text: For a description of the risks from cybersecurity threats that may materially affect our business and how they may do so, see the section titled "Risk factors" in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, we could experience adverse consequences resulting from such a compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function and is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Cytek Biosciences, Inc.

ticker: CTKB

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our COO, Mr. Chris Williams. Mr. Williams has experience in the security of both corporate and technical systems as well as business continuity planning in previous security operations roles at public pharmaceutical companies.


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO and senior director of global information technology. Our COO works with our IT department to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to our board of directors for certain cybersecurity incidents.


text: Our board of directors receives periodic reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy The operation of our businesses is dependent on the secure functioning of our computer infrastructure, digital information systems, and third-party hosted services. We use these systems to maintain sensitive business and customer data, operate record-keeping and accounting functions, process business transactions, and for other key aspects of our business.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: We rely on a multidisciplinary team, including our information technology ("IT") department, management, and third-party service providers to identify, assess, and manage cybersecurity threats and risks. Our information security program utilizes various security tools and strategies, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We also work with third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, and threat intelligence service providers.


text: Our cybersecurity risk management is integrated into our overall risk management system. Our IT department works closely with our management and other relevant teams to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported on at least a quarterly basis to our Executive Compliance Committee, as described further below, to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented.


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risk Factors – We face risks related to our information technology systems, and potential cyber-attacks and security breaches."


text: Cybersecurity Governance Our management leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our information security program is coordinated by our IT department, led by our Senior Vice President of Information Technology, who has 27 years of industry experience in IT, with responsibility for enterprise security, and cyber risk management including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Supporting team members have relevant educational and industry experience, including holding similar technology positions at other companies.


text: Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our incident response processes include reporting to the Executive Compliance Committee, which includes our executive officers and leaders from the IT, compliance and legal teams, as well as to the Board for certain cybersecurity incidents.


text: Our Board holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. Members of the Board receive updates on a quarterly basis from senior management and the Executive Compliance Committee, including the reporting of emerging or existing cybersecurity risks, mitigation strategies employed to manage these risks, any cybersecurity and data privacy incidents, and status on key information security initiatives. In addition, our SVP of IT annually provides an overview of our information security program to the Board, including a summary of key performance indicators.


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage such material risks and to safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners and employees.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Risk Management and Strategy The Board of Directors is actively involved in oversight of the Company's risk management framework and the Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration attempts to ensure that cybersecurity considerations are an integral part of decision-making processes throughout the Company. The Company's risk management team works closely with the Company's IT department to continuously evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures that are designed to provide for the prompt escalation of any cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive appropriate information in a timely manner.


text: Due to the complexity and evolving nature of cybersecurity threats, the Company has engaged from time-to-time external experts, including cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. The Company engages these third-parties to conduct regular audits, threat assessments and consultation on security enhancements. These interactions are intended to enable the Company to leverage specialized knowledge and insights, in an attempt to ensure its cybersecurity strategies and processes remain at the forefront of industry practices.


text: In furtherance of assessing, identifying, and managing material cybersecurity risks; the Company: • Employs advanced technology solutions, such as proactive detection tools, to safeguard our assets and identify threats within its environment. • Conducts routine cyber education and awareness training sessions to empower employees with the necessary knowledge and cultivate a strong security culture across the organization. • Regularly assesses our cybersecurity program against the NIST Cybersecurity Framework, using the findings to develop action plans and track progress to completion. • Organizes tabletop exercises and drills to simulate cyber incidents, enhancing its incident response and recovery capabilities. • Analyzes internal and external cybersecurity incidents and threat intelligence to assess their relevance to its environment and industry, crafting actionable plans accordingly. • Manages an enterprise-wide disaster recovery governance program, including cybersecurity-related standards and compliance procedures. • Performs regular cybersecurity-related disaster recovery testing to ensure the recoverability of its critical systems, supporting business continuity across various lines. • Fosters integration between business units and corporate divisions with its internal cybersecurity team, embedding cybersecurity requirements into operational environments and influencing strategic decisions, budgeting, and processes (e.g., Security by Design). Additionally, senior management, executives, and the Board of Directors consistently review financial planning processes concerning cybersecurity initiatives.


