text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 18 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external and internal control validations to assess our processes and procedures and the threat landscape, and we maintain a vulnerability management program designed to identify vulnerabilities and coordinate remediation efforts for any identified vulnerabilities in the environment. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, and vendors. Results of these ongoing activities are reported quarterly to management through the Cyber and Information Technology Steering Committee. In addition, we periodically perform simulations and tabletop exercises at the management level and incorporate external resources and advisors as needed. All employees are required to complete information security training at least once every year, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: SouthState Bank Corp

ticker: SSB

secItem: Item 1C


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile. The review assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.


text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from our CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure." in Item 1A- Risk Factors.


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party vendors. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our risk management and compliance program.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise-wide risk management and compliance program and overseen by the Audit Committee, and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk Management and Strategy As one of the critical elements of the Company's overall risk management and compliance approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is led by the Audit Committee of the Board, which regularly interacts with our Chief Compliance Officer, our Executive Director of IT, and other members of management.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, Security Information and Event Management systems, Extended Detection and Response with 24/7 Security Operations Center, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the Executive Director of IT.


text: Our Executive Director of IT, in coordination with our executive management team, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Executive Director of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our Executive Director of IT has over 28 years of experience in leading IT teams and managing cybersecurity in several industries including biotech, media and consumer products. He has hands-on experience as an IT network engineer and systems administrator, configuring and hardening systems against security threats. In addition, he has previously held executive-level leadership IT roles. Throughout his career, he has kept abreast of new developments in cybersecurity and has implemented industry standards to secure IT infrastructure and systems. He works closely with the Company's IT managed service provider to assess all security incidents and events and escalate as needed.


text: Risk Management and Strategy We employ risk management, mitigation and prevention strategies based on frameworks provided by the National Institute of Standards and Technology ("NIST") regulation standards, third party cyber service providers, and common industry practices. These frameworks are applied across all network, hardware, software and communication platforms whether the platform is self-hosted or provided as a service. We leverage a Risk Assessment Score ("RAS") based on these standards against any internal networks, platforms, technologies or initiatives as well as any perimeter or connected partner, vendor or third-party service.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Our cyber posture, policies and in-production procedures are designed and developed to manage and minimize risk, threat, or loss to business processing, business objectives and business assets as well as protecting the integrity, confidentiality and personal identifying information ("PII") of our employees and partners.


text: Our security team is intentionally comprised of internal personnel with a range of technical, legal and management disciplines as well as external, third-party cyber service providers, auditors and technical consultants. This allows for broader monitoring, objective reporting, controlled policy, decreased recovery time objectives and quicker incident response.


text: We maintain cybersecurity risk insurance, conduct threat scenario exercises, provide end user cyber awareness and security training, perform regular vulnerability audits and formally report the relevant results, statuses or assessments to our senior management team or other identified key stakeholders.


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is certified as a Secure Infrastructure Specialist, Security Specialist, Network Specialist and IT Operations Specialist. Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor. Our Cyber Incident Response Plan includes direction and formality on what events are immediately reported and to whom.


text: Our cyber policies are based on NIST and cyber coverage standards, requiring formal written policies, procedures, plans of action, general security plans and regular audits.


text: The Company's cybersecurity program, identified events, current and future strategies are presented to the Audit Committee for periodic review. The Audit Committee may choose to present relevant information to our board of directors (the "Board") as deemed necessary.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy, Written Information Security Policy and Incident Response Plan with Stellus Capital Management (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy also sets forth the role of our Chief Compliance Officer and our Information Security Team in preparing, implementing, and maintaining incident response procedures.

companyName: Stellus Capital Investment Corp

ticker: SCM


text: Our Chief Compliance Officer and Information Security Team are responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. At times we may also engage assessors, consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of Stellus Capital Management who provide services to us pursuant to the Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors," in this Annual Report on Form 10-K under the heading " We, Stellus Capital Management and our portfolio companies are subject to risks associated with "phishing" and other cyber-attacks. "


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Team as needed, but no less frequently than annually. On at least a quarterly basis, the Information Security Team reports to our Board on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and Information Security Team's evaluation of cybersecurity risks that are material to us.


