text: Our Chief Information Security Officer ("CISO") partners with management in internal functions, such as finance, legal, and internal audit, in overseeing information security risks, as well as third-party consultants who perform risk-based assessments with recommendations for designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategies, which helps align our programs and strategies with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee and the Board of Directors.

companyName: AAR CORP

ticker: AIR


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated CISO whose team is responsible for managing our information security strategy, policies, standards, and processes. The information security team provides security monitoring and response and provides regular reports to the CISO to inform about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO, who also serves as our data protection officer, reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer.

secItem: Item 1C


text: Our CISO and CDTO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. Our CISO has 35 years of experience in information technology systems and is a 25-year military veteran of the U.S. Navy and Navy Reserves with a Top Secret/Sensitive Compartmented Information (TS/SCI) U.S. security clearance and multiple combat deployments in information warfare. Additionally, our CISO holds several certifications, including, among others, the following security certifications: Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Network Defense Analyst (CNDA), Disaster Recovery Institute International (DRII), and CompTIA – Network+ and Security+. Our CDTO has over 25 years of leadership experience across all aspects of technology-enabled digital transformations, including leading multiple transformations at a major airline prior to his role at AAR. He previously advised companies across multiple industries in collaboratively developing and executing their digital and technology roadmaps as a consultant at a major firm.


text: The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.


text: Notwithstanding the Company's processes for assessing, identifying and managing risks from cybersecurity threats, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. During 2025 and 2024, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: AMREP CORP.

ticker: AXR


text: Risk Management and Strategy Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned, or managed by us. Our focus is on protecting sensitive information, such as the personal information of our customers and employees, and confidential business information that a competitor or a malicious actor could leverage. Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices and engaging third-party service providers to conduct security assessments.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We conduct regular risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards.


text: We have implemented technical solutions designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware and endpoint protection functionality, and access and identity controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards.


text: We have not experienced any cybersecurity incidents that have been determined to affect us materially, our business strategy, results of operations, or financial condition. As external events evolve, we will continue to evaluate and address these conditions as needed.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Risk Management and Strategy We maintain high standards with respect to cybersecurity and our cybersecurity risk management program is integrated into our enterprise risk management framework, overseen by our Information Security Officer ("ISO"), meaning that cyber-risks are identified, evaluated, and managed with the same rigor as other strategic, operational, and financial risks. We have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles as a guide for our security controls and processes, helping us structure our activities around identifying potential threats, protecting systems, detecting incidents, responding to events, and recovering operations. We engage independent third-party cybersecurity auditors and testers annually to review our Information Security Management (ISMS) and renew our ISO/IEC 27001 certification. Key elements of our program include:

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Preventive Controls and Monitoring: We employ multiple layers of technical controls (firewalls, intrusion detection systems, encryption, and multi-factor authentication) to proactively monitor IT controls to ensure compliance with security policies, legal regulations, contractual obligations and industry best practices. Our Global Security Operations Center operates 24/7 with real-time monitoring capabilities to rapidly investigate alerts and trigger containment measures, which helps us minimize exposure or damage if a cybersecurity incident occurs.


text: Vulnerability Management and Testing: We conduct regular vulnerability assessments and annual external penetration testing of our systems and applications to probe for weaknesses. We also perform periodic exercises simulating cybersecurity incidents to test our defenses and response procedures. Findings from these tests are used to strengthen our security posture on an ongoing basis.


text: Incident Response Planning: We maintain a cybersecurity incident response plan that defines procedures for addressing security events. This plan is updated and tested regularly (including through tabletop drills and simulated breach exercises) so that our teams remain practiced in incident handling. In the event of an incident, our aim is to respond swiftly to contain the issue, notify appropriate stakeholders, investigate the root cause, and recover normal operations as soon as practicable.


text: Third-Party Risk Management: We carefully manage cybersecurity risks arising from our use of third-party software, cloud services, and suppliers. We perform due diligence and security risk assessments on critical third-party service providers, both at onboarding and periodically during the relationship. Our procurement and legal teams work together to incorporate robust cybersecurity requirements into contracts with vendors (for example, data protection standards and incident notification obligations). Where appropriate, we require suppliers to adhere to our security policies or industry standards, and we conduct ongoing monitoring or audits of their security controls. These steps help reduce the risk that a weakness in a partner's systems could compromise our data or operations.