text: Additionally, the Company is aware of the risks associated with third-party service providers, it implements stringent processes to oversee and manage these risks. The Company conducts security assessments of third-party technology providers before engagement and maintains ongoing monitoring to ensure compliance with Company cybersecurity standards. The monitoring includes assessments (e.g., reviewing vendor cybersecurity related attestation and disclosures (SOC 2 Type 2, etc.)) by the Company's Chief Information Officer ("CIO") and on an ongoing basis by its security engineers.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated the primary responsibility for oversight of the Company's cybersecurity risk management. As discussed below, members of management report the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports out to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise including, risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Senior Vice President and CIO, Executive Vice President and Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to their regularly scheduled meetings, Board members, the CIO, CFO and CEO regularly engage in ad hoc conversations regarding emerging or potential cybersecurity risk and developments in the cybersecurity domain. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board of Directors conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Christos Ruci, the Company's CIO, is the member of the Company's management team primarily responsible for assessing, monitoring and managing the Company cybersecurity program. Mr. Ruci has over 20 years of experience in the field of technology and security including extensive experience as an enterprise CIO, as well as consulting experience advising organizations on their technology and risk profiles. The Company believes Mr. Ruci's in-depth knowledge and experience are instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies.


text: The Company's CIO oversees the day-to-day implementation of the Company's cybersecurity risk management programs, tests its compliance with standards, remediates known risks, and leads its employee training program. The CIO is tasked with keeping informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, in an attempt to assist in effectively preventing, detecting, mitigating, and remediating cybersecurity incidents. The CIO implements and oversees processes for the regular monitoring of the Company's information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is responsible for implementing the Company's incident response plan to mitigate the cybersecurity incident's immediate impact, implement long-term strategies for remediation, and prevent future incidents.


text: The CIO regularly informs the Company's CEO and CFO of material aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: RISK MANAGEMENT AND STRATEGY We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GrowGeneration Corp.

ticker: GRWG


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer ("CIO") who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: We engage consultants and other third parties in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CIO provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.


text: Our CIO is primarily responsible to assess and manage our material risks from cybersecurity threats. Our CIO has over 25 years of professional IT experience and has held numerous positions with responsibility for managing network and data security, including in the legal and banking industries.


text: Our CIO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CIO is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include log review from IT and operations teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.


text: We conduct regular technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We also conduct periodic programmatic risk assessments including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: ESS Tech, Inc.

ticker: GWH


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Vice President of Information and Business Systems who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and annual policy acknowledgments.


text: We engage external cyber vendor consultants, auditors, and other third parties in connection with our risk assessment processes. These service providers assist us to assess, design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We review the ability of third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our Company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our products and services."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk function in coordination with the oversight and periodic review of the audit committee.


text: Our Vice President of Information and Business Systems and members of our management team in accordance with our cybersecurity incident response plan, which includes the following members from the following function – legal, IT, finance, audit, operations, engineering, human resources, communications, and additional executives as applicable under the plan – and external cybersecurity support providers (collectively, "IRP stakeholders"), are primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Vice President of Information and Business Systems and our IRP stakeholders oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Vice President of Information and Business Systems has an advanced degree in management information systems and has managed the Company's IT processes and policies inclusive of cybersecurity matters throughout his tenure at the Company, in addition to many years of prior experience in various technology roles at a large U.S. public company. He is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by working with the IT department and external vendors to implement our security risk management, including through the use of both automated and manual tools and reporting, in accordance with the Company's incident response plan and Company cybersecurity policies.


text: Our Vice President of Information and Business Systems provides quarterly briefings to the audit committee and board of directors regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: TIAA, on behalf of the Account, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. The Account's business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA, with support from certain of its subsidiaries, manages the Account's day-to-day operations and has implemented a cybersecurity program that applies to the Account.

companyName: TIAA REAL ESTATE ACCOUNT


text: The Account depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. The Account relies on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with the Account's use of such entities.


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Account, and other products, subsidiaries and affiliates of TIAA and their respective third party service providers.


