before access is granted to authorized individuals.


text: Security and Application Lifecycle Security. We perform analysis of security requirements for all systems and applications throughout their lifecycle, including for new systems and applications and significant upgrades to existing systems and applications. All new or upgraded systems and applications are tested for stability, compatibility, and security integrity in a separate environment prior to introduction into our production environment.


text: Security Updates and Backups. We monitor security bulletins, software updates/patches, and functional software updates/patches and apply them in accordance with the timeline prescribed in our policies and based upon recommendations from third-party vendors, as applicable. Systems that no longer provide security updates/patches are discontinued. We research, test, and verify functional software updates/patches before installation. We perform data backups periodically based on business requirements to maximize data availability and prevent information loss, including before any system upgrade or maintenance. Encrypted data remains encrypted throughout our backup processes. We review backup schedules at least annually, and changes may only be made by authorized personnel after formal documentation and approval. Data backups are stored in geographically separate facilities.


text: Vulnerability Assessments. We conduct assessments over potential vulnerabilities for all new and existing network-connected assets on an annual basis. Any potential vulnerabilities that we identify are remediated. We rate vulnerabilities based on the following criteria: (i) High: A vulnerability exists that could potentially allow an attacker to gain elevated access of the host, divulge system information, and/or lead to system or network compromise; (ii) Medium: A vulnerability exists that could potentially allow an attacker limited access to file contents, security settings or ability to conduct a denial-of-service attack; (iii) Low: A vulnerability exists that could potentially allow an attacker limited access to sensitive host system data, such as installed software version giving the ability to exploit application vulnerabilities; and (iv) Info: An attacker could collect basic host information such as open ports and services.


text: Security Incident Reporting Our security incident reporting policy and procedures enable the identification, monitoring, reporting, and response capabilities to known or suspected security incidents in our network and all IT-managed services and Information Systems. Security identification begins with a broad range of potential risks, including, but not limited to, theft or unauthorized disclosure of Information Assets, unexpected modification of Company Information Assets, disruptions of service that can result in Information Assets being unavailable for an unacceptable amount of time, and suspicious behavior and/or unauthorized activity by any individual or organization that can potentially compromise Information Assets or Information Systems.


text: Our process to monitor, report, and respond to identified or suspected security incidents includes (i) collection of relevant information about an incident, including (a) impacted systems, (b) impacted entities, (c) protection mechanisms that were in place and active at the time of the security incident, (d) audit logs, and (e) the risk classification of the Information Assets that were potentially impacted; (ii) reporting to a centralized ticketing system; (iii) reporting to management and other authorities, such as legal, human resources, IT, and local and/or state law enforcement, etc.; (iv) escalation, if the incident is considered to be critical based upon our assessment of its potential impact, to appropriate management and directors and other authorities; and (v) documentation of the incident and our response actions taken.


text: Change and Configuration Management Our change and configuration management policy and procedures enable the effective management of changes to Information Systems ("Changes") to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and information technology ("IT") services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners.


text: Changes must be approved by authorized personnel prior to (i) performance of any work related to a Change, (ii) migration of any Change-related work from the quality environment to the production environment, to ensure the Change was adequately tested and performs properly, and (iii) closing of the Change, to ensure the Change was implemented in the production environment and correctly solves the issue that prompted the Change request.


text: Changes are tracked and documented in a change tracking system, and we retain past versions of source components and supporting documentation. Testing is performed in an environment other than the production environment, and user acceptance testing is performed by an independent person not responsible for development, modification, or configuration of applications, programs, or system code. Errors are identified, logged, and resolved.


text: Additionally, for Changes that may impact our manufacturing process, we perform impact assessments prior to performing a Change to understand the (i) level of financial, technical, and compliance risk, (ii) impact on business operations, (iii) impact of configuration and user access security, (iv) impact on connected Information Systems and interfaces, and (v) need for user training. The extent and documentation of impact assessments are commensurate with the level of risk associated with the Change, and the level of testing performed shall be determined by the results of the impact assessment.


text: Identity and Access Management Our identity and access management policies and procedures define the access control measures to our Information Systems to protect the privacy, security, and confidentiality of Computer Equipment, Information Systems, and Information Assets.


text: Unique identification is assigned to all individuals with a defined relationship (e.g., employees, vendors, suppliers, etc.), and if a relationship changes, a new identifier is created to reflect the new relationship. Passwords must be changed upon first logon and all privileged account passwords (e.g., root, super user, and administrator passwords) must follow our password guidelines. Identification and authentication are required every time Medium or High Risk Information Assets are accessed or elevated privileges are exercised, and use of elevated privileges is temporary and is revoked upon implementation of a change.


text: Our data access procedures require completion and authorization of access request forms to request, change, or delete access privileges to Information Systems containing Medium or High Risk Information Assets. We perform checks for segregation of duties conflicts and only grant the minimum necessary and least privilege access to users based upon their role. When users are reassigned, promoted, or separated, their access privileges are reviewed and, if necessary, updated in a timely manner. We also perform periodic reviews of user privileges and require training for users with access to Medium or High Risk Information Assets.