text: Our Senior Vice President of Information Technology, a certified CISSP, who reports directly to the Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Information Technology. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program, which is based on recognized industry standards and frameworks, is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Consolidated Communications Holdings, Inc.


text: Cybersecurity Governance Our Board of Directors (the "Board") regularly considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents.


text: The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics which may pose potential impacts to the Company's operations from our Chief Technology Officer. Board members also receive external training or attend seminars on cybersecurity topics that impact public companies as part of their continuing education.


text: Our management team, including our Chief Technology Officer, Senior Director of Information Security and other members of the IT team are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer joined Consolidated in 2017 and has more than 30 years of communications industry experience. Prior to joining Consolidated, he served as the Chief Technology Officer at FairPoint Communications, Inc. and also held key leadership roles at Comcast and Level 3 Communications.


text: Our management team oversees the efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; as well as providing ongoing cybersecurity awareness training for our employees including management.


text: Risk Management and Strategy Cybersecurity and privacy incidents in the pharmaceutical industry are growing in frequency and severity, prompting organizations to invest heavily in people, processes, and technology to bolster their cybersecurity risk management capabilities.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We assess the integrity of our information technology and cybersecurity platforms to help ensure proper safety measures are implemented. We understand the extensive responsibility associated with safeguarding our systems and data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include:


text: Detection and Prevention: We utilize various securities tools and technologies designed to prevent, identify, protect, detect, escalate, respond and recover from cyber threats in a timely manner. Our approach includes real-time monitoring, threat analysis, and regular security evaluations to identify and mitigate potential vulnerabilities.


text: User Training & Education: We realize that human error can be a significant cybersecurity risk, so we have implemented education and training programs for our staff to raise awareness about cybersecurity best practices. By promoting a culture of security consciousness, we empower our staff to identify potential threats and respond effectively, in a way that is designed to enhance the overall cybersecurity posture of our organization.


text: Incidence Response and Business Continuity: We have comprehensive Incidence Response and Business Continuity plans in place designed to ensure the continuity, availability and accessibility of our systems and data, even in the face of unforeseen events such as natural disasters or cyber incidents, which plans and systems we test regularly.


text: We rely upon the capacity, availability and security of our information technology hardware and software infrastructure. We maintain comprehensive compliance and security programs designed to help safeguard and ensure the integrity of the confidential information we possess, which includes both organization and technical control measures. We routinely conduct employee trainings on important information security procedures and test and measure compliance with these security measures. In addition, we maintain cyber insurance policies that mitigate the financial risk of any potential incident.


text: We engage consultants, auditors, and other third parties in connection with such processes. We work with third-party service providers to assist us in our cybersecurity risk management to identify areas that may potentially impact our business, develop and implement control framework to mitigate such cybersecurity risks, and to be prepared to respond to and report (as required) applicable cybersecurity incidents.


text: We face a number of risks including the growing threat of cybersecurity attacks. Despite our implementation of security measures to combat the threats of cybersecurity attacks, any system failure, accident or security breach could result in disruptions to our operations. To the extent that any disruption, cybersecurity attack or other security breach results in a loss or damage to our data or inappropriate disclosure of confidential information, our business could be harmed. In addition, we may be required to incur significant costs to protect against damaged caused by these disruptions or security breaches in the future.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity challenges (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.


text: Our Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management. This committee periodically reviews and assesses the risk exposure of our risks related to data privacy, technology and information security, including cyber-security, and back-up of information systems and makes recommendations to our Board of Director pertaining to monitoring and minimizing findings in such assessment. This committee periodically reports to the Board of Directors.


text: While the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management, our management also plays an integral role in cybersecurity oversight. Our management is responsible for day-to-day risk management processes. This includes periodic updates from the Executive Director of Information Technology who has over 23 years of work experience in the life science industry, and holds an undergraduate degree in Industrial Technology. The Executive Director of Information Technology is responsible for managing the daily measures of safeguarding the information technology infrastructure from potential threats and vulnerabilities, which includes monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, we have established a Crisis Management Team (CMT), which is a team of cross-functional participants who are prepared to review and assess any potential cybersecurity incidents. The CMT team is led by our CFO and our General Counsel who will advise the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee of the Board accordingly in the event of any incident. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that the Board leadership structure supports this approach.


