text: Cybersecurity Risk Management and Oversight We have processes for assessing, identifying, and managing cybersecurity risks, integrated into our overall risk management program and information technology function. These processes are designed to:

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Protect our information assets and operations from internal and external cyber threats, Safeguard employee, vendor, and collaborator information from unauthorized access or attack, and Secure our networks and systems.

secItem: Item 1C


text: Response plans for cyber incidents, Regular system testing and incident simulations, and Routine reviews of policies and procedures to identify risks and enhance practices.


text: To strengthen our cybersecurity risk management practices and oversight, we engage external consultants with expertise in information security, incident response, and governance. Additionally, we evaluate the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: Board and Audit Committee Oversight We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially impact the company or its business strategy, operations, or financial condition. The Audit Committee provides direct oversight of cybersecurity risk and updates the Board of Directors on such matters.


text: Management delivers quarterly cybersecurity updates to the Audit Committee, with additional updates provided as significant new threats or incidents arise.


text: Operational Leadership and Incident Response Our Vice President of Information Technology, or VP of IT, leads company-wide cybersecurity strategy, policy, standards, and processes. This role includes working across departments to assess and address cybersecurity risks and participating in management's updates to the Audit Committee.


text: In the event of a cybersecurity incident, the VP of IT collaborates with the information technology department and relevant teams to assess and respond to the incident, determining the need for internal and external reporting.


text: Our VP of IT brings over 15 years of experience in cybersecurity, including serving as Chief Information Security Officer for a multinational company in the specialty materials industry. Our VP of IT has experience with compliance programs for cybersecurity-related regulations and standards.


text: Additionally, the VP of IT has participated in Gartner cybersecurity programs and conferences and received training on combating cyber threats, including phishing, malware, and social engineering.


text: Employee Training and Technology-Based Safeguards We provide annual data protection and cybersecurity training for all personnel, including full-time, part-time, and temporary staff. This program covers topics such as: Social engineering and phishing awareness, Password protection and mobile security, and Incident response and reporting.


text: Proactive cybersecurity monitoring for threat detection and swift response, Tools to address vulnerabilities and protect information assets, Endpoint security measures, geo-fencing, and geo-blocking on firewalls, and Automatic email prioritization to help our information technology department efficiently address the most critical threats.


text: Our Executive Director of Information Technology, or IT, and other relevant personnel help identify, assess and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We (including the Executive Director of IT) use various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal audits, conducting threat assessments, conducting third-party threat assessments, and conducting vulnerability assessments.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Depending on the relevant information systems environment, we implement and maintain various technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response measures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls, data segregation, access controls, asset management (such as tracking and disposal of our information systems), systems monitoring, and cybersecurity insurance.


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We maintain a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment or auditing for certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify, mitigate and manage cybersecurity risks associated with a particular provider.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Executive Director of IT, who has 26 years of experience developing and deploying network and data security policy and technology.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: ZYNEX INC

ticker: ZYXIQ


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We are establishing incident response, business continuity, and disaster recovery plans designed to more formally address our response to a cybersecurity incident.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct basic security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the System and Organization Controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's incident response team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is an element of this program. Our cybersecurity risk assessment and management efforts are led by our Director of Information Technology, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our Director of Information Technology reports directly to our COO. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our cybersecurity risk management program is supervised by our Director of Information Systems, who has over 20 years of relevant experience, and whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program.

companyName: ELUTIA INC.

ticker: ELUT


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, comprised solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risks and threats and provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. Periodic updates are provided to the Audit Committee on, among other things, our cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. We also engage third parties to periodically evaluate and audit aspects of our information security programs, including by conducting vulnerability assessments and penetration testing. These partnerships enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current. The results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.


text: We face a number of cybersecurity risks in connection with our business. Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We may also rely on information technology and third-party vendors to support our operations, including to collect and store sensitive data. Despite ongoing efforts to continued improvement of our ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.


text: Based on the information we have as of the date of this Annual Report, we do no t believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. See Item 1A, Risk Factors, of this Annual Report for further discussion of cybersecurity risks.


text: We engaged a third party to perform a cybersecurity audits in 2021 and in the fourth quarter of 2024. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation, or financial condition. To date, we have not experienced a material cybersecurity attack, such as a cybersecurity threat, a ransomware attack, computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks, or system failures. The Company carries cybersecurity insurance and considers our coverage to be adequate.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Cyber Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our broader information security policy, which is informed by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security (CIS) benchmarks.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Security incident management processes designed to oversee, identify and manage security events and incidents, including a cybersecurity incident response plan and a managed 24/7 security operation center, which monitors all security events from endpoints and cloud services.