text: Employee Training and Awareness: A strong security culture among our employees is one of our best defenses in relation to cybersecurity events. Our employees are required to complete annual cybersecurity and data protection awareness training. This training educates personnel on topics like phishing prevention, safe computing practices, and how to report potential security issues. We supplement formal training with periodic phishing email simulations and security reminders.


text: Through a combination of these technical, procedural, and educational measures, our program is designed to detect and respond to cybersecurity threats effectively and thereby safeguard our business operations and sensitive information.


text: Cybersecurity threats are endemic to the modern business environment, and attempts to penetrate our network security are frequent and on-going. However, to date, no cybersecurity threats (including incidents) have resulted in a material impact on our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident, that we will not experience a cybersecurity incident in the future, or that a past cybersecurity incident will not result in a future material impact. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Governance and Oversight We have established strong governance practices to oversee cybersecurity and IT risks. The Board of Directors has delegated primary oversight responsibility for cybersecurity to the Risk Management Committee (RMC) of the Board, which is composed of several Board members. Our Chief Information Officer (CIO) and Information Security Officer (ISO) receive security reports and threat intelligence from the Security Operations Center, which apprises the CIO and ISO of any potential incidents and the status of ongoing preventive measures and they share this information at least quarterly with the RMC. They also brief the full Board as needed on cybersecurity matters.


text: We have a multi-disciplinary Cybersecurity Council that connects our Information Security, IT, Corporate Audit, Finance, Legal, Compliance, and Investor Relations teams. This Council facilitates coordination of cybersecurity risk management across our organization and a unified response to incidents. In the event of a cybersecurity incident, the ISO will lead our incident response efforts and convene the Cybersecurity Council to evaluate the situation and determine appropriate next steps (for example, engaging law enforcement or cyber-experts, and considering disclosure obligations). This integrated governance structure – from the operational teams up through senior management and the Board – helps drive accountability and visibility for cybersecurity throughout our organization.


text: Our leadership team includes seasoned professionals with deep expertise in technology and security. Our CIO, Todd Weathersby, has more than 25 years of experience in global IT and cybersecurity management, and our ISO has more than 25 years of experience in cybersecurity, risk, and compliance (with certifications such as CISSP and CISM). The knowledge and experience of our CIO and ISO, along with the Board's active engagement, provides a strong oversight of our cybersecurity strategy. The Board and management also receive regular briefings and training sessions regarding emerging cybersecurity threats and regulatory developments in order to be positioned to adapt to new challenges in the cybersecurity landscape.


text: The Company's Cybersecurity Program The Company's cybersecurity program is an integral part of the long-term sustainability and effectiveness of the Company's operational and technology environment. To protect the integrity of its data and operational and technology systems, the Company employs a "defense-in-depth" strategy that uses multiple security measures. This strategy aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. The Company periodically reviews and modifies the implementation of its cybersecurity strategy based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants.

companyName: American Water Works Company, Inc.

ticker: AWK


text: The Company's cybersecurity program includes the following areas of focus: • Technology that includes, among other things, encryption, threat management, monitoring, investigation support and backups for physical devices, such as mobile phones and computers, connected to the Company network; • Identity and access management controls that include, among other things, multi-factor authentication and safeguards associated with granting elevated privileges; • Proactive cybersecurity processes, including vulnerability scanning, penetration testing and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that are regularly evaluated using various incident response and disaster recovery exercises; • Employee cyber risk awareness and training, including regular simulation exercises with employees, that covers cybersecurity threats and actions to prevent and report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring and contractual obligations, and periodic review of third-party control environments to align the Company's risk exposure with its business requirements and risk tolerances.


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations and has implemented a third-party risk management program to understand the cybersecurity risks to the Company that may arise out of these third-party relationships. The Company categorizes third-party relationships by risk level, which is determined primarily by the service provided by the third-party and its level of access to the Company's data. Each category has specific cybersecurity controls, data privacy and documentation requirements, which are outlined in the agreement between the Company and the third-party service provider. In addition, the Company evaluates the online security footprint for its service providers at the time of agreement, and on a regular basis, thereafter, depending on the provider's risk level. The Company reviews its agreements with third-party service providers periodically related to terms and conditions governing cybersecurity controls and data privacy. The Company also monitors, as appropriate, risks relating to potential compromises of sensitive Company information through third parties and reevaluates these risks periodically. In addition, the Company obtains annual attestation reports related to data security and privacy from certain third-party providers to further support compliance with industry-standard cybersecurity protocols.