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Account relies. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Account and other products, subsidiaries, and affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Account in connection with its day-to-day commercial real estate, investment, and other operations.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from TIAA's Cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Account.


text: Management's Role in Cybersecurity Risk Management TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Account. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Account is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Account, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Account are assessed on an ongoing basis, and how such risks could materially affect the Account's business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected the Account. Cybersecurity risk remains heightened to the financial industry, including the Account, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Account's operations and performance. TIAA continues to invest in its cybersecurity program to protect against emerging threats, including threats against third parties and service providers.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Executive Officer.

companyName: Southern States Bancshares, Inc.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on- going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees. The Business Continuity Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To date, risks from cybersecurity threats have not materially affected our company.


text: Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense program. This endpoint program is monitored 24/7 and would notify IT staff of an incident. Most incidents would be mitigated by monitoring staff of the endpoint program, but IT staff would have to be involved in more severe incidents. This mitigation is resolved from an always updating database. In severe cases, the device that triggers the incident would be locked down and a plan of action would be put in place. The second line of defense is a monitored firewall. This would also notify IT staff of an incident. Last line of defense is IT Staff. The department is augmented by an information security specialist that is on a monthly retainer. Individuals within the department are generally subject to professional education requirements.


text: Our board of directors has approved a committee comprised of directors and management called the Information Technology Committee. This committee provides oversight and governance of the technology program and the information security program. This committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur from time to time in accordance with the Business Continuity Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents.


text: Risk Management and Strategy The Company is a late-stage clinical biotechnology company committed to applying scientific leadership in the field of localized cancer reduction leading to anti-cancer immune activation. Currently, management has not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk. Management assesses material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. To this end, the Company utilizes an outsourced information technology consultant to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. The outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems and has implemented systems and procedures to mitigate cybersecurity risks that the Company believes are appropriate for a company of our size, stage of growth and financial condition. In addition, the Company carries insurance with coverage for cyber events that it believes is suitable for a company of our size, stage of growth and financial condition.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including the Company's business strategy, results of operations or financial condition.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, the Company's Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology (including cybersecurity) risks. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that it collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service provider risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches and other disruptions could compromise our information systems and expose us to liability, which could cause our business and reputation to suffer" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates periodically from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by our CFO and CLO. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: At AssetMark, cybersecurity risk management is an integral part of our comprehensive enterprise risk management program. Our approach to cybersecurity risk management is designed to follow our industry's best practices, identifying, monitoring, assessing and responding to cybersecurity threats and incidents. This includes managing risks related to third-party vendors and service providers and facilitating coordination across different departments of the Company.

companyName: AssetMark Financial Holdings, Inc.


text: Our program incorporates procedures for identifying the source of a cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider), assessing the severity and risk of a cybersecurity threat or incident, implementing countermeasures, and reporting significant threats to management and the board of directors.


text: The Audit and Risk Committee, responsible for the oversight of our overall enterprise risk management program, oversees our cybersecurity program. They ensure management identifies and evaluates cybersecurity risks, implements risk management processes designed to ensure that potential cybersecurity, data privacy and information technology risks are identified, monitored, assessed and remediated, puts in place appropriate mitigation and remediation measures, and maintains our cybersecurity programs. We have established a (i) Regulatory Cybersecurity Committee which reviews new and changing regulatory requirements and recommendations and assesses any impacts on our business and (ii) an Information Security Council which enables collaboration for ongoing security incidents and emerging threats, reviews our information technology security roadmap and evaluates the current state of the information security program. Our cybersecurity programs are managed under the direction of our Chief Information Security Officer ("CISO") in consultation with our General Counsel and Chief Information Officer. Certain members of our executive team have extensive experience in assessing risks associated with cybersecurity threats, and our CISO and the cybersecurity team are certified and experienced information systems security professionals and information security managers with many years of experience and focus on preventing, detecting, mitigating, and remedying cybersecurity risks. Updates on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and cybersecurity reports are provided to the Governance Committee on at least on a monthly basis and our Audit and Risk Committee receives updates on our information security programs at least annually. Such updates cover, among other topics, third party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: The cybersecurity team, with external third-party involvement, conducts risk assessments and system enhancements, and provides employee training during the onboarding process and annually with additional training as we deem appropriate. We have adopted and implemented an Information Security Program that outlines our security and data protection policies and procedures. This program is approved by the CISO and is reviewed and updated at least annually, or more frequently on an as-needed basis, to account for changes in the evolving cybersecurity threat landscape as well as legal and regulatory developments. Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over critical third parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. When we do become aware that a third-party vendor or service provider has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, operations, or financial condition. However, we cannot eliminate all cybersecurity risks or provide assurances that we have not experienced an undetected. For more information about these risks, refer to the "Risk Factors—Risks Related to Intellectual Property, Data Privacy and Cybersecurity" section in this Annual Report on Form 10-K.