text: System lifecycle and management processes designed to oversee and manage systems and services used by Sagimet, including system assessments and the management of vulnerabilities. System protections including firewalls, endpoint protection, access controls and cloud-based security systems.


text: Annual cloud system assessments designed to help identify material cybersecurity risks to our critical systems, information and our broader enterprise Information Technology (IT) environment.


text: Cybersecurity awareness training for all users with access to our systems including employees, consultants and senior management, with timely relevant security topics, which include social engineering, phishing, password protection, protecting personal data and appropriate use of assets.


text: We have leveraged the support of a third-party data privacy organization to perform a risk assessment designed to identify, assess, and manage data privacy risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf. This process includes a risk assessment process which is designed to oversee, identify and manage material cybersecurity and data privacy risks associated with systems, services and third parties.


text: To date, we have not experienced any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information technology systems and infrastructure. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Senior Director of IT is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has over 15 years of experience as an information technology professional.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our audit committee, per the audit committee charter. Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. In addition, management alerts the audit committee of any material cybersecurity incidents. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.


text: To identify, detect and respond to a cybersecurity incident, we conduct proactive cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing, perform incident response capability reviews and exercises, conduct annual employee training, monitor emerging laws and regulations related to data protection and information security (including intellectual property) and implement appropriate changes. The Company has implemented a cybersecurity incident response plan that outlines the Company's process for preparing for a cybersecurity incident, detecting, analyzing, containing, eradicating and recovering from such incident, and provides guidance for post-incident analysis. Additionally, we have established a Cyber Incident Committee that is comprised of leadership across the Company's finance, legal, accounting, internal audit and IT organizations to provide guidance and monitor overall company cybersecurity.

companyName: Westrock Coffee Co

ticker: WEST


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional discussion of cybersecurity risks or the impact of previous cybersecurity incidents, see Item 1A. Risk Factors "Risks Related to Our Business" in this Annual Report on Form 10-K.


text: The Company's board of directors is responsible for overseeing the Company's risk management program and has designated its Audit & Finance Committee with specific responsibility for overseeing cybersecurity risks, among other risks. The Company's cybersecurity organization is led by our Director of Information Security ("DOIS"), who is responsible for assessing and managing material risks that result from cybersecurity threats, and reports to the Senior Vice President and Chief Information Officer ("CIO"). The CIO and the Audit & Finance Committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes.


text: Our DOIS has nearly a decade of experience within cybersecurity functions and his skillset includes security architecture and engineering, incident response and penetration testing. Our CIO joined the Company in 2023 and most recently served as CIO and VP at another large, publicly-traded organization and has held other vital IT positions over the course of his over 25 year career.


text: We have implemented incident response processes in the event of a cybersecurity threat. Such incident responses are overseen by functional leaders and internal experts. In the event of a cybersecurity threat, security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for potential privacy impact. As part of the above processes, we have engaged external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards and obtained a SOC 2 Type II report.

companyName: AUDIOEYE INC

ticker: AEYE


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cyber and data security threats. Members of the Board or Audit Committee receive periodic updates from senior management regarding our cybersecurity processes and risks. Members of management that comprise our incident response team include the following officers (or those with similar responsibility): Senior Director of Information Technology, Chief Operating Officer, Chief Financial Officer, Customer Success (if customers are affected), and Vice President of Human Resources (if employee data is affected). As part of our internal response policy, upon confirmation of a breach, a remediation process is initiated, led by our Principal Privacy Officer who chairs an incident response team. This team may include members from relevant departments such as Product Development, Information Technology, Finance, Legal, Marketing, Client/Customer Services and Human Resources, any other relevant units or departments affected by the breach and any additional personnel as deemed necessary.


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Hughes Satellite Systems Corp


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, reviews of vendor's written security program and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our collaborators, contractors, consultants or other third parties with whom we work, may fail or suffer security breaches, which could result in a significant disruption of our product development programs and can lead to adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; reputational harm; loss of revenue or profits; loss of customers or sales; disruption of our business operations."


text: ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and the Company's client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: Information Services Group Inc.

ticker: III


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization ("ISO") 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials. In 2024, the Company achieved a System and Organization Controls 2 ("SOC2") Type 1 against our GovernX platforms, and we are preparing to continue maturity in this area by seeking to attain SOC2 Type 2 in 2025.


text: The Company's cybersecurity efforts are led by the Chief Information Security Officer (" CISO "), who reports to the Chief Information Officer ("CIO") and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cybersecurity disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board ("IEB") and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee ("ISC").


text: Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents, and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.


text: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely our Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high-rated incidents to help align our risk exposure with our strategic objectives. The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.


text: For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across our security domain.


text: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, through the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable. We seek to work directly with any suppliers to address potential deficiencies when identified.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program.