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes several safeguards, such as password protection; multi-factor authentication; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic audits and incident response simulations; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: MARINUS PHARMACEUTICALS, INC.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including providing our code of conduct to our vendors and conducting due diligence in connection with onboarding new vendors.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a cybersecurity incident response program. Pursuant to the program and its procedures, a Security Incident Response team (SIRT), which is a team lead by the Head of IT and comprised of cross-functional personnel, is responsible for handling potential cybersecurity incidents. We also maintain business continuity and disaster recovery plans in the event of a significant cybersecurity incident.


text: We have relationships with a number of third-party service providers to assist with cybersecurity event and incident identification, response, containment and remediation efforts.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Chief Financial and Operating Officer. Our Head of IT is responsible for the day-to-day management of the cybersecurity program and provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters and reports up to the full Board of Directors. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures.


text: The Head of IT updates the Chief Financial and Operating Officer who apprises the Audit Committee and Board of Directors of cybersecurity incidents consistent with our cybersecurity incident response plan promptly for any cybersecurity incidents, if applicable.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management (ERM) process. As part of our ERM process, cross-functional leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity.


text: We also maintain specific coverage to mitigate losses associated with certain cybersecurity incidents. To date, we have not experienced any material cybersecurity incidents or threats. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors.


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.


text: Board Oversight of Cybersecurity Risks The board of directors of the Company ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Information Security Officer ("CISO") of the Investment Adviser and Chief Compliance Officer ("CCO") of the Company regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's Management, including the Company's CCO and the CISO of the Investment Adviser manage the Company's cybersecurity program, under the supervision of the Company's Chief Executive Officer. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Investment Adviser's CISO has 23 years of experience actively managing cybersecurity and information security programs for financial services companies with complex and evolving information systems. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has worked in the financial services industry for over 20 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Cybersecurity Risk Management and Strategy Allient has processes in place to assess, identify, and manage material risks from cybersecurity threats. We regularly undertake audits and evaluations (including to the National Institute of Standards and Technology (NIST) SP 800-171 standards) and enhance our security framework based upon the results of those audits and evaluations. For new associates, and on an annual basis thereafter, we require associates to take security awareness training and conduct on-going phishing recognition training and testing programs.

companyName: ALLIENT INC

ticker: ALNT


text: We have integrated cybersecurity risk management into our enterprise risk management program, and our management, lead by our Global Information Technology Director, regularly review cybersecurity risks. We rely extensively on information technology ("IT") systems for the storage, processing, and transmission of our electronic, business-related information assets used in, or necessary, to conduct business. We leverage our internal information technology infrastructures, and those of our business partners, to enable, sustain, and support our global business activities. In addition, we rely on networks and services, including internet sites, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors, to assist in conducting our business.


text: Numerous and evolving cybersecurity threats pose potential risks to the security of our IT systems, networks and services, as well as the confidentiality, availability and integrity of our technology systems and data. In addition, the laws and regulations governing security of data on IT systems is evolving and adding another layer of complexity in the form of new requirements.


text: Over the last three years, we have experienced one known information security breach, in connection with a ransomware incident that occurred in June 2021. Costs incurred related to the information security breach did not have a material adverse effect on our results of operations in the years ended December 31, 2023, 2022, and 2021. However, as cybersecurity incidents continue to increase in scope, complexity, and frequency, we may be unable to prevent a significant incident in the future which may materially impact our results of operations.


text: Our cybersecurity program engages third parties when necessary. In the past, we have had cybersecurity incidents and we have made, and continue to make investments, seeking to address these threats, including monitoring of networks and systems, hiring of experts to evaluate and test our systems, employee training and security policies for employees and third-party providers. All third parties that we use have been vetted and have significant reputations in the industry. As such, controls from the third-party vendors have been deemed to be adequate prior to any goods or services having been provided.


text: Cybersecurity Governance Management is responsible for the development of all cybersecurity programs, including the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Board receives quarterly reports regarding the overall cybersecurity risk management process. The Board and Audit Committee are responsible for information security oversight. Two members of the Company's Board have relevant information security and cybersecurity experience. As part of their oversight, senior leadership meets with the Audit Committee at least annually to discuss information security and cybersecurity matters.