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Board is responsible for overseeing risk management and Cybersecurity is an integral part of the Company's overall risk management program. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Boxlight Corp

ticker: BOXL


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.


text: Cybersecurity Risk Management and Strategy We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and reported to our Audit Committee of the Board of Directors, or the Audit Committee, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct regular tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees and consultants with tools to make employees and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by our assessments, audits and reviews. Such processes include (i) procedural and technical safeguards, (ii) response plans, (iii) annual tests on our systems, (iv) incident simulations and (v) routine review of our cybersecurity policies and procedures to identify risks and improve our practices. We engage certain external cybersecurity firms to enhance our cybersecurity oversight. We include confidentiality provisions in all contracts with third-party service providers, and data protection provisions in certain contracts with third-party service providers where applicable, to help protect us and our employees and patients from any related vulnerabilities.


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee of our Board of Directors meets annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team.


text: We use an internal management committee to run our information and technology team and our information and technology team includes our cybersecurity team lead who has served in various roles in information technology and information security for over 25 years, including at other public companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee quarterly with an overview of our cybersecurity threat risk management and strategy processes. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding significant new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factor — Risks Related to our Business and Managing Growth" in Part I, Item 1A of this Form 10-K, cybersecurity threats could pose multiple risks to us. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.


text: The Company's management is responsible for the day-to-day management of risk, and our board of directors, including through its committees, is responsible for understanding and overseeing the various risks facing the Company.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. Getty Images seeks to manage cybersecurity risks consistent with its general approach to enterprise risk management.


text: Getty Images engages third parties to conduct assessments to help it identify, categorize and manage cyber risks and to confirm compliance with applicable legal and regulatory requirements. Additionally, management and third parties conduct ongoing vulnerability scanning and performs penetration testing from time to time to help Getty Images identify and reduce the threat of known and emerging cybersecurity risks.


text: Board Oversight and Governance Getty Images' board of directors has delegated the oversight of cybersecurity risks to the Audit Committee. The Audit Committee assists Getty Images' board of directors in its oversight of the policies and practices used by Getty Images to identify, assess and manage key risks facing Getty Images, including cybersecurity risks. Members of management, including the Company's Chief Technology Officer ("CTO"), provide the Audit Committee with updates on cybersecurity and information technology matters. In turn, the Audit Committee and management also provide updates to Getty Images' board of directors. In addition to reporting to the Audit Committee and Getty Images' board of directors, the CTO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or Getty Images' board of directors, is notified of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.


text: Cybersecurity Oversight Management plays an important role in assessing and managing Getty Images' material risks from cybersecurity threats. The CTO is responsible for oversight of the design and implementation of the security program and strategy. Getty Images' current CTO has served in various roles in technology for over 25 years, and has had had oversight of information technology and information security for both Getty Images (6+ years) and other organizations.


text: At the employee level, we maintain an experienced information technology team who is tasked with implementing our privacy and cybersecurity program and support the CTO in carrying out reporting, security, and mitigation functions.


text: As part of the Getty Images cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: Getty Images has a global Information Security Incident Response Plan (the "Plan") for identifying and managing cyber and data security threats. The Plan defines the roles and responsibilities of Company stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. A cross-functional working group of security, privacy, and legal personnel review significant incidents to determine if further escalation is appropriate. If an incident could be deemed material, it is escalated to the CTO and other members of the executive team, and we consult with outside counsel during this assessment as appropriate. • Technical Safeguards: Getty Images seeks to continuously improve technical safeguards that are designed to protect its information systems. Standards include controls for identity and access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While Getty Images seeks to maintain adequate cybersecurity controls, it may not always be effective. See "Item 1A. Risk Factors—Our failure to protect the proprietary information of our customers and our networks against cyberattacks, security breaches or unauthorized access could adversely affect our business and results of operations, damage our reputation and expose us to liability" and "We collect, store, process, transmit and use personal information, which subjects us to governmental regulation and other legal obligations in many jurisdictions related to privacy, information security and data protection" for more information as well as related risks. • Education and Awareness: We require annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. • Third-Party Risk Management: We rely on certain third-party computer systems and third-party service providers in connection with providing some of our services. We also depend upon various third parties to process payments for our transactions around the world. These third-party business partners, service providers, and consultants need to access our customer and other data and in some cases connect to our computer networks. We define expected security and privacy requirements through our contracting processes with third parties and we perform third-party cyber risk assessments to monitor the cyber risk management efforts of third parties as needed. • Threat Intelligence: Our security teams engage in threat intelligence, predictive modeling, and penetration testing to understand the Company's threat landscape and reduce the risk and impact of cybersecurity incidents.