companyName: Vuzix Corp

ticker: VUZI


text: Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and overseen by our information technology function, that are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular exercises and tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Generation Bio Co.

ticker: GBIO


text: Based on an assessment using the previously described risk management program, we do not believe that there are currently any known risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. See " Our internal information technology systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business " in Part I, Item 1A, "Risk Factors" for additional information.


text: Our Senior Director of Information Technology, or IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Director of IT has over 25 years of experience in building, running, and managing diverse functional areas of IT, including but not limited to enterprise cybersecurity, IT infrastructure, operations, business continuity, and service delivery. He began his IT career overseeing datacenter operations for a pharmaceutical company and has held multiple IT leadership positions at biotechnology companies, including serving as the director of cybersecurity and infrastructure at a biopharmaceutical company prior to joining us over four years ago.


text: In an effort to deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention trainings, which cover a range of timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This incident response and prevention training functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: During the fiscal year ended December 31, 2024, we did not experience any cybersecurity incidents that materially impacted, or are reasonably likely to materially impact, our business strategy, results of operations or financial condition. Please refer to the risk factors described in this report under Item 1A, "Risk Factors," for a discussion of the potential impacts of future cybersecurity events.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Our Information Technology ("IT") security department, led by our Chief Information Officer ("CIO") and overseen by our Vice President of Information Systems ("IS"), holds primary responsibility for assessing and managing cybersecurity threats. Our CIO has more than 35 years of experience in IT and holds a bachelor's degree in Management of IS; his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Vice President of IS has more than 20 years of experience in various IT and IS roles, and holds a bachelor's degree in Accounting and Finance.


text: A team of IT Specialists (including a dedicated Senior Cybersecurity Analyst) at our Company monitors cybersecurity and operational risks associated with information security and system disruption. This team employs measures aimed at protecting against, detecting, and responding to cybersecurity threats, and has implemented processes and procedures in line with our information security management system to bolster and advance resilient programs. This encompasses:


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and next generation detection platforms, security automation orchestration and response, and protection platforms designed to stop initial malicious activity. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we have a shared responsibility model with these third parties and require them to implement security programs commensurate with their risk. We cannot ensure that in all circumstances their efforts will be successful.

companyName: WideOpenWest, Inc.

ticker: WOW


text: Our Audit Committee is responsible for overseeing our cybersecurity and data privacy risks. Our cybersecurity program is led by the Hamilton Company's Chief Financial Officer, who, along with the Hamilton Company's Director of Information Technology who has been with Hamilton for 39 years, provide regular updates each quarter to the Audit Committee regarding this program, including information about the cybersecurity threat landscape, investments in infrastructure and opportunities to protect and enhance the Company's systems and security of products and operations. The also Board receives periodic briefings from management regarding cybersecurity activities and initiatives The Partnership's cybersecurity program is designed to safeguard the confidentiality, integrity and availability of data and systems within the Company's environment to effectively support our business objectives and customer needs. Our commitment to cybersecurity focuses on enhancing our prevention, monitoring, and detection response capabilities to identify and respond to evolving threats. We believe cybersecurity is the responsibility of every employee of the Hamilton Company, and it is prioritized each year. We regularly test, educate, and share best practices with employees of the Hamilton Company to raise awareness of cyber threats through a comprehensive security awareness training program. Our Managed Service Provider is responsible for testing our ability to restore our critical infrastructure on a quarterly basis. Additionally, our incident response and disaster recovery plans are reviewed and updated annually. During 2024, we have not encountered cybersecurity challenges that have materially impaired our operations, business strategy or financial condition.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor security and information events on a real-time basis to respond to threats as they occur; Monitor emerging data protection laws and implement changes to our processes to comply; Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; Update key employees regularly on phishing email and other cybersecurity risks; Employ artificial intelligence assisted cybersecurity monitoring capabilities; and Complete regular updates to key software and infrastructure.

companyName: McEwen Inc.

ticker: MUX


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President Finance. The Vice President Finance is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, information technology staff and outside consultants that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks.


text: Cybersecurity Risk Management and Strategy Hanover recognizes that risk is an intrinsic aspect of all areas of our business and activities. Effective risk management is vital to our success. A comprehensive risk management approach is fundamental to maintaining the trust of our customers and the efficacy of our financial services.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: Hanover's Enterprise Risk Management ("ERM") framework leverages the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") principles. This alignment is intended to bolster effective risk management practices that meet regulatory expectations. ERM considers all eight major risk categories including credit, market, liquidity, operational, compliance, reputation, legal, and strategic risk and further enhances the Company's financial resiliency by integrating ERM with our capital and strategic planning processes. Cybersecurity is a major component of the broader operational risk category given the increase in risk due to the increased reliance on technology both for operating processes and delivery channels.