text: Cybersecurity Risks The Company believes that its current preventative actions and response activities provide reasonable measures of protection against security breaches and serve generally to reduce the Company's overall cybersecurity risk. However, cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In addition, the Company has obtained insurance to provide coverage for a portion of the losses and damages that may result from a cyber attack or a security breach, but such insurance is subject to exclusions, limitations and exceptions, and may not cover the total loss or damage caused by an attack or breach. To date, management has determined that no cybersecurity incident experienced by the Company has resulted in a material impact on its financial condition, results of operations or business strategy. For additional information concerning cybersecurity-related risks, see Item 1A—Risk Factors—We may be subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured.


text: Cybersecurity Risk Management and Strategy The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Security Officer ("CSO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The Company's CSO has 23 years of work experience in the cybersecurity field throughout various industries, including the utility sector, and has obtained several professional certifications, including from the International Information System Security Certification Consortium. The CSO reports directly to the Company's Chief Information Officer ("CIO"), who is responsible for the Company's information technology program. The CIO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's CSO, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CIO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CIO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CIO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council.


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2023, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.


text: The Company's cybersecurity risk assessment process involves considering risks associated with the nature of its business, receiving and processing inputs from internal and external stakeholders, monitoring industry trends and risks and engaging external advisors, to assist in aligning the Company's cybersecurity processes with industry best practices. Risk assessments are conducted quarterly and annually to evaluate the effectiveness of the Company's existing security controls and serve as the basis for additional safeguards, security controls and measures. Operational and technical security controls are deployed and integrated as safeguards against unauthorized access to the Company's information systems. These controls are aimed at (i) assuring the continuity of business processes that are dependent upon automation, (ii) maintaining the integrity of the Company's data, (iii) supporting regulatory and legislative compliance requirements, and (iv) maintaining safe and reliable service to the Company's customers.


text: The Company has also implemented a vulnerability assessment program that is conducted at least annually and more frequently, depending on the nature of the risk. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.


text: Incident Response The Company utilizes an established internal framework designed to assess promptly the severity and materiality of cybersecurity incidents based on predefined quantitative and qualitative criteria and to determine the appropriate level of response. Incidents are escalated to the relevant management teams based on their severity and materiality for prompt response and mitigation. The Company maintains a standing crisis response team comprised of individuals from various functional units, including without limitation Information Technology, Legal, Finance, Enterprise Risk Management, Operations and Communications, to respond to cybersecurity and physical security incidents, environmental incidents and health and safety emergencies, among others.


text: If a cybersecurity incident were to occur, the Company would establish a cross-functional incident response team to respond to the specific cybersecurity incident. The incident response team would consist of a subset of members from the standing crisis response team, including personnel with the most relevant experience related to the specific incident. This collaborative approach is intended to enable the Company to leverage expertise throughout the business to address cybersecurity events and to evaluate the potential financial, legal, operational and reputational implications of an incident, or series of related incidents. In considering the materiality of an event, related attacks, whether in terms of quantity or impact, are reviewed individually and in the aggregate to determine whether they may have a significant impact on the Company's financial condition, results of operations or business strategy, either quantitatively or qualitatively.


text: Cybersecurity Governance The Board of Directors is responsible for oversight of the Company's cybersecurity program and the Company's responses to cybersecurity risk. The Board of Directors has delegated to the Safety, Environmental, Technology and Operations ("SETO") Committee of the Board of Directors responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company's operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports from the CIO and CSO related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company's cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee of the Board of Directors, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company's system of internal controls and the Company's risk assessment and management strategy, including with respect to cybersecurity risks.


text: Cybersecurity Risks Cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and information technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving and increasingly complex nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. By way of example, as previously disclosed, on October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems, which was determined to be the result of a cybersecurity incident. To date, the Company has determined that it has not experienced a cybersecurity incident that has resulted in a material impact to the Company's financial condition, results of operations, cash flows, or business strategy. For additional information concerning the October 3, 2024, cybersecurity incident, and cybersecurity-related risks, see Item 1A—Risk Factors—Risks Related to Our Industry and Business Operations—We are, and may in the future be, subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured; and Item 7—Management's Discussion and Analysis of Financial Condition and Results of Operations—Other Matters—Cybersecurity Incident.


text: Cybersecurity Risk Management and Strategy The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Information Security Officer ("CISO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The CISO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's Chief Security Officer, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CISO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CISO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CISO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council. The CISO reports directly to the Company's Chief Technology and Information Officer, who is responsible for the Company's information technology program.