text: Material Effects of Cybersecurity Incidents As of the date of this Annual Report, we have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems. We do not believe these cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in "Item 1A. Risk Factors" in this Annual Report, as updated by Getty Images' subsequent SEC filings. The risks described in such filings are not the only risks facing Getty Images. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial may materially adversely affect Getty Images' business, financial condition, or results of operations.


text: Cybersecurity Risk Management and Strategy The Company recognizes the security of our banking operations is essential to protecting our customers, maintaining our reputation, and preserving the value of the Company. The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Enterprise Risk Management Program establishes policies and procedures for assessing the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program: Federal Financial Institutions Examination Counsel Cybersecurity Assessment Tools and GLB Act and regulations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Enterprise Risk Management Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the section titled "Governance," the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program. Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees. To maintain alignment and appropriate insight regarding information security activities, a bi-weekly operational committee provides general program insight. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, assessing, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management. • Security Competencies: The organization oversees a program of security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense and Incident Response Plan: The Company utilizes sophisticated security monitoring and detection tools for continuous monitoring of our information systems 24 hours per day, seven days per week. The Company utilizes third-party tools and solutions to actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. We also receive the latest cybersecurity alerts and threat intelligence from government agencies and information sharing and analysis centers. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidance on our response to incidents by focusing on the coordination of personnel, policies, and procedures to ensure incidents are detected, analyzed and managed. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Vendor Management Program. The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management. A review process is conducted on new or significantly changed key third parties, to ensure certain cybersecurity baseline requirements are met and cybersecurity incidents are appropriately disclosed. This process is aimed at advocating for appropriate standards and controls, based on risk factors, to secure the third parties' information systems, and to ensure the third parties have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.


text: The Company leverages continuous monitoring and regular risks assessments to identify the Company's current and potential cybersecurity risks. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board Risk Oversight Committee.


text: The Company engages third parties on a regular basis to assess, test and assist with the implementation of our cybersecurity program to detect and manage cybersecurity risks, including but not limited to third parties who assist with monitoring our information security systems and auditors who assist with conducting penetration tests.


text: Cybersecurity Governance The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Oversight Committee reviews and approves the Information Security Policy, which includes the Company's cybersecurity risk management program. The Board of Directors receives regular presentations and updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, risk and vulnerability assessments, independent audit reviews, and technological trends. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full board of directors discusses the Company's approach to cybersecurity risk management.


text: The Information Security Officer, under the guidance of our Chief Risk Officer and Operational Risk Manager, works collaboratively across the Company to implement a program designed to protect the Company's information systems and data from cybersecurity risks. The Information Security Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents in accordance with the Company's Incident Response Plan and Business Continuity Plan, and reporting incidents to appropriate personnel at the Company in accordance with the Incident Response Plan. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Information Technology and the Operational Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Information Security Officer and Chief Information Officer and ultimately the Board Risk Oversight Committee when appropriate. The Information Security Department has over three decades of experience in managing Information Security and Cybersecurity programs at financial institutions. The Information Security Officer holds the Certified Information Security Manager Certification and is supported by additional team members with extensive backgrounds in cybersecurity and related fields.


text: Notwithstanding our efforts at cybersecurity, the Company cannot guarantee that it will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business.


text: Risk Management and Strategy Mattel has processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which include developing, implementing, and maintaining cybersecurity measures and controls. Mattel considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk; impact on Mattel and others, including retail customers, suppliers, consumers, or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on operations.

companyName: MATTEL INC /DE/

ticker: MAT


text: As part of its cybersecurity risk management program, Mattel utilizes cybersecurity assessors, consultants, auditors, and other third-parties to assist its internal team with network security, cloud security, endpoint security, data loss prevention, and security information and event management. In addition, Mattel utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents.