text: Hanover is committed to safeguarding the confidentiality, integrity, and availability of our information assets, including in particular customer information, and information technology environment. The objective of our cybersecurity program is to minimize the potential and impact of cyber threats. Our comprehensive cybersecurity program is designed based upon the National Institute of Standards and Technology ("NIST") cybersecurity framework and in accordance with applicable industry guidance inclusive of Federal Financial Institutions Examinations Council ("FFIEC") Information Security program guidance and NYDFS guidance and requirements.


text: Our cybersecurity governance framework includes documented policies, procedures, and controls designed to mitigate cybersecurity risk. We also perform regular risk assessments of our infrastructure, network architecture, and software/systems using current threat intelligence received from a variety of sources. We employ various preventative and detective controls to block, monitor, and alert for suspicious activity. Additionally, we engage third-party experts to perform periodic internal and external assessments, including penetration testing and vulnerability scanning. We also maintain an ongoing education and training program designed to increase employee awareness and gauge risks relative to the human element. Moreover, we maintain a third-party risk management program designed to identify, assess, and mitigate risks, inclusive of cybersecurity risk, associated with third-party service providers and Hanover's supply chain vendors. Lastly, we engage third-party audit firms to periodically assess our IT general controls and information security.


text: We also maintain an Incident Response Plan that provides a structured framework for addressing potential or actual cybersecurity incidents. The Incident Response procedures and detections/prevention mechanisms are continuously refined to address evolving threats and alerts. This Plan includes the timely notification, escalation, and reporting of cybersecurity incidents to the Bank's Operational Risk Management Committee, Enterprise Risk Management Committee, and the Board of Directors and/or the duly designated ERM Committee of the Board of Directors. It also includes for the timely notification to regulatory agencies, including but not limited to the FDIC, DFS, FRB and SEC as required or deemed appropriate. We also undertake periodic simulations and tabletop exercises to test our Incident Response Plan and ensure business resiliency and proper incident response management.


text: Cybersecurity Governance Our Senior Information Security Officer ("SISO"), who is supported by a team of specialized Information Security and Third-Party Risk Management Analysts, is primarily responsible for the development, oversight, and administration of our Information Security, Business Continuity, and Vendor Risk Management Programs. The SISO has over 25 years of experience in information security, information technology, and enterprise risk management and holds certifications as both a Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA"). The SISO is an active member of the following management-level committees: Incident Response Committee, IT Steering Committee, Change Control Committee, Product Management Committee, Project Management Committee, and Operational Risk Management Committee ("ORMC"). The SISO reports to the ORMC on a quarterly basis, or more frequently if needed, regarding the effectiveness and status of the cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments.


text: The SISO reports directly to the Chief Risk Officer ("CRO"), who has over 35 years of experience in enterprise risk, audit, and compliance. The CRO maintains oversight of entity-wide risk management, inclusive of but not limited to cybersecurity risk.


text: The SISO meets regularly with and works collectively with the Bank's Chief Information Officer ("CIO") and various members of the Information Technology Department as well as third-parties we may employ to assist in this area. The CIO has over 30 years of experience in Information Technology.


text: The SISO also reports to Hanover's Board Enterprise Risk Management Committee on a quarterly basis, or more frequently if needed. Similar to the SISO's management-level reporting, the SISO reports on the overall cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments. The SISO also provides an annual Information Security report to the full Board of Directors and executive leadership team on the overall cybersecurity program, including material risks, key risk indicators, and emerging trends.


text: The ultimate responsibility, among management, for effective risk management, including cybersecurity risk, resides with the Chief Executive Officer ("CEO"). The Bank's CEO and SISO annually certify compliance to the NYSDFS as required under DFS regulations.


text: Material Cybersecurity Risks, Threats, and Incidents Our cybersecurity program has been designed to mitigate risks from cyber-attacks. However, even with a strong internal control environment designed to mitigate risks, Hanover is keenly aware that risks cannot be entirely eliminated. Notwithstanding our cybersecurity program's effectiveness, the threat posed by cyber-attacks remains substantial. Additionally, we maintain cybersecurity insurance designed to further reduce residual risk. Nevertheless, due to the continuously shifting and evolving threat landscape and global geopolitical events, a portion of cyber risk remains inherently beyond full mitigation.


text: While we have experienced cybersecurity incidents in the past, we do not believe any of these incidents have materially affected or are reasonably likely to materially affect the Company or its operations and financial condition.