text: For additional information regarding risks related to information technology and cybersecurity, as well as governance related to managing such risks - see also Item 1.A: Risk Factors.


text: Risk Management and Strategy. We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. Our general risk management strategy is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: We rely on a multidisciplinary team (including from our information security function, management, and third party service providers, as described further below) to assess how identified cybersecurity threats could impact our business.


text: These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; credit and background checks on our and/or third parties' personnel; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; red/blue team exercises; cyber insurance; dedicated cybersecurity staff/officer.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks. Governance.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the Vice President of Finance, who reports to the CEO. The Vice President of Finance has over 15 years of experience as a Certified Public Accountant specializing in internal controls and U.S. GAAP. The CEO has nearly 25 years of experience in management including serving as a CFO and CEO of publicly traded life science companies as well as holding an MBA for New York University's Stern School of Business. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We have processes in place to regularly assess, manage and identify potential risks from cybersecurity threats. Our cybersecurity policies and processes are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools and processes that are designed to help identify and investigate any security incidents in a timely manner. When any risk or threat is identified we have a designated group of individuals including representatives from our information security team, finance team, compliance teams and legal teams who are involved in the assessment of the risk based on probability and potential impact to key business systems and processes. Risks that are considered to have a high impact to our business are incorporated into our enterprise risk management program. The tracking of these risks and the processes we have in place to address cybersecurity threats are and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Adaptimmune Therapeutics PLC


text: As part of our overall risk management system, we train our staff on the safeguards we have in place to mitigate cybersecurity threats and ensure employees are able to identify potential attempts to breach our security and how to report and deal with any potential threats.


text: We have not identified any cybersecurity threats that have materially affected our ability to conduct our business or our financial standing. Refer to the risk factor captioned " Our internal information technology systems, or those of our partners, third-party CROs or other contractors or consultants, may fail or suffer cybersecurity incidents, including related to data protection and privacy laws and adversely affect our business and operations " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks. The Audit Committee of the board oversees our risk management program on behalf of the Board of Directors, which focuses on the most significant risks. Audit Committee meetings include discussions of any specific risk areas which are significantly increasing or which are of particular concern.


text: We have introduced corporate policies and training on these policies for all of our staff. Our Information Management team, and in particular our information security team together with the corporate compliance team are responsible for ensuring compliance with these corporate policies. Our Chief Operating Officer oversees our policies and is primarily responsible to assess and manage material risks from cybersecurity threats, with assistance from third party experts as appropriate.


text: We leverage well-known and established third parties as industry partners to support our key business processes and utilize the services of reputable external advisory firms for running important functions such as cybersecurity assessments and technical security management activities, including network security management.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: We engaged an independent cybersecurity advisory service firm to perform a focused cybersecurity assessment to better understand our current cybersecurity threats and risks and build a foundation for establishing a cybersecurity risk assessment framework to identify, assess and manage cybersecurity risks arising from our business operations.


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our operations or financial standing. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us.


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees our risk management program, which focuses on the most significant risks we face. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity. Our Chief Financial Officer or Chief Operating Officer reports on our enterprise risk profile on an annual basis or as needed. Our Audit Committee also engages with external counsel on legal matters related to cybersecurity incident management and reporting.


text: Our Chief Financial Officer and Chief Operating Officer are jointly responsible for managing cybersecurity risks and implementing the required policies across the Company. Our Chief Executive Officer is responsible for making strategic decisions and approving external communication releases related to cybersecurity risks or incidents.


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the Compensation and Services Agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Chief Financial Officer and Senior Vice President-Financial. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is, required to be made).

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: Our internal auditor performs certain procedures to test the integrity and functionality of our IT systems (which includes a high-level review of our cybersecurity defenses). In addition, we have retained a third-party cybersecurity consulting firm that (i) advises us as to cybersecurity matters (including prevailing cybersecurity threats), (ii) performs, on a periodic basis, assessments of our cybersecurity defenses and (iii) on a continuous basis, monitors our IT systems for cybersecurity threats and intrusions.