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2024, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.


text: The Company has also implemented a vulnerability assessment program that is reviewed at least annually and more frequently, depending on changes to the risk environment. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.


text: When a cybersecurity incident occurs, the Company establishes a cross-functional incident response team to respond to the specific cybersecurity incident. The incident response team consists of a subset of members from the standing crisis response team, including personnel with the most relevant experience related to the specific incident. This collaborative approach is intended to enable the Company to leverage expertise throughout the business to address cybersecurity events and to evaluate the potential financial, legal, operational and reputational implications of an incident, or series of related incidents. In considering the materiality of an event, related attacks, whether in terms of quantity or impact, are reviewed individually and in the aggregate to determine whether they may have a significant impact on the Company's financial condition, results of operations or business strategy, either quantitatively or qualitatively.


text: Cybersecurity Governance The Board of Directors is responsible for oversight of the Company's cybersecurity program and the Company's responses to cybersecurity risk. The Board of Directors has delegated to its SETO Committee responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company's operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company's cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company's system of internal controls and the Company's risk assessment and management strategy, including with respect to cybersecurity risks.


text: As discussed further in "Item 1. Business—Our Manager and Ellington," we are externally managed and advised by our Manager, an affiliate of Ellington. Our Manager does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. Other than with respect to our majority-owned subsidiary Longbridge's operations, we rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Ellington Financial Inc.

ticker: EFC


text: Ellington's cybersecurity processes and practices are integrated into Ellington's risk management and oversight program. In general, Ellington seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Ellington collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.


text: Longbridge's cybersecurity processes and practices are integrated into Longbridge's operational risk oversight program. In general, Longbridge also seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Longbridge collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur. Longbridge had over 400 employees as of December 31, 2023.


text: Ellington's Risk Management and Strategy Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee of our Board of Directors (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board of Directors, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Longbridge's Risk Management and Strategy Longbridge's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Directors' oversight of cybersecurity risk management is completed through the Audit Committee, which regularly interacts with both our and Longbridge's management teams who are responsible for assessing and managing material risks from cybersecurity threats at Longbridge. • Collaborative Approach: Longbridge has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows us to make decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Longbridge deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security such as anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Longbridge continuously evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Longbridge has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible such business disruption plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Longbridge maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of Longbridge's systems, as well as the systems of third-parties that could adversely impact Longbridge's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Longbridge to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Longbridge: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via a variety of communication methods; and (iii) conducts phishing tests to assess user alertness, and retains an external cybersecurity vendor to conduct similar tests on an annual basis.


text: Longbridge's technology team, and its operational risk management group, perform regular assessments of the firm's cybersecurity and infrastructure posture. These reviews cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and Longbridge's threat monitoring services. In such continued maintenance of its cybersecurity posture, Longbridge conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has an external firm dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Longbridge also regularly engages third parties to perform assessments of its cybersecurity posture, including cyber risk assessments, penetration testing, user access control reviews and independent reviews of Longbridge's information security control environment and operating effectiveness. The results of such assessments, tests and reviews are reported to our Audit Committee and Board of Directors, and Longbridge adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats from Longbridge have materially affected or are reasonably likely to materially affect our Company.


text: Our Board of Directors, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at both Ellington and Longbridge, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties.


text: Each of Ellington and Longbridge employ internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.


text: Ellington's cybersecurity team is lead by Ellington's outsourced Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has lead large technical efforts such as the development of Ellington's proprietary whole loan management system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has lead several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: Longbridge's cybersecurity risk management and strategy is co-led by its Chief Operating Officer ("COO") and its Vice President of Information Technology ("VP of IT"). Longbridge's COO has extensive leadership experience with enterprise information technology in the mortgage banking industry, where he has held various executive roles, including Chief Privacy Officer and Chief Information Officer. Longbridge's COO has developed and executed IT strategy, including cybersecurity programs, and helped achieve and maintain Sarbanes-Oxley compliance and SOC-2 certification. Longbridge's VP of IT has extensive leadership experience with enterprise information technology, both in the banking and manufacturing industries. She has also developed and executed IT strategy, including cybersecurity programs and helped achieve and maintain Sarbanes-Oxley compliance. Longbridge's COO, accompanied by its VP of IT, regularly discusses Longbridge's cybersecurity risks and posture, and its information technology roadmap, with the Audit Committee. In these reviews, Longbridge's COO informs the Audit Committee of what Longbridge believes are the key focus items of Longbridge in its cybersecurity program and the COO and VP of IT provide an overview of their views of emerging threats, and any significant cyber response activities or incidents.