text: Risk Management and Strategy Our operations include the creation, collection and maintenance of sensitive information, including proprietary and confidential business information, intellectual property, third-party information and employee information. To protect this information, we use external and internal services to managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats on a constant basis. In addition, we use multi-factor authentication (MFA) for external use, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incident response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: We have implemented a Data Protection Policy, or the DPP, in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of our information, data and assets, and to manage identified material cybersecurity risks. The DPP was prepared using relevant guidance issued and technology standards that are used across various industries. It applies to all entities who are using our equipment and resources, including but not limited to, employees and temporary workers. Our Senior Director, Information Technology, is a certified information security officer (CISO). He is primarily responsible for implementing and overseeing the DPP and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: We work with third-party service providers from time to time that assist us to identify, assess and manage cybersecurity risks, including professional SEIM SOC and other services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.


text: No risks from cybersecurity threats have occurred that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.


text: See " Risk Factors – Our internal computer systems, or those used by our third-party contractors or consultants, may fail or suffer security breaches, resulting in liability and harm to our reputation, which could negatively affect our business, results of operation and financial condition. We may face liability if we breach our obligations related to the protection, security, nondisclosure of confidential information or disclosure of sensitive data or fail or are perceived to fail to comply with applicable data protection laws and regulations, or consumer protection laws, regulations and standards. "


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company utilizes a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment. We use a third-party consultant to provide us with advisory, project execution, and operational support in connection with cybersecurity and to conduct NIST assessments and vulnerability evaluations. Cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: Our Vice President of Information Technology, as head of our information technology team, leading our cybersecurity efforts, oversees the day-to-day administration of our cybersecurity program. Our CIRT has members that include our Chief Executive Officer, Chief Financial Officer, Vice President, Corporate & Securities Law, and Vice President of Information Technology. As key members of our management team, our Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology have approximately a combined 48 years of risk management experience and are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Key members of our information technology management team collectively possess over 16 years of hands-on experience in implementing a diverse array of cybersecurity initiatives. Their expertise spans both cloud and on-premise IT infrastructure and applications/systems, cultivated through extensive engagement across various regulated environments.


text: In developing our cybersecurity incident response plan and assessing the maturity of our cybersecurity threat program, we utilize the National Institute of Standards and Technology Cybersecurity Framework (NIST). We use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We make it a practice to continually review the maturity of our program, utilizing the NIST standards and leveraging the feedback of both internal resources and external advisors in an effort to continuously improve our program in relation to evolving cybersecurity threats in our industry.

companyName: ATN International, Inc.

ticker: ATNI


text: Our cybersecurity risk management program includes: risk assessments performed internally and with the help of third-party vendors that are designed to help identify material cybersecurity risks to our critical systems, information, products, services, equipment, and our broader enterprise IT and customer-facing network environments;


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management from time to time on our cyber risk management program. Board members receive presentations and training on cybersecurity topics from our Chief Information Officer (CIO), Vice President of Security, or external experts as part of the Board's continuing education on topics that impact public companies. Our CTIO is an experienced information technology professional with just under 30 years of experience in the networking and communications industries. His extensive experience extends to all facets of information technology, including enterprise applications, cloud and SaaS systems, network infrastructure, and network management. For the past decade, he has been at the forefront of cloud systems development and security. Our VP of Security has over 30 years of experience in IT and Security and has the Certified Information System Security Professional (CISSP) certification as well as various technology vendor certifications.


text: As referenced above, our Risk Council is responsible for day-to-day cyber risk management, and reports to the Audit Committee on these matters. Our management team, including our General Counsel, who serves as the lead of our Risk Council, and our CIO are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal security team is made up of experienced professionals that have an average of more than 25 years of IT and security experience, including certifications such as CISSP, CompTia Security+. We also have developed an internal training program to develop new talent within our organization and work with vendor and third-party training programs to mentor and educate these team members to expand and enhance the capabilities of our team.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through various means, which may include briefings from internal security personnel; and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third-party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our Information Security Program team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.

companyName: First Foundation Inc.

ticker: FFWM


text: We have processes to inform the Directors' Risk Committee, Audit Committee and the Board about risks from cybersecurity threats. Our management team reports its findings using the FFIEC Cybersecurity Assessment Tool and our information security team's determination as to whether our security controls, at a minimum, are in place and effective. The Information Security Officer and Chief Technology Officer regularly report to the Director Risk Committee, Audit Committee and the Board regarding cybersecurity and related threats and trends, changes, control effectiveness and residual risk, the areas where our cybersecurity program may be improved and improvements made to address and remediate issues.


text: We evaluate our cybersecurity strategy annually, including our processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein, within our overall enterprise risk management framework. Our cybersecurity strategy takes a multi-faceted approach, one which focuses on the following key areas: (i) the human element within the Company; (ii) perimeter security; (iii) network security; (iv) application security; (v) endpoint security; and (vi) data security. We use a wide array of processes, mechanisms, controls, technologies, systems, strategies and tools to address these areas, including but not limited to: routine security awareness training, formal evaluations of third-party applications, password strength policies, antivirus software, firewalls, routine patch management, encryption software, data backups and data redundancies, email security software, multi-factor authentication tools, network security monitoring, and web vulnerability scanning.

companyName: XOMA Royalty Corp

ticker: XOMA


text: We engage outside consultants on a regular basis to help us design internal controls and processes that are intended to help address cybersecurity risks. We also leverage these outside consultants and other third parties, when appropriate, to implement appropriate processes, policies, and internal controls designed to help prevent, detect, and/or mitigate these cyberthreats.