text: The Company is committed to maintaining a strong cybersecurity posture devoting significant resources to cybersecurity and risk management processes to adapt to the rapidly evolving landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company has designed and implemented cybersecurity policies and procedures for identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular basis. At the tactical level, our information technology (IT) security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The Company monitors and evaluates our cybersecurity position and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Additionally, the Company maintains a formal information security training program for all employees that includes training on matters such as phishing, email security best practices and data privacy. To evaluate and enhance our cybersecurity program, it is regularly evaluated by external experts with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: Oversight of cybersecurity risk is maintained by the Company's Board of Directors and is supported by the Audit Committee of our Board of Directors (Audit Committee). The Audit Committee is primarily responsible for overseeing our design, execution and administration of the Company's enterprise risk management process, and with regard to cybersecurity risks, setting expectations and accountability for management and reviewing management's assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks and overseeing the Company's cybersecurity disclosures. The Company's information security program is managed by the Company's Director of IT, whom reports to the Chief Financial Officer (CFO), and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Director of IT periodically briefs the Audit Committee and our CFO, as well as our Chief Executive Officer, other members of the Board of Directors and other members of our senior management as appropriate. These reports include, but are not limited to, new developments, evolving standards, vulnerability assessments, third-party and independent reviews, threat environment summaries and technological trends. When applicable, the Audit Committee and other members of the Board of Directors also receive prompt information from the CFO regarding any material cybersecurity incident and appropriate ongoing updates thereto.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on the Company will not occur in the future. In response to the rapidly evolving cyber threat environment, the Company continues to invest in data security and system resiliency. See also Item 1A, "Risk Factors" for additional discussion regarding risks related to information technology systems.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from our Board of Directors (the "Board"), Board committees, employees and third-party experts. The Board, Audit Committee, Technology and Innovation Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology ("IT") team reviews cybersecurity risks periodically, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response. These policies go through an internal review process by members of management and appropriate Board committees, as applicable.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: The Company's President and Chief Information Officer, who has over a decade of experience leading information and cyber security oversight, is responsible for developing and implementing our information security program, overseeing our IT team and reporting on cybersecurity matters to the Technology and Innovation Committee. We view cybersecurity as a shared responsibility, and we consult with third-party resources and advisors as needed on information security maturity assessments, penetration testing, dark web reviews, best practices to address new challenges, and, when applicable, digital forensics. All employees are required to complete annual information security trainings and have access to more frequent online information security trainings.


text: We continue to prioritize our investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting capabilities and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. Further, we conduct periodic external penetration tests, bug bounty hackathons and maturity assessments to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, the Audit Committee and the IT security team also consider and evaluate cybersecurity risks associated with use of third-party service providers.


text: We recently created a new Technology and Innovation Committee of our Board to oversee jointly, alongside the Audit Committee, matters of technology, innovation, cybersecurity and information security. The Technology and Innovation Committee also provides advice and guidance to management on these matters. The Technology and Innovation Committee, Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Technology and Innovation Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. The Audit Committee oversees cybersecurity disclosures and receives periodic reports from management and the Technology and Innovation Committee. Further, the Technology and Innovation Committee and Audit Committee periodically discuss the Company's actions to identify and detect threats, as well as its cybersecurity strategic roadmap.


text: In the fiscal year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Risks Related to Our Technology Infrastructure" in Item 1A-Risk Factors.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility, and availability of company data stored, processed, or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Our corporate cybersecurity program is led by our chief information officer (CIO), who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews enterprise risk management level cybersecurity risks annually. Our CIO reports to our chief executive officer.


text: We continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls through penetration testing, red team testing, consulting on best practices, and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least twice a year and have access to more frequent cybersecurity training through online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to our response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief financial officer, chief operating officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Our IT team is responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to the CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC committee performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CIO and chief financial officer, regularly briefs the board of directors on our cybersecurity and information security posture, and the board of directors is apprised of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. The full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification. This includes notifying functional areas (such as legal and human resources), senior leadership, and the board as appropriate.


text: We face a number of cybersecurity risks in connection with our business. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.


text: Risk Management and Strategy The Company maintains a cybersecurity risk management program designed to mitigate cybersecurity risks through a comprehensive framework that integrates cybersecurity into the Company's overall risk management processes.

companyName: EVgo Inc.