text: Longbridge's cybersecurity processes and practices are integrated into Longbridge's operational risk oversight program. In general, Longbridge also seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Longbridge collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur. Longbridge had over 400 employees as of December 31, 2024.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. Cyber criminals do, however, target us, Ellington and Ellington's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Ellington's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's and Longbridge's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our stockholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows." While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Longbridge's technology team, and its operational risk management group, perform regular assessments of the firm's cybersecurity and infrastructure posture. These reviews cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and Longbridge's threat monitoring services. In such continued maintenance of its cybersecurity posture, Longbridge conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has an external firm dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: To date, no risks from cybersecurity threats from Longbridge have materially affected or are reasonably likely to materially affect our Company. Cyber criminals do, however, target us and Longbridge's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Longbridge's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's and Longbridge's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our stockholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows."


text: Ellington's cybersecurity team is led by Ellington's Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO led large technical efforts such as the development of Ellington's proprietary internally hosted rapid application system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has led several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to assess, identify, and manage material risks from cybersecurity (including cybersecurity threats associated with the use of third-party service providers), to safeguard our information systems, and to protect the confidentiality, integrity, and availability of the data on our information systems.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework. Management has formed cross-functional risk and information security committees (the "Security Committees") to initiate, develop, review and implement cybersecurity policies, procedures and training to mitigate cybersecurity risks. Our information technology ("IT") cybersecurity leadership team works closely with our Security Committees and internal audit team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Risk Management Personnel The Company's senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company's senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company's IT cybersecurity leadership team, comprised of the AMC Sr. Director Cybersecurity and Network, the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC VP IT Operations, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.


text: Monitoring Cybersecurity Incidents The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the NIST framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.


text: Engagement of Consultants for Risk Management Services Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts to perform a variety of functions for the Company. These include, but are not limited to, cybermaturity audits, targeted ransomware assessment and table-top exercises, red and purple team attack simulations, internal penetration tests and other internal and external audits. These partnerships enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, the Company implements processes to oversee and manage these risks. The Company utilizes software products and services to monitor and protect the Company's environment from possible third-party breaches impacting the Company's environment. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Third-parties who have access to highly sensitive information due to services performed and data retained are subject to increased scrutiny.


text: Risks from Cybersecurity Threats We have not experienced any cybersecurity incidents that we believe have materially affected, or are likely to materially affect, the Company.


text: Board of Directors and Audit Committee Oversight Our board of directors (the "Board") understands the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: The audit committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: Management's Role Managing Risk Senior IT leadership play a pivotal role in managing cybersecurity risk and keeping the Audit Committee apprised of cybersecurity developments. Senior IT leadership provide comprehensive briefings to the Audit Committee on a periodic basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;


text: learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and senior IT leadership maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Company, at the direction of the Audit Committee, conducts periodic reviews of the Company's cybersecurity posture and the effectiveness of its risk management strategies. These reviews help in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Using a risk-based prioritization approach, the IT cybersecurity leadership team and the Security Committees focus on securing our high value assets, updating our cybersecurity detection and prevention capabilities to identify new threats, and improving compliance processes to protect the Company's operations and data. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations.


text: The Company has also implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and vulnerability and patch management.


text: Risk Management Personnel The Company's senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company's senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company's IT cybersecurity leadership team, comprised of the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC SVP & Chief Information Officer, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.


text: Monitoring Cybersecurity Incidents The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the National Institute of Standards and Technology ("NIST") framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to prompt remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.


text: The audit committee of the Board (the " Audit Committee ") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, including multi-layered technical security measures, mandatory user security awareness and training, access control policies and activity monitoring. Additionally, we engage third-party cybersecurity experts to assess the security of our network.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: We design and assess our program based on the NIST Special Publication 800-171 and the Cybersecurity Maturity Model Certification (CMMC) levels 1. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CMMC maturity models as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors (the Board) considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity risks. The Committee oversees our cybersecurity risk management program.