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. These threats include but are not limited to: (i) ransomware and malware attacks; (ii) endpoint attacks; (iii) compromised business email and other social engineering threats; and (iv) vulnerabilities related to inadequate patch management. Our licensees, suppliers, contractors, and consultants also face similar cybersecurity risks, which could have an adverse impact on our business.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information technology systems or data or those of our partners or contractors are compromised, our business could experience adverse consequences, including regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; and loss of revenue, income, or profits" and "Compliance with the stringent and changing obligations related to data privacy and security is an onerous and resource-intensive process. Our actual or perceived failure to comply with any data privacy or security obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue, income, or profits; loss of customers or sales; and other adverse business consequences."


text: Our management, led by our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer, is responsible for assessing cybersecurity risks and for overseeing our cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer each have experience in senior leadership roles in which they have been responsible for an entity's enterprise risk management, including management of cybersecurity risks. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer regularly communicate with those responsible for daily IT operations and infrastructure to assess potential cybersecurity threats and determine whether updates to the cybersecurity strategy are necessary.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to our Information Technology Steering Committee, Audit Committee and to our board of directors. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, the Federal Financial Institutions Examination Council ("FFIEC") guidelines. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Technology Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions. We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Our Information Security Officer has 24 years of experience working for financial institutions and has served in the role of Chief Information Officer and Chief Information Security Officer. He is a certified and active Certified Information Security Manager ("CISM") professional. Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact and cyber security awareness. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by department managers and include the Information Security Officer and Chief Technology Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts.


text: The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a quarterly basis (or more frequently as may be required by the Incident Response Plan). The Information Technology Steering and Audit Committees are responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Technology Officer provide quarterly reports to the Information Technology Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee and Audit Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at least quarterly.


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors " above.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: The responsibility for managing and assessing material risks from cybersecurity threats lies with the Company's IT Steering Committee, which met five times during 2024. The IT Steering Committee is made up of five members of senior management having legal or corporate finance backgrounds. The committee also includes one lead representative of the third-party IT management and security service providers utilized by the Company to mitigate cybersecurity risks as discussed above. Information regarding cybersecurity risks and mitigation efforts is reported periodically by the IT Steering Committee to the Company's chief executive officer, chief financial officer, and Audit Committee. The Audit Committee is primarily responsible for the Board of Directors ' oversight of cybersecurity risks. The Company created and hired a new role in early 2025, Vice President of Information Technology and Cybersecurity, which is expected to enhance the management and oversight of cybersecurity.

companyName: Ramaco Resources, Inc.

ticker: METC


text: We perform regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists, and engage independent auditors to periodically review our cybersecurity program, including our process, systems, and control effectiveness, and provide recommendations to continuously strengthen our program. Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness.

companyName: SIERRA BANCORP

ticker: BSRR


text: The Senior Information Security Officer (ISO), along with both the Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program. The Director of IT and Director of Information Services report to the Chief Financial Officer and are responsible for designing and maintaining the company's network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence. The ISO reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities. The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.


text: Our Board of Directors and Board Risk Committee have delegated oversight authority to a management-level Risk Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise. The Risk Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience. The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats. This information is subsequently reported up to the Board Risk Committee.


text: The Board Risk Committee is responsible for oversight of the Company's enterprise risk management program, which encompasses information technology, information security and cybersecurity. This includes management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs. Annual independent assessments of the Company's cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee. The Chief Risk Officer and ISO report to the Board and/or Board Risk Committee on cybersecurity risks. Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Financial Officer and/or the Chief Risk Officer, who will share these with the Company's Executive Officers and Board members, as appropriate.


text: Integrated Risk Management Our cybersecurity risk management program is an important component of, and is integrated into, our overall risk management process. Our Board, acting primarily through the Audit Committee, actively oversees the strategic direction, objectives and effectiveness of our risk management practices, including cybersecurity risk management, while management is responsible for the day-to-day management of the Company's risk exposure, subject to the direction and objectives established by our Board. As an important component of our risk management process, management reviews risks from cybersecurity threats and our programs for evaluating, mitigating and educating its employees regarding cybersecurity risks. The program includes a comprehensive set of security policies and procedures, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessments and penetration testing, to update our ongoing cybersecurity risk identification and mitigation efforts.