ticker: EVGO


text: Risk Assessment. The Company's internal cybersecurity team conducts regular assessments designed to identify vulnerabilities within the Company's systems and processes. These assessments are part of the Company's ongoing risk management strategy and inform strategic decisions regarding security investments and policy developments. The internal risk assessment process includes periodic reviews of the Company's charging infrastructure, software applications and operational procedures against best practices and address current and potential threats.


text: To augment the Company's internal efforts, the Company engages third parties to conduct independent assessments of the Company's cybersecurity posture. These external assessments provide an objective review of the Company's security controls, breach readiness and compliance with industry standards and regulations. The insights gained from these audits inform refinements to the Company's risk management strategies with respect to cybersecurity-related threats.


text: Cybersecurity Policies and Procedures. The Company maintains a set of cybersecurity policies and procedures that are regularly reviewed and updated. These policies are crafted in accordance with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides a policy foundation for critical infrastructure security. These policies govern the Company's cybersecurity program, including but not limited to access control, system development life cycle management, change management, and incident response.


text: Monitoring Controls. In addition to the Company's cybersecurity policies and procedures, the Company places a significant emphasis on monitoring controls as a critical component of its cybersecurity strategy. These controls are designed to enable the Company to consistently oversee and evaluate the effectiveness of the Company's cybersecurity measures to help ensure prompt detection of and response to potential threats or anomalies.


text: The Company maintains a continuous monitoring strategy that utilizes advanced tools and technologies to oversee the Company's network infrastructure and digital assets. This includes data loss prevention controls, system log reviews and unusual activities that could indicate a potential security breach. Automated alert systems deployed as part of the Company's monitoring controls are designed to enable rapid identification and escalation of suspicious activities. These systems are configured to detect a range of cyber threats, from malware infections to unauthorized access attempts.


text: Cyber Incident Response and Reporting. The Company's Security Incident Response Policy is designed to enable prompt and effective action in the event of a cybersecurity incident to safeguard the Company's information technology systems, customer data and overall business operations. The Company is cognizant of the ever-evolving landscape of cybersecurity threats and their potential to materially impact the Company's operations. To date, the Company does not believe that it has experienced any cybersecurity incidents that have had a material adverse effect on the Company's business strategy, operations or financial condition. However, the Company recognizes that cybersecurity threats are a significant risk factor for any organization, especially those involved in digital infrastructure. See Part I, Item 1A, "Risk Factors," for further discussion.


text: Detection and Analysis. Under the Security Incident Response Policy, all EVgo employees and other personnel are responsible for reporting any known, suspected or possible security events, including those that may have originated with a third-party service provider, to the Company's Information Security Department, which promptly notifies the Company's President, who serves as the Company's Information Security Coordinator. The Information Security Coordinator reviews the initial facts and findings regarding any security events, provides direction to the Information Security Department regarding any additional information that should be obtained, and convenes a meeting of the Company's Security Incident Response Team (the "SIRT") to review the matter, including to determine if the event could constitute a security incident.


text: The SIRT is composed of employees with expertise in various aspects of EVgo's operations including information security, information technology, DevOps, legal, and EVSE engineering, as well as senior leaders, including EVgo's President, Chief Financial Officer and Chief Legal Officer.


text: Materiality Assessment, Mitigation and Reporting. Under the Company's Security Incident Response Policy, the SIRT, under the leadership of the Information Security Coordinator, is responsible for promptly assessing the materiality of security events, developing the Company's response to such events and, if a security event is determined to be a material incident, to oversee the Company's disclosures regarding the incident as required by the rule adopted by the SEC related to cybersecurity disclosures. In determining whether a security event could constitute a security incident, the SIRT considers all facts and known information, including (without limitation) the potential harm to customers, employees and other parties; possible effects on the Company's operations, financial statements, brand perception, reputation, customer or vendor relationships and competitiveness; the risk of fraud, extortion or intellectual property theft; litigation, regulatory and other legal risk; and other potential impacts. The Chair of the Audit Committee is informed of the SIRT's review of cybersecurity events and its determinations as to the materiality of such events. The Security Incident Response Policy also includes procedures for the SIRT to coordinate the containment, eradication, mitigation, recovery and remediation related to security events and security incidents and the implementation of procedures and actions designed to prevent additional security events in the future.