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of our management team, including our Chief Executive Officer (CEO), CFO, and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.


text: Cybersecurity Governance Our Board of Directors (the Board) considers cybersecurity risk as part of its risk oversight function and the Audit Committee (the Committee) contributes to oversight of cybersecurity risks.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary or appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential, as appropriate.


text: The Board may also receive briefings from management on our cyber risk management program, and may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO) or external experts as part of the Board's continuing education on topics that impact public companies. Members of our management team, including our CFO, Head of Information Technology, General Counsel and our Vice President of Quality Assurance, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and oversees our retained external cybersecurity experts, which includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.


text: Our cybersecurity management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from cybersecurity experts; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer data that use to provide services for our customers ("Information Systems and Data").

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Our Chief Information Security Officer ("CISO") with help from our legal department and our security and compliance team from our IT infrastructure department help identify, assess and manage the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, conducting scans of the threat environment, conducting internal and external threat and vulnerability assessments, conducting internal and external audits, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting third party assessments and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, incident detection and response, disaster recovery plan, encryption of certain data, network security controls, access controls, asset management, tracking and disposal, employee training, penetration testing, systems monitoring and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security and compliance team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and evaluates material risks from cybersecurity threats and reports to the audit committee of the board of directors ("Audit Committee"), which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including outside legal counsel, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers and threat intelligence service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes vulnerability scans related to vendors and a review of vendors' security certification reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, the Company may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: We have not experienced a cybersecurity incident that would materially affect the company's business strategy, results of operations or financial position.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.


text: The Company's CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's CFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including IT security leadership, the CFO, CEO, General Counsel ("GC") and third-party consultants as needed. IT security leadership, the CFO, CEO and GC work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences. "


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Principal Financial Officer ("PFO") who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.


text: The Company's PFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's PFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including IT security leadership, the PFO, CEO, General Counsel ("GC") and third-party consultants as needed. IT security leadership, the P FO, CEO and GC work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") team, our Chief Information Security Officer ("CISO"), and our Enterprise Risk Management Committee, as overseen by the Board of Directors, primarily through its Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: Our cybersecurity risk management program categorizes cybersecurity risks into five areas: identify, protect, detect, respond, and recover. We regularly assess the cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As a part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.


text: We foster a shared responsibility for the Company's cybersecurity with all our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory security awareness training to enhance awareness and readiness against cyber threats. Certain roles require additional role-based, specialized cybersecurity training. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, malware protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. The CISO and IT team review and update such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: We continually seek to improve our cybersecurity posture, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts as needed to evaluate the efficacy of our security measures. We engage reputable third-party tools and products to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness.


text: Cybersecurity Governance and Oversight Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the Audit Committee. Our CISO possesses over 25 years of experience in various technology and cybersecurity operations, holds the following certifications from ISC2, Information Systems Security Management Professional (ISSMP), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC) as well as ISACA certifications of Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). Other key members of management assist our CISO in the oversight of cybersecurity risk management.


text: We have established an incident response team which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed to perform an impact analysis of security incidents which may have a material affect on the Company, The Audit Committee has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Enterprise Risk Management Committee and our Audit Committee review quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, newly identified risks, existing projects, and key performance insights and engage in discussions with management based on such reports and other recent developments.


text: Cybersecurity Incident Reporting and Management We have not identified any cybersecurity incidents that have materially affected or vulnerabilities to cybersecurity threats that are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.


text: We foster a shared responsibility for the Company's cybersecurity with all our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory security awareness training to enhance awareness and readiness against cyber threats. Certain roles require additional role-based, specialized cybersecurity training. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption requirements, malware protection, remote access, multifactor authentication, confidential and privacy information, and internet, social media, email, and wireless device usage. The CISO and IT team review and update such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: Cybersecurity Governance and Oversight Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the Audit Committee. Our CISO possesses over 25 years of experience in various technology and cybersecurity operations, holds the Certified Chief Information Security Officer (CCISO) certification from EC-Council and certifications from ISC2, Information Systems Security Management Professional (ISSMP), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC) as well as ISACA certifications of Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). Other key members of management assist our CISO in the oversight of cybersecurity risk management.


text: We have established an incident response team which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed to perform an impact analysis of security incidents which may have a material effect on the Company, The Audit Committee has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Enterprise Risk Management Committee and our Audit Committee review quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, newly identified risks, existing projects, and key performance insights and engage in discussions with management based on such reports and other recent developments.


text: Cybersecurity Incident Reporting and Management We have not experienced any cybersecurity incidents that have a material impact on our business strategy, results of operations, or financial condition. Nor have we identified vulnerabilities to known threats that are reasonably likely to materially affect the same. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.