companyName: Liquidia Corp

ticker: LQDA


text: We have also implemented a well-established incident response plan to address cybersecurity threats and incidents related to operational risk, intellectual property theft, reputational risks, fraud and extortion, harm to the personal identifying data of employees or customers, violations of laws, and other risks, including procedures for (i) detection and analysis, (ii) containment and eradication, (iii) remediation and (iv) preparation for future incidents. These processes are aligned with standard industry frameworks, such as the National Institute of Standards and Technology, Committee of Sponsoring Organizations and International Organization for Standardization 27001, and other industry standards.


text: Engagement of Third-party Support To further improve the effectiveness of our cybersecurity risk management program, we engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of cybersecurity controls.


text: Third-party Risk Management We also implement third-party risk assessments to identify, assess and monitor material risks from cybersecurity threats associated with the use of any third-party vendor who interacts with our technology infrastructure or our confidential, proprietary, or personal information, or is otherwise part of our supply chain. These assessments include identifying and evaluating cybersecurity risks as part of the due diligence conducted prior to the selection of third-party service providers, recurring risk assessments to ensure such third-party vendors have acceptable levels of cybersecurity controls in place and ongoing monitoring to address material cybersecurity risks that may arise from such third-party relationships.


text: Impact of Risks from Cybersecurity Threats We do not believe that any of the risks from cybersecurity threats we have faced to date have materially affected, or currently viewed as reasonably likely to materially affect, the Company, our business strategy, results of operations or financial condition. However, the scope and impact of any future cybersecurity threats cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity threats in the future. For a description of the risks from cybersecurity threats that may materially affect us, including our results of operations and financial condition, see Item 1A. Risk Factors – We are subject to information technology systems failures, security breaches, loss or leakage of data, technological malfunctions or other disruptions, which could result in, among other things, material disruption of our product development programs, financial losses, the inability to process transactions, the unauthorized release of confidential information and reputational risk, restrictions on accessing critical information and potential exposure to liability, all of which would negatively impact our business, financial condition or results of operations.


text: Board Oversight of Cybersecurity Threats The Board has oversight responsibility for the Company's overall risk management framework. The Board, acting primarily through the Audit Committee, is also responsible for oversight of our risk management practices, including as to cybersecurity, while management is responsible for the day-to-day risk management processes. Through our CEO and other members of management, the Board receives periodic reports regarding the risks facing the Company, including as to cybersecurity risks. In addition, the Audit Committee assists the Board in its oversight role by receiving regular reports from management regarding risks associated with technology, information systems and controls and security, including risks related to data security, cybersecurity and data privacy and the effectiveness of the Company's security controls, systems and policies.


text: Role of Management Our management and information technology teams, collectively, have decades of experience in the areas of information technology, finance, legal, human resources, data privacy and risk management. Our internal information technology organization, overseen by our Controller, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The day-to-day activities of our information technology organization are managed by our current head of information technology, who has more than 30 years of experience in information technology systems and cybersecurity, including experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure, and holds multiple industry-recognized certifications. The information technology organization also engages legal and cybersecurity professionals with appropriate subject matter expertise in support of its cybersecurity efforts. The information technology organization manages and continually enhances our enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur.


text: Incident responses under our cybersecurity incident response plan are led by our incident response team, consisting of our Chief Executive Officer (the "CEO"), Chief Financial Officer (the "CFO"), General Counsel, head of information technology and head of human resources, and supported by Legal, Compliance and other functions as appropriate. The incident response team, in connection with outside legal and cybersecurity advisors, is responsible for investigating suspected cybersecurity incidents, taking appropriate steps to contain, mitigate or resolve a cybersecurity incident and reporting findings to management. In the event of a cybersecurity incident, our General Counsel is responsible for convening a materiality incident response team to assess the materiality of cybersecurity incidents meeting certain escalation criteria. Through ongoing communications with the incident response team, management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity initiatives. Management provides regular updates to the Audit Committee and the Board concerning the Company's technology and cybersecurity programs, associated risks and our efforts to help mitigate those risks.


text: We partner with third parties to support and evaluate our cybersecurity program. The Services provided by third-parties span areas including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: In 2024 and 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, ETI experienced a previously disclosed network security incident which had material adverse impact and required ETI to, among other things, limit access to its applications and services by its employees and customers. In response, ETI incurred considerable costs to restore the security of its internal systems and networks and adopted various enhancements. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. Please refer to " Item 1A. Risk Factors " for further information about the material risks associated with various cybersecurity threats.


