text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of a variety of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs our Chief Financial Officer and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Compliance Committee and the full Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH

secItem: Item 1C


text: Risk Management and Strategy The Company maintains a cyber risk management program that is designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program addresses both the corporate information technology ("IT") environment and customer facing products. In line with our dedication to upholding strong corporate governance standards and safeguarding the security of our operations, we maintain a continuous effort to assess and mitigate cybersecurity risks that could impact our business, stakeholders and the integrity of our systems. Additionally, we maintain a similar risk-based approach to our third-party vendor management program including identifying and overseeing cybersecurity risks they present.

companyName: NBT BANCORP INC

ticker: NBTB


text: The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information security, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This framework organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company regularly assesses the threat landscape of cybersecurity risks, with a layered defense in depth strategy that is focused on prevention and detection.


text: Employing comprehensive methodologies for risk assessment, we diligently identify and evaluate potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks. We actively participate in industry forums, information sharing initiatives and collaborate with relevant stakeholders to exchange threat intelligence and best practices.


text: The Company continues to expand investments in Information Technology security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting. We emphasize continuous training for our staff to improve their ability to identify and address diverse cybersecurity threats. We invest in cybersecurity technology and talent to support this endeavor. Furthermore, we conduct thorough reviews of our vendors and mandate specific security standards for third-party providers. Our comprehensive policies and procedures are designed to safeguard the integrity and security of information collected by us and our service providers on our systems. Additionally, we have implemented security measures to prevent unauthorized access to personal data and minimize the consequences of potential incidents. We consistently learn from any event and look at postmortem improvements where necessary to enhance our security and resilience.


text: The Company consistently collaborates with third party experts to conduct audits, penetration testing, assessments and validations of our controls, aligning them with established frameworks like the NIST CFS. We adapt our cybersecurity policies, standards, processes and practices accordingly based on the insights provided by these reviews. These audits and assessments are useful tools for maintaining a robust cybersecurity program.


text: It is the responsibility of the Risk Management Committee ("RMC") of the Board to oversee the Company's cybersecurity risk exposures and action taken by management to monitor and mitigate cybersecurity risks.


text: Cybersecurity risks are reported to the RMC at least quarterly and those reports include key performance indicators, test results, recent threats and how the Company is managing those threats, along with the effectiveness of the Information Security and cyber risk program. The RMC is responsible for monitoring our Information Security Program ("ISP") and is led by a member of our Board of Directors. The RMC reports quarterly to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board receives briefings from executive management on the overall Information Security program at least annually.


text: The Company has appointed the Senior Director of Information Security ("DISO") to oversee the implementation, coordination, and maintenance of the ISP. The responsibilities of the DISO include developing and implementing our information security program, designing appropriate administrative, technical, and physical safeguards to protect institutional data and ensuring the implementation and maintenance of safeguards across the Company as needed. The DISO reports to our Chief Risk Officer and has over a decade of experience leading cybersecurity oversight along with expertise in cyber-crime prevention, threat intelligence, social engineering, identity access and governance, identity theft and fraud prevention through prior roles in the organization. The Information Security team has cybersecurity experience or certifications, such as the Certified Information Systems Security Professional and Certified Information Security Manager from the Information Systems Audit and Control Association.


text: The DISO also administers the Incident Response Team ("IRT") and its members, which is comprised of various high-ranking executive personnel such as the Chief Audit Officer, Chief Compliance Officer, General Counsel, and representatives from Technology, Operations, Accounting and Corporate Communications. Members of the NBT IRT have extensive knowledge regarding the security protocols, operational processes and IT infrastructure for the Company. This allows cross-functional response efforts in the detection, mitigation and prevention of a cybersecurity incident suffered by the Company or its third party service providers. Upon detection of an incident, the IRT promptly convenes and updates executive leadership to assess its severity level, categorizing it as low, moderate, or high. The Company actively performs simulations and tabletop exercises at a management level and incorporates external resources as needed to stay current to cyber threat vectors. The Incident Response Plan also maintains procedures and escalation protocol to escalate significant cybersecurity matters to the Executive Committee, RMC and/or full Board, as deemed necessary.


text: During the incident response process, senior management, in collaboration with relevant personnel from information technology, information security, and, when necessary, external cybersecurity firms specializing in forensic investigations will assess the materiality of the breach alongside the severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of immediate impact and reasonably likely future impacts.


text: Although cybersecurity threats, including those stemming from prior incidents, have not had a significant impact on the Company in the previous fiscal year, and there are no known imminent cybersecurity threats likely to materially affect us, we cannot guarantee that we will remain unaffected in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe. For further discussion of such risks, see the section entitled "Risk Factors" in Item 1A of this Form 10-K under the heading "Risks Related to Cybersecurity and Data Privacy."