text: Mattel seeks to identify vulnerabilities and mitigate risks from cybersecurity threats posed by its use of third-party technology, information systems, and service providers through oversight by Mattel's information technology ("IT") organization through a variety of processes, including conducting onboarding due diligence, imposing contractual obligations related to privacy and information security, and regularly monitoring the performance of third parties providing critical support systems.


text: To support incident response preparedness, Mattel has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact Mattel or arise from Mattel's use of third-party technology, information systems, and service providers. Mattel also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that Mattel relies upon. Further, Mattel monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.


text: As part of Mattel's overall risk management program, Mattel's IT organization has a governance, risk, and compliance group that provides oversight regarding IT-related risks, including cybersecurity risks, and monitors Mattel's IT control environment. This group also works with Mattel's Internal Audit team to assess Mattel's cybersecurity processes. In addition, Mattel's IT organization has a steering committee comprised of internal privacy and cybersecurity experts, chaired by Mattel's Chief Information Security Officer ("CISO"), which is responsible for the development and maintenance of Mattel's privacy and information security programs and regularly reports to Mattel's Chief Technology Officer ("CTO").


text: Mattel is subject to cybersecurity threats that could have a material adverse impact on its results of operations, financial condition, and liquidity, as further discussed in Item 1A "Risk Factors" under the headings of Legal and Regulatory. Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition. However, there can be no assurance that Mattel will be able to mitigate negative impacts in the same way in the event of future attacks or other cyber incidents.


text: Mattel's CISO has more than twenty years of cybersecurity industry experience at Mattel and elsewhere and is responsible for coordinating cybersecurity efforts within Mattel, with a focus on cybersecurity threat prevention, detection, and mitigation, as well as enhancement of privacy and security measures, including security updates, security architecture and engineering, and identity access management. Mattel's CISO reports to the CTO, regularly communicating risks and other relevant information related to cybersecurity threats and incidents. Mattel's CTO has significant leadership, cybersecurity, and technology experience, is responsible for overseeing the monitoring and mitigation of cybersecurity threats, and advises and consults Mattel's senior management regarding material cybersecurity risks.


text: A team led by the CISO implements and maintains systems designed to detect and prevent cybersecurity threats, monitors important developments that may present risk to Company and third-party systems, and oversees the results of internal and third-party security reviews. The CISO provides regular updates to Mattel's CTO regarding critical and major severity security incidents involving Company systems, security incidents involving third parties that have the potential to impact Mattel's operations or involve sensitive customer, supplier, consumer, or employee data, and mitigation and remediation implemented to address such threats or incidents.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the Company's assessment and management of material cybersecurity risks. The CTO reports to the Audit Committee on Mattel's cybersecurity, including material cybersecurity risks and mitigation, at least annually. The CTO reports and escalates cybersecurity incidents to management and the Audit Committee as appropriate.


text: Information Security Risk Management and Strategy We manage our cybersecurity risk in accordance with our Information Security Program, which is applicable to all users of our information technology assets, information assets, and facilities, including our directors, officers, employees, temporary workers, business partners, contractors, vendors, service providers, and individuals affiliated with third parties. The Information Security Program includes a dedicated Cybersecurity Incident Response Plan (the "CIRP"), which sets forth the rules and requirements for detecting, investigating, containing, eradicating, and resolving information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) a collection of Security Incident Forms, which delineate the processes for reporting, classifying, investigating, documenting, and communicating information security incidents and (ii) Security Guidelines and Baseline Protections, that establish the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual) in connection with security incidents.

companyName: Community West Bancshares

ticker: CWBC


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a member's direct supervisor, IT Management, and / or the Information Security Officer, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Information Security Officer and the Incident Response Team ("IRT") in accordance with the CIRP.