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, the Company has not detected any material cybersecurity incident to our own systems. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, or financial condition.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: The Company's information technology resources are managed by the Information Technology Department, which is responsible for the first line of defense – identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (CIO), who reports to the Company's President and CEO. The present CIO has been employed by the Company in the information technology area for three years and was previously the CISO at the Company for two years. The present CIO has over 36 years of IT experience, 13 of that in banking. The CIO holds a current Certified Information Systems Security Professional (CISSP) designation.


text: The Chief Information Security Officer (CISO) whose responsibilities constitute the second line of defense provides the vision, leadership, and strategies necessary to protect the information security of the Company. The CISO manages policy, procedure, and process to ensure the execution of the Company's Information Security and Business Continuity/ Disaster Recovery (BC/DR) Programs. The CISO reports directly to the Chief Risk Officer to provide segregation between the first and second line of defense. The Information Security Department, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Company's information systems, and monitors implemented security measures. The CISO has over 30 years of IT and IT security experience in various organizations with 14 years in the banking industry.


text: The Company has established a Management Technology Committee and a Board Technology Committee. These Committees provide oversight and governance of information technology and the Information Security Program and meet quarterly. The Board Technology Committee's responsibilities include: (1) monitoring the strategic deployment and usage of Information Technology throughout the Company using reports and presentations from management;


text: (2) oversight of cybersecurity preparedness through information security reports, discussion of internal events and discussion of cybersecurity topics pertinent to the Company and the industry; (3) oversight of activities in support of the Company's business continuity/disaster recovery program to ensure optimal corporate resiliency in the unlikely event of a disaster; and (4) providing broad strategic guidance on the technology direction of the Company by, among other things, overseeing the development of the AmeriServ Strategic Technology Plan.


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and EchoStar's Board of Directors as a whole to ensure accountability.

companyName: DISH DBS CORP


text: With oversight from the Board of Trustees, the Advisor is responsible for managing all cyber risks and overseeing our security programs. Cybersecurity risk management has been delegated to the Advisor's executive officers, with day-to-day management carried out by the Advisor's Chief Financial Officer (CFO), Elizabeth Reich.

companyName: Sterling Real Estate Trust


text: The Advisor 's cybersecurity risk oversight includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, (iii) confirming the Advisor has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident, and (iv) mandatory cyber security trainings for all Advisor personnel.


text: The Advisor partners with several third-party technology providers to monitor and protect internal IT infrastructure and data. The Advisor has hired Marco Technologies as the organization's Managed IT provider with tools that systematically update hardware and software while also monitoring uptime to ensure seamless business operations. Marco Technologies also provides cyber security trainings, which all Advisor personnel are required to complete on a monthly basis. The Advisor utilizes Red Canary to provide 24/7 monitoring on all end points with triggers to isolate and mitigate any suspicious cyber activity. Finally, High Point Networks provides physical and cloud-based network data backup solutions for the Advisor. In collaboration with the Advisor, an extensive data back-up plan is in place with Return to Operations objectives of less than 24 hours. Although our CFO does not come from an information technology background, she relies on her extensive organization and project management experience to coordinate and manage the third-party providers who perform our cybersecurity function and to implement our cybersecurity incident response plan described below.


text: Our cybersecurity risk management program includes multiple components, including information security maturity assessments, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. We also conduct employee training and leverage third-party security tools, including but not limited to access controls, threat monitoring, and endpoint protection and response. We maintain a security operations center operated by a third party that collects cybersecurity threat data from multiple internal and external sources and determines if activity is potentially suspicious or malicious. We are in the process of developing and implementing additional cybersecurity policies and procedures.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors experienced threats and security incidents that could affect our information or systems. For more information, please see Section 1A. Risk Factors.


text: Cybersecurity Governance Our Director of Cybersecurity is responsible for the strategic leadership and direction of the Company's information security organization. The individual currently serving as the Director of Cybersecurity has over twenty years of experience working in information technology. The Director of Cybersecurity receives cybersecurity alerts from the Company's third-party security operations center, and provides periodic updates to the Head of Information Technology who informs the Company's executive committee, which includes the Company's Chief Executive Officer, Chief Operating Officer and, Chief Financial Officer.


text: Risk Management Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative ("CSI") committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization. The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: We employe an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, penetration testers, and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Operating Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned "A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business" in Item 1A. Risk Factors.


text: Our Information Security Officer is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line's activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as Information Technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has the necessary relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the CSI Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. There are also three technology steering committees that plan and guide technology projects in alignment with the Corporation's strategic plan. These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, violation of privacy or security laws and other litigation and legal risk; and reputational risks. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.

companyName: MetaVia Inc.

ticker: MTVA


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards. We work with a third-party provider to monitor threats and potential cybersecurity breaches.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or reported by our third-party monitoring service that may affect our information services and have processes to assess those issues for potential cybersecurity impact or risk. We impose security requirements upon our suppliers and CROs, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.