text: As a healthcare-focused company, we understand the importance of managing cybersecurity risks that we face and have established a cybersecurity risk management program as part of our enterprise risk management program.

companyName: Phreesia, Inc.

ticker: PHR


text: Cyber Risk Management and Strategy Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company's cybersecurity program utilizes a cross functional, multilayered approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.


text: Our cybersecurity program includes safeguards that are designed to protect the Company's information systems from cybersecurity threats. Such safeguards include firewalls, automated intrusion detection systems, anti-malware functionality and access controls, which are evaluated and improved through periodic vulnerability assessments and ongoing cybersecurity threat intelligence. We have established and maintain an incident response plan that addresses the Company's response to and recovery from a cybersecurity incident. The incident response plan is tested and evaluated on an annual basis.


text: The Company's cybersecurity program is supported by engagement of third-party service providers who help identify, assess and respond to cybersecurity risks. For example, the Company regularly engages third parties to perform and facilitate assessments on our cybersecurity measures, including information security maturity assessments, audits, tabletop exercises, threat modeling and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to leadership, the Audit Committee, and/or the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by the assessments, audits and reviews.


text: As part of our cybersecurity risk management program, we maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business. Further, all personnel are required to undergo cybersecurity training during onboarding and, thereafter, on an annual basis to reinforce the Company's information security policies, standards and practices.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors may from time to time experience threats and security incidents that could affect our information or systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.


text: Phreesia takes a cross-functional approach to address the risks from cybersecurity threats. The Company's Board of Directors (the "Board") holds oversight responsibility over the Company's enterprise risk management ("ERM") program, which incorporates the Company's cybersecurity risk management program. The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Technology Officer, who serves as the Company's Security Officer, along with other members of management including the Senior Director of Security Engineering, the Chief Privacy Officer, and the compliance, audit, and risk teams.


text: The Company's Chief Technology Officer is principally responsible for day-to-day management of the Company's cybersecurity risk management program. The Chief Technology Officer reports directly to the Chief Executive Officer and works in coordination with the other members of the leadership team, which includes our General Counsel, Chief Operating Officer, and Chief Financial Officer. The Chief Technology Officer oversees a team of security professionals, which is led by the Senior Director of Security Engineering. The security team includes approximately 40 security professionals, 25 of whom are security engineers. Other members of the team oversee and manage identity, risk, compliance and audit functions.


text: The Board and the Audit Committee each receive regular presentations and reports from the Company's Chief Technology Officer and/or General Counsel on cybersecurity risks, which address a wide range of topics including, among others, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third party service providers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds under the Company's incident response plan.


text: Cyber Risk Management and Strategy Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company's cybersecurity program utilizes a cross functional, multilayered defense-in-depth approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced and will likely experience threats and security incidents that could affect our information or systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.


text: Phreesia takes a cross-functional approach to address the risks from cybersecurity threats. The Company's Board of Directors (the "Board") maintains oversight responsibility over the Company's enterprise risk management ("ERM") program, which incorporates the Company's cybersecurity risk management program. The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Technology Officer, along with other members of management including the Chief Information Security Officer, the Chief Privacy Officer, and the compliance, audit, and risk teams.


text: The Company's Chief Information Security Officer is principally responsible for day-to-day management of the Company's cybersecurity risk management program and reports to the Chief Technology Officer. The Chief Information Security Officer has more than 15 years of cybersecurity experience, including leadership roles at four publicly traded companies. He is a Certified Information Systems Security Professional, holds a M.S. in Security Technologies from the University of Minnesota and is an alumnus of the FBI Citizen's Academy. The Chief Technology Officer has served in various leadership roles in information technology and information security at the Company for over 14 years and holds a B.S. in computer science from Worcester Polytechnic Institute. The Chief Technology Officer reports directly to the Chief Executive Officer and works in coordination with the other members of the leadership team, which includes our General Counsel, Chief Operating Officer, and Chief Financial Officer. The Chief Technology Officer oversees a team of security professionals, which is led by the Chief Information Security Officer. The security team includes approximately 36 security professionals, 25 of whom are security engineers. Other members of the team oversee and manage identity, risk, compliance and audit functions.


text: The Board and the Audit Committee each receive quarterly presentations and reports from the Company's Chief Technology Officer and/or General Counsel on cybersecurity risks, which address a wide range of topics including, among others, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third party service providers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds under the Company's incident response plan.