text: Risk Management and Strategy Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity / information security program. The Information Security Officer reports directly to the Chief Operations Officer, and periodically reports to the Audit and Examination Committee of our board of directors.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance and related industry standards. In addition, we leverage various cyber-related associations, threat intelligence feeds, and audits to facilitate and promote program effectiveness. The information security program is periodically reviewed by the Information Security Officer in collaboration with information technology management with the goal of addressing changing threats and conditions.


text: We employ a layered defensive strategy when designing our cybersecurity controls. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations, and tabletop exercises. We engage in regular monitoring and assessments of our technology infrastructure using internal staff and third-party specialists. We conduct ongoing social engineering testing and training across our entire employee base. We maintain a vendor management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Our independent auditors periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our CEO and Board of Directors as appropriate. The Incident Response Plan is coordinated by the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple areas of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company to date. For further discussion of risks from cybersecurity threats, see the section captioned "We are subject to certain risks in connection with our use of technology" in Item 1A. Risk Factors.


text: Our Information Security Officer is responsible for managing our information security program, inclusive of cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business continuity. Some of these responsibilities are carried out in collaboration with other internal departments, such as the information technology department. In any case, the Information Security Officer provides guidance, oversight, and monitoring of the information security program, and acts in an independent role, reporting directly to the Chief Operations Officer and subsequently to the Audit and Examination Committee of the board of directors. Our Information Security Officer has extensive bank operations experience, has attained Certified Banking Security Manager certification with the banking industry, and attends relevant cybersecurity training sessions on a regular basis. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats.


text: The Audit and Examination Committee of our board of directors is responsible for overseeing our information and cybersecurity risk management program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Audit and Examination Committee of our board of directors regarding the information security program, cybersecurity and/or privacy incidents, key cybersecurity initiatives, and other matters relating to cybersecurity processes. These reports may occur more frequently if a significant issue or incident is being addressed.


text: Cybersecurity Risk Management and Strategy The Company recognizes the security of our banking operations and the confidentiality, security and availability of the information that the Company collects and stores, is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. The Company has implemented a comprehensive cybersecurity risk management program that we believe is reasonably designed to mitigate these risks and protect sensitive customer data, financial transactions and our information systems. Key components of the cybersecurity risk management program include:

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors.


text: A third-party Managed Detection and Response ("MDR") service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting.


text: A third-party Managed Security Service Provider ("MSSP") covering all critical cyber defense functions such as data protection, identity and access management, insider risk management, security operations and threat intelligence. A training program that educates employees and management about cybersecurity risks and how to protect themselves from cyberattacks.


text: An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: The Company engages reputable third-party auditors and security assessors to conduct various independent risk assessments on a regular basis, including cybersecurity program maturity assessments and network and systems testing to identify and address potential vulnerabilities. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Our vendor management program is designed to ensure that our vendors meet current cybersecurity and information security standards. This includes conducting periodic reviews of independent control audits of the security, infrastructure, application standards or controls, and recovery plans of our most critical vendors.


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission, to ensure the confidentiality, integrity, and availability of Company information.


text: These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.


text: The Company has an incident response program in place that is designed to enable a coordinated response to mitigate the impact of cyber-attacks, recover from the attack and provide for the prompt escalation of certain cybersecurity incidents to management, including for decisions regarding timely reporting of material incidents in accordance with SEC rules.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Part I, Item 1A, "Risk Factors" in this report.


text: Board of Directors Oversight The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's cybersecurity risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has delegated primary oversight responsibility over the Company's cybersecurity risk and cybersecurity risk management to the Information Services Steering Committee of the Board of Directors. The Information Services Steering Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Information Security Officer ("ISO") and/or the Chief Information Officer ("CIO"). The ISO and/or CIO also provide periodic updates regarding cybersecurity risks and the cybersecurity program to the Audit Committee of the Board of Directors and to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The ISO and the CIO are responsible for implementing and maintaining the Company's cybersecurity risk management program. Information Security is led by the ISO, who reports directly to the President/Chief Executive Officer. The Company's ISO has over 35 years of experience in IT management, information security, and cybersecurity with the Company. The ISO and CIO are responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the ISO or the CIO through quarterly metric reporting to the Information Services Steering Committee. This Committee establishes and oversees policies, programs, and other guidance to provide specific expectations for managing the Company's cybersecurity risk.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Nuwellis, Inc.