text: The Company also conducts regular cybersecurity training for employees to ensure they are aware of potential cybersecurity threats and understand the role they play in maintaining the Company's defenses. The Company also monitors evolving regulations and standards to ensure that the Company's practices align with industry best practices and legal and regulatory obligations.


text: Board Oversight of Cybersecurity. The Audit Committee of the Company's Board of Directors (the "Audit Committee"), acting pursuant to authority delegated by the full Board of Directors, actively oversees the Company's cybersecurity strategy and risks from cybersecurity threats, as well as the Company's broader enterprise risk management framework. The Company's management-level Enterprise Risk Committee meets regularly to review the Company's risk profile and develop mitigation strategies with respect to those risks. The Audit Committee reviews the enterprise risk matrix prepared by the Enterprise Risk Committee on an annual basis.


text: Board's Oversight Role. The Audit Committee reviews and assesses the Company's risk management program and cybersecurity activities and strategy to help align with the Company's business objectives and compliance with legal and regulatory standards. These updates include reviews of new or evolving cybersecurity threats, the Company's cybersecurity measures, the results of recent third-party security audits, and assessments and oversight of any recent cybersecurity events with certain characteristics that may have occurred. This oversight role includes evaluating the effectiveness of policies and procedures designed to protect Company assets and sensitive customer information from cyber threats. The Chair of the Audit Committee regularly reports on the Audit Committee's oversight activities related to enterprise risk management and cybersecurity to the full Board of Directors. The Information Security Coordinator promptly notifies the Chair of the Audit Committee of any security events reviewed by the SIRT, the SIRT's determination of whether a security event is reportable on Form 8-K pursuant to the SEC Cyber Rule and the factors underlying that determination. If the SIRT determines that a cybersecurity incident is likely material and therefore reportable on Form 8-K, a draft of the Form 8-K will be provided to the Audit Committee for review and comment prior to the Company filing the Form 8-K within the deadline specified by the SEC Cyber Rule. The Audit Committee's active engagement with and oversight of the Company's cybersecurity program helps foster a culture of security awareness throughout the Company.


text: Risk Management and Strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, products and our critical data (including intellectual property and confidential information that is proprietary, strategic or competitive in nature, and clinical trial data) (collectively, "Information Systems and Data").

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Our Executive Director of Information Technology, or IT, and other relevant personnel help identify, assess and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We (including the Executive Director of IT) use various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal audits, conducting threat assessments, conducting third-party threat assessments, conducting vulnerability assessments, and arranging a managed detection and response process with a third-party vendor.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response measures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls, data segregation, access controls, physical security, asset management (such as tracking and disposal of our information systems), systems monitoring, a vendor risk management program, personnel training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Executive Director of IT works with executive management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our Executive Director of IT and executive management also evaluate material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of our Board of Directors, or the Board.


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers may provide services related to: threat intelligence, cybersecurity practices, cybersecurity software, managed cybersecurity response, penetration testing, dark web monitoring, forensic investigation, and professional services (including legal counsel).


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We maintain a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment or auditing for certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify, mitigating and manage cybersecurity risks associated with a particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the subsection titled " Our information systems, or those of others upon whom we rely (such as our CROs, contract manufacturers, contractors, consultants, service providers, collaborators and others) may fail or suffer cybersecurity breaches, loss or leakage of data or other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability that could adversely affect our business. "


text: Our Board performs oversight of our risk management process. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various standing committees of the Board that address risks inherent in their respective areas of oversight. In particular, the Board is responsible for monitoring and assessing strategic risk exposure, including a determination of the nature and level of risk appropriate for us. The Board is also focused on emerging risks, as well as risk mitigation strategies. As part of its risk mitigation duties, the Audit Committee monitors cybersecurity risk and mitigation of such risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Executive Director of IT, who has 25 years of experience developing and deploying network and data security policy and technology.


text: The Executive Director of IT and Chief Financial Officer, or CFO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key cybersecurity priorities to relevant personnel. The Executive Director of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members, including the CFO, depending on the circumstances. The CFO, Executive Director of IT, and Vice President of Finance work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee of the Board for certain cybersecurity incidents.