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level "One," "Two," or "Three" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the IRT and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the IRT and ISO will engage the Company's technology service provider to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee and/or the Board of Directors Technology Committee. The ISO reports to the Senior Risk Officer.


text: The ISO has over 15 years of industry experience including management of cybersecurity, enterprise telecommunications infrastructure, and vendor relationships as well as possessing both undergraduate and graduate level degrees, including a Bachelor of Science Information Security and Assurance and Master of Science Information Security and Assurance. Additionally, the ISO was previously certified in 18 industry niches to foster in-depth understanding of technology and its associated risks, including certification as a Certified Ethical Hacker, Certified Computer Hacking Forensics Investigator, Database Design, Web Design, CCNA Routing, Switching, and Security, and is currently enrolled in the International Information System Security Certification Consortium's official Certified Information Systems Security Professional curriculum. Furthermore, the ISO must effectively collaborate with business leaders, executives, and stakeholders. To bolster the collaboration, communication, and business skills necessary to effectively analyze risk holistically, the ISO has undertaken additional graduate level curriculum, including a Master of Business Administration degree program, while maintaining active membership in the National Society of Leadership and Success Honors Society.


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. The ISO performs information security assessments for third party service providers that store or process our confidential data. These information security assessments, include a review of any service organization controls ("SOC") reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor. In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a annual basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Our Information Technology Steering Committee consists of members of the Executive Management Team and department heads with relevant technology experience, and meets on a bimonthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Technology Committee which also meets on a bimonthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Directors Technology subcommittee and/or Audit Committee sooner than its next bimonthly update.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.


text: Cybersecurity risk management is a critical part of our overall risk management efforts. We have adopted security-control principles based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and other industry-recognized standards, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these principles as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity strategy prioritizes detection, analysis, and response to known, anticipated or unexpected threats. We implement and continue to update risk-based controls to protect key information and systems. Some of the controls and processes in place to manage risks from cybersecurity threats include monitoring systems, enforcement mechanisms, employee training, tools and related services from third-party providers, and management oversight.

companyName: Karat Packaging Inc.

ticker: KRT


text: At least annually, we conduct a cybersecurity risk assessment to identify the inherent cyber security risks and threats to which we are exposed to, evaluate maturity and effectiveness of our systems and processes in addressing such identified risks and threats, and to identify any areas for further enhancements. Our cybersecurity risk assessment considers information from internal stakeholders, known and potential information security vulnerabilities, and data from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on prioritization of initiatives to enhance our security controls, make recommendations to senior management, and if necessary, but at least annually, inform the Audit Committee and Board of Directors.


text: Incident Response and Recovery Planning We maintain an incident response and recovery plan (the "IRR Plan") that guides our activities in preparing for, detecting, responding to, and recovering from cybersecurity incidents. The IRR Plan identifies the working group responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRR Plan also covers the range of activities we undertake in connection with responding to cybersecurity incidents, including monitoring, identification, investigation, assessment, containment, remediation, and mitigation, as well as compliance with legal obligations including any necessary regulatory reporting. Incidents are evaluated, ranked by severity, and prioritized for response, remediation and reporting, if needed.


text: We also engage third-party security consultants to assist with assessment and enhancement of our cybersecurity risk management program and compliance with applicable practices and standards. Should a cyber security incident occur in the future, we may engage third parties to assist us in responding to the incident as well as enhancing our cybersecurity risk management program, if necessary.


text: The importance of cybersecurity is conveyed internally within the organization as well as externally. Within the organization, our cybersecurity efforts are led by our Information Technology ("IT") Manager who is a Microsoft Certified Professional and holds CompTIA Network+ and Cisco Network certifications. We have also established an IT steering committee consisting of members from various key departments including IT, Finance, Operations, and Human Resources. The IT steering committee convenes at regular periodic intervals and reviews IT strategic and investment priorities, including the Company's cybersecurity programs. Our policies also require each of our employees to contribute to our data security efforts. At least annually, employees are required to attend a mandatory training on how to recognize phishing attempts and how to best handle and report cybersecurity threats.


text: In addition, we collaborate with third party software as a service providers and other service providers to maintain policies and procedures governing our third-party security risks. We evaluate and ensure such third parties maintain appropriate security controls to protect our confidential data, and notify us of material data breaches that may impact our data.


text: Cybersecurity is an important part of our risk management processes and an area of focus for senior management. Our Board of Directors has oversight of our strategic and business risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. Members of the Audit Committee receive updates on an as-needed basis, but at least annually, from senior management. This includes existing and new cybersecurity risks, how management is assessing and addressing such risks, status on key information security initiatives, and cybersecurity incidents, if any, and responses. Members of our Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management program.