ticker: NUWE


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees [from our information technology department], our senior vice president of operations and engineering, and our board of directors. The board of directors, Audit Committee, and senior and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management protocols are comprised of software programs including antivirus protection, end-point threat detection, remote access, multifactor authentication. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an employee handbook as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to incident response, confidential information and the use of internet, social media, email and wireless. These policies go through an internal review process and are approved by our senior vice president of operations and engineering.


text: Our Senior Vice President of Operations and Engineering is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the board of directors. Nuwellis leverages 3 rd party IT service provider and specifically their cybersecurity team's expertise.


text: All employees are required to complete cybersecurity training as part of on-boarding process and on-going training both online and in-person. IT department assigns position specific security level encryption to manage information security We have continued to expand investments in IT security, including software programs and policies mentioned above. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation.] In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers.


text: The Audit Committee and the full board of directors periodically participate in discussions with management and amongst themselves regarding cybersecurity risks. As of 2023 the Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap.


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages as part of our risk management processes. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. Although the board members are former executives of publicly traded companies, none of them have specific cybersecurity experience.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. Such occurrences could negatively impact our business strategy, reputation and results of operation. For more information about the cybersecurity risks we face, see our risk factors in Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Risk Management and Strategy The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Governance: As discussed in more detail under the heading "Governance," the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee of the Board of Directors (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Vice President of Information Technology, other members of management and relevant management committees and councils, including management's Sarbanes-Oxley & Cybersecurity Steering Committee.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt and appropriate internal reporting of certain cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Incidence Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans intended to fully and timely address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to proactively address cybersecurity threats and prevent incursions and to communicate the Company's evolving information security policies, standards, processes and practices. Our awareness program includes assessment of our personnel's preparedness through regular phishing e-mail alerts, highlighted banners that warn about external senders, and tests administered to help the Company's personnel interrogate, navigate around, and avoid clicking suspicious and unfamiliar links from unknown senders.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are periodically reported to the Audit Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by these assessments, audits and reviews.


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed.


text: On an annual basis, the Board of Directors and Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Sarbanes-Oxley & Cybersecurity Steering Committee, which includes the Company's President and Chief Financial Officer ("CFO") and Vice President of Information Technology.


text: The Sarbanes-Oxley & Cybersecurity Steering Committee, in coordination with the Company's outside legal counsel, works collaboratively across the Company and with various consultants to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Vice President of Information Technology has served in various roles in information technology and information security for over 25 years and holds undergraduate and graduate degrees in computer science. As described in more detail above under the heading "Information about our Executive Officers," the Company's Chief Executive Officer and the President and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 30 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: As of December 31, 2023 and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this report.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through its audit committee, which provides oversight of our cybersecurity program as part of its periodic review of enterprise risk management.


text: Our Chief Executive Officer and Senior Vice President of Finance are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Senior Vice President of Finance have assistance from consultants.


text: Our Chief Executive Officer and Senior Vice President of Finance oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Under such policies and processes, our Chief Executive Officer and Senior Vice President are responsible for reporting to our audit committee regarding any cybersecurity incidents.


text: The audit committee, in turn, provides periodic reports to our board of directors regarding our cybersecurity processes, including the results of cybersecurity risk assessments.


text: The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If we fail to observe such regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties. In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.


text: Under a final rule adopted by federal banking agencies in 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization's ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the Board of Directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services.


text: A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. "Risk Factors" for a further discussion of risks related to cybersecurity.


text: Risk Management and Strategy Information security and cybersecurity risk is the risk that the security, confidentiality, integrity or availability of our information and critical information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Cybersecurity attacks and other security breaches can have material adverse impacts on our business. While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. The Bank devotes significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs. However, our facilities and systems, and those of third-party service providers, are still vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. The Company seeks to address cybersecurity risks through the implementation of a governance structure and processes to assess, identify, manage, remediate, and report cybersecurity risks.


text: Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture. We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable "best practices" and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments and to remediate material identified vulnerabilities.


text: We have in place a robust incident response process that helps ensure our preparedness for a cybersecurity incident including our ability to detect, analyze, contain, remediate, and recover from a security incident as well as conduct post-incident analysis to avoid future incidents. Incident response process activities are overseen by cross-functional leadership in Risk Management, Operations, Information Security, Compliance, and Information Systems. Security events and incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business, and overall privacy impacts. We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.