text: The Audit Committee receives reports from the Executive Director of IT concerning our significant cybersecurity threats and risks, as well as the processes we have implemented that are designed to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within our information technology ("IT") and risk management systems and addresses both the corporate and the operational IT environment.

companyName: W&T OFFSHORE INC

ticker: WTI


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology (the "NIST"), the Control Objectives for Information Technologies ("COBIT") framework and the International Organization Standardization 27001, Information Security Management System requirements. We have an annual assessment, performed by our internal audit department, of our cyber risk management program against the NIST and COBIT frameworks.


text: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. We have adopted a Cybersecurity Incident Response Plan that applies if a security event occurs. Our Incident Response Plan provides a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting, and responding to security events that are identified by or reported to the Chief Information Officer (CIO). Our Incident Response Plan applies to W&T personnel including contractors and partners that perform functions or services that require securing W&T information assets, and to all devices and networks that are owned by W&T. The Incident Response Plan details the coordinated, multi-functional approach for investigating, containing, and mitigating incidents. Under our Incident Response Plan, cybersecurity incidents are escalated based on a defined incident categorization to the CIO and the General Counsel. Regular updates are provided by the Cybersecurity team to the CIO, who will maintain communication and information flow to senior leadership including the General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders as well as the Audit Committee and/or the Board of Directors as appropriate. Generally, our incident response process follows the National Institute of Standards and Technology (NIST) framework and focuses on preparation; detection and analysis; containment, eradication, recovery and post-incident remediation.


text: We conduct mandatory security training during new employee onboarding, as well as require our employees to complete annual security risk training and, when necessary, perform additional updated training. We also engage certain third-parties in assessing, identifying and managing cyber-security risks. These third parties perform a number of services, including managed detection and response services for information technology endpoints, anti-virus monitoring, penetration testing, and other miscellaneous cyber security programs and services. We maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under our third-party assessment process, we gather information from certain third parties who contract with us and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.


text: The Audit Committee of our board of directors oversees our cybersecurity policies, procedures, risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Our executive management, including our Vice President and Chief Information Officer, periodically updates and reports to the Audit Committee and the board of directors regarding cybersecurity risk exposure and our cybersecurity risk management strategy (at a minimum, once per quarter). Additionally, all members of the board of directors attend quarterly training sessions through internal and external IT specialists, which include review of IT whitepapers, presentations, and other learning materials. Each of the members of the board of directors has also completed certificated training concerning IT security, IT fraud, and other common enterprise-level IT threats.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. In the past three years, we have not experienced a material information security breach but may in the future. See Risk Factors in Part I, Item 1A in this Form 10-K for additional information.


text: Risk management and strategy Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to our tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on our management and third-party service providers, as described further below, to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Brent Winn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Winn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2020. Mr. Winn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Winn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and overseen by our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular exercises and tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Generation Bio Co.

ticker: GBIO


text: Our Audit Committee provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.


text: Our Senior Director of Information Technology, or IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Director of IT has 25 years of experience in building, running, and managing diverse functional areas of IT, including but not limited to enterprise cybersecurity, IT infrastructure, operations, business continuity, and service delivery. He began his IT career overseeing datacenter operations for a pharmaceutical company and has held multiple IT leadership positions at biotechnology companies, including serving as the director of cybersecurity and infrastructure at a biopharmaceutical company prior to joining us over three years ago.


text: We have also established a cross-functional cybersecurity working team led by our chief financial officer serving as the chair and consisting of executive-level leaders, that is responsible for reviewing, revising and testing our cybersecurity policies and procedures.


text: In an effort to deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention trainings, which cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We operate through our subsidiaries and affiliate and receive services through our intercorporate services agreement (ISA) with Contran (see Note 15 to our Consolidated Financial Statements). We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility, and availability of company data stored, processed, or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: NL INDUSTRIES INC

ticker: NL


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by the chief information officer (CIO) of Contran who provides services to us under the ISA, and who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. The Contran CIO, who also serves as the Kronos CIO, reports to the chief executive officer of Contran and Kronos, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating business segments. Both the Contran CIO and the director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review enterprise risk management level cybersecurity risks annually.


text: We, Kronos and CompX continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage third-party services to conduct evaluations of our security controls through penetration testing, red team testing, consulting on best practices, and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of the Contran CIO and senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to the CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.