text: Information Asset Protection Our Information Asset protection policy and procedures enables the management, control, and protection of Information Assets from unauthorized disclosure, theft, loss, destruction, unauthorized alteration, unauthorized access, and the denial of availability, all of which could have a direct and significant impact on the future success of the Company. Protection of Information Asset supports the efficient and effective management, control, and protection of our business information and the business information entrusted to us by our customers and external business partners. All Information Asset protection policies and procedures must also be viewed in the context of our obligations to comply with government requirements, such as those related to the protection of personal data, and compliance with our contractual obligations.


text: We use the following approach to manage risks related to Information Asset protection: (i) identification and classification of Information Assets, (ii) identification and assessment of the threats to those Information Assets and the associated risk based upon impact to the business and the likelihood of their occurrence, (iii) assessment and analysis of risk, and determination of the actions required to lower risks to an acceptable level, (iv) implementation of appropriate controls or management acknowledgment or risk where controls cannot be implemented, (v) continuous monitoring and measuring of risk, (vi) ongoing communication of risks and mitigating actions, and (vii) auditing for compliance.


text: Once a risk is identified, we analyze the risk and assign a risk classification based upon a combination of factors, including data volume, legal and regulatory requirements, privacy considerations, and intellectual property considerations. Risks are classified as (i) Low Risk, where unauthorized disclosure could be expected to have a limited adverse effect on operations, assets, or individuals; (2) Medium Risk, where unauthorized disclosure could be expected to have a serious adverse effect on operations, assets, or individuals; or (3) High Risk, where unauthorized disclosure could be expected to have a severe or catastrophic adverse effect on operations, assets, or individuals.


text: Prior to the close of 2024, we intend to implement automated system restrictions over Information Assets that will permit general use of Low Risk Information Assets both internally and by our external business partners, and will restrict access to Medium and High Risk Information Assets to limited audiences with legitimate business purposes or specific job responsibilities. Additionally, we currently use confidentiality agreements before granting access as determined by relationship of the user and the associated risks of the Information Asset, and we periodically review access rights to ensure compliance and prevent unauthorized access.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our Chief Executive Officer, General Counsel, and Vice President of Quality and Technical Operations directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 21 years of combined experience in managing IT, operations, and information risk and security. Our Vice President of Quality and Technical Operations has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our Vice President of Quality and Technical Operations and reported to management, including our Chief Executive Officer, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors "Our internal computer systems, or those used by any CROs or other third-party contractors or consultants we may engage, may fail or suffer security breaches."


text: Risk Management and Strategy Ensuring the protection of sensitive data is fundamental to our operational integrity and strategic vision. Cybersecurity and data protection form essential pillars of our long-term strategy, safeguarding confidential information concerning our business, employees, customers, suppliers, and shareholders.

companyName: Whitestone REIT

ticker: WSR


text: Our corporate infrastructure, including information technology systems, communication networks, enterprise applications, and financial platforms, serves as vital tools for our business operations. These systems support crucial functions such as tenant and vendor management, internal communications, and financial record-keeping, underscoring the criticality of secure data collection, storage, and transmission.


text: To mitigate material risks posed by cybersecurity threats to our critical networks, third-party services, and data assets, we have instituted a comprehensive suite of information security processes. These measures encompass the diligent identification, assessment, and management of potential risks, threat monitoring services, and vulnerability assessments.


text: Cross-Functional Collaboration and Coordination: We foster collaboration among various departments, including our information security function, legal team, management, and third-party service providers, to effectively identify, assess, and manage cybersecurity risks.


text: Ongoing Evaluation and Assessment of Systems and Processes: We continuously evaluate and enhance our systems and processes to adapt to evolving cybersecurity threats, ensuring the resilience and effectiveness of our security measures.


text: Security Awareness Program: We conduct regular training and testing programs to enhance the cybersecurity awareness and readiness of our personnel, empowering them to actively contribute to our cybersecurity efforts.


text: As of December 31, 2023, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business strategy, our financial results, or our financial health. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled "We face risks relating to Cybersecurity attacks, loss of confidential information and other business disruptions" in this Form 10-K.


text: Aligned with our risk management governance structure, our management team oversees the daily management of cybersecurity risk, while our Board and its Audit Committee maintain an active and ongoing oversight role, with the Audit Committee receiving regular reports from management regarding cybersecurity risks and countermeasures being undertaken or considered, including updates to the internal and external cybersecurity landscape and relevant technical developments.


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data we produce and collect.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Managing Material Risks & Overall Risk Management We have a cross-departmental approach to addressing cybersecurity risk, including input from our employees, senior management, and Audit Committee of our Board of Directors (the " Board "). The Company devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats promptly and effectively.


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our network security provider follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure the inclusion of our cybersecurity risks are fully incorporated into the Company's overall risk management approach.


text: Third-Party Risk Management and Oversight As part of our cybersecurity program, we also engage with external service providers as part of our continuing cybersecurity efforts, assisting us in the evaluation and enhancement of the effectiveness of our information security policies and procedures. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity policies and procedures are comprehensive, up-to-date, and aligned with regulatory requirements.


text: The use of these third-party providers is regularly reviewed and monitored by the appropriate members of management. We conduct thorough assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impacted our strategic plan, operations, or financial standing. For additional information, see " Risk Factors. "