text: In the event of a cybersecurity event, a cross-functional steering committee involving the IT, Finance, and Legal departments, would review and assess the incident and determine whether further escalation and regulatory reporting is required. Any incident assessed as potentially being or becoming material is immediately escalated to the Audit Committee, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate.


text: We consult with our outside legal counsel as appropriate, including on materiality analysis and disclosure matters. Senior management makes the final materiality determination and disclosure decisions. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: In 2023, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Risk Management and Strategy We use a "cloud-only" environment for our information systems; there is no central access point that provides access to all software and related data. We use third-party clinical research organizations ("CROs") to manage all patient-related data and review their cybersecurity procedures as part of vendor evaluation. Our employees do not have access to any patient-identifiable data.

companyName: Fresh Tracks Therapeutics, Inc.


text: The Company has an IT Security Policy that establishes IT security and rules for the Company. This policy covers both good practice quality guidelines and regulations ("GxP") and non-GxP IT systems. With the assistance of a senior IT consultant, management has evaluated the potential cyber risk associated with each of our information systems, both internal and external, taken appropriate steps to mitigate risks, and assigned specific tasks to our Cyber Incident Response Team members in case of a cyber incident. Our Cyber Incident Response Team currently consists of all remaining members of management.


text: Our cybersecurity environment emphasizes the role of each individual user in preventing a cyber incident. We have implemented required monthly video-based cybersecurity training. All users are tested on each training module. This training is supplemented by "test" phishing messages to see if users are alert to cyber risks.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, as further described in Part I, Item 1A, " Risk Factors " in this Annual Report.


text: The Board is responsible for general risk oversight. The Board reviews and evaluates management's evaluation and mitigation of cyber risks as part of its oversight of the Company's Risk Management program. Management periodically reviews cyber risks, incidents, and risk mitigation plans and activities with the Board. In addition to recommendations from our senior IT consultant, we engaged an outside consulting firm to conduct a review of our information systems environment and make recommendations to improve security where appropriate. Management shared the report's findings with the Board and periodically updates the Board regarding our progress on implementing the report's recommendations.


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our critical third-party service providers. These cyber-attackers can attempt to gain unauthorized access to our digital systems for purposes including, but not limited to: misappropriation of company assets, accessing Company confidential or sensitive customer non-public information, corrupting data, causing operational disruptions, or as part of a ransom demand for payment. As described below, we believe we have appropriate risk management processes, governance policies, standards, and procedures, a system of internal controls designed to address and mitigate these risks, and experienced internal resources to execute our information security and cybersecurity risk management programs.

companyName: Capital Bancorp Inc

ticker: CBNK


text: In 2020, the Company's Board of Directors approved the implementation of a three lines of defense enterprise risk management framework upon the hiring of our current Chief Risk Officer/Chief Information Security Officer ("CRO/CISO"). Our three lines of defense enterprise risk management framework includes processes and procedures used to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.


text: Within the three lines of defense framework for cybersecurity risk, the first line of defense is provided by the Information Technology department, which is responsible for the design and execution of information security practices and risk mitigation, led by the Company's Business Information Security Officer ("BISO"). The BISO reports to the Chief Information Officer, who leads the Company's Information Technology department.


text: The second line of defense is provided by the Enterprise Risk Management department, which is led by the Company's CRO/CISO. The department seeks to identify, assesses, and monitors cyber risk, in collaboration with our first line, while maintaining independent oversight of our information security program. The CRO/CISO is independent of management and reports to the Board Risk Committee Chair.


text: The third line of defense is independent Internal Audit, led by our Head of Internal Audit, who is responsible for ensuring that the first and second line of defenses are both designed and operationally effective in mitigating cybersecurity risk through internal audits of including but not limited to: cybersecurity, electronic banking, GLBA/Privacy, information security, information technology, and vendor risk management. The Head of Internal Audit is independent of management and reports to the Board Audit Committee Chair.


text: Our BISO, CRO/CISO, and Head of Internal Audit have nearly seven decades of combined work experience, including six decades in banking and financial services risk management and information security roles, and all maintain several industry licenses and certifications through continuing professional education.


text: The Company's information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data on our systems as well as securing our interfaces with our critical third-party service providers.


text: Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees, management, management's committees, as well as each individual Company employee.