text: Our risk management program regularly assesses third-party risks (inclusive of fourth-party risk) by conducting activities to identify and mitigate risks from third-parties (e.g., vendors, suppliers, and other business partners). Cybersecurity risks are evaluated when selecting and managing applicable third-parties that handle or process employee, business, or customer data, and a review process that includes due diligence over a third-party's information security and technology control environment is conducted at onboarding and periodically throughout the lifecycle of the relationship to ensure that systems of third- parties meet certain security baseline requirements. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.


text: Cybersecurity Gover nance Given the importance of information security, privacy and data protection to our stakeholders, cybersecurity is a critical part of our risk management program and a key focus area for our Board and Executive Management. The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help manage our risk exposure to meet our strategic objectives. Executive Management and our Information Security Officer ("ISO") regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.


text: The Audit & Risk Committee meets on a monthly basis to receive updates from management, including leaders from Information Systems, Information Security, Risk Management, and Compliance, on matters of cybersecurity risks and mitigation initiatives. The leaders from these areas each bring over 20 years of professional experience and certifications in information technology, information security, information systems audit, compliance, and risk management. This group of leaders provides updates on existing and new cybersecurity risks, status updates on how management is addressing or mitigating cyber risks and cybersecurity or privacy incidents, and progress on key cybersecurity initiatives.


text: The Electronic Data Processing ("EDP") Steering Committee is a senior management level committee that meets at least quarterly to discuss a variety of information technology and cybersecurity matters, which form the basis for providing status reports to the Board of Directors. The committee is responsible for monitoring all Information Systems-related projects and initiatives, facilitating the remediation of issues that could adversely impact the ability of the Information Systems Department to perform its function, and allocating available resources to the highest priority projects and initiatives. The Chief Administrative Officer chairs the EDP Steering Committee and members of Executive Management, Information Systems, Information Security, Treasury Management, Retail and Wholesale Banking departments are represented in the meetings. In addition to project management guidance, the committee provides oversight of and direction for the Information Security Program, monitors cybersecurity risks, and helps ensure prompt remediation of cybersecurity incidents.


text: In 2023, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition; however, cybersecurity threats are pervasive. Despite the capabilities, processes and security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, cybersecurity threats are continuously evolving, which may cause cybersecurity threats to be more difficult to detect in the future. See "Risk Factors - Risks Related to Cybersecurity and Information Technology" in Part I, Item 1A of this Form 10-K, for additional information about these and other risks related to cybersecurity and information technology.


text: Ohio Valley recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As a result, the Company has devoted significant financial and personnel resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of the Company's Information Security Program; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert us of potential threats;

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in an efficient and effective manner;


text: Collaborating with third-party cybersecurity consultants that perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes; Utilizing a third-party risk management program for purposes of identifying, assessing, and managing risks involved with external service providers;


text: Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices; and Providing regular cybersecurity training for both our employees and our Board of Directors.


text: The Board, through the Information Technology Steering Committee, works with senior management and other employee committees to oversee the development, implementation, maintenance, and administration of the Information Security Program, which is aligned and integrated into Ohio Valley's overall risk management system and processes. The Information Technology Steering Committee itself is comprised of diverse directors and officers of the Bank with vast knowledge and years of banking experience. The Information Security Officer of the committee has 25 years of banking experience including 24 IT related years as well as continuing education including a BA in Management Information Systems and Network+ and A+ certifications. The purpose of the Information Security Program is to: Identify and analyze cybersecurity risks; Provide the Company with direction on effectively managing such risks; Approve information security plans, policies, and programs; Assess whether the Company's current security programs are effective; and Provide recommendations for corrective action.


text: The Company has also implemented an Incident Response Plan which is reviewed and updated at least annually in response to an ever-changing threat landscape. The purpose of the Incident Response Plan is to provide long-term strategies for the remediation and prevention of, and resiliency to, cybersecurity threats and incidents. Our Incident Response Plan is executed through the incident response team comprised of both cybersecurity experts and select members of management, including one or more Information Security Officers, who are responsible for monitoring potential threats and identifying events that may warrant Board notification and/or public disclosure. Additionally, our Information Security Officers are responsible for responding to security events by ordering emergency actions to protect the Company and its customers; managing negative effects on the confidentiality, integrity, and availability of information; and minimizing the disruption and degradation of critical services.


text: Notwithstanding the strength of Ohio Valley's defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Ohio Valley has not detected a significant compromise, significant data loss, or any material financial losses related to cybersecurity attacks, Ohio Valley's systems and those of its customers and third-party service providers are under constant threat, and it is possible that Ohio Valley could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us and our customers.


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, and for various other aspects of the business.

companyName: AmBase Corp

ticker: ABCP


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies on third party service providers to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to any tenants' and employees' personal data.


text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These cybersecurity processes are integrated into the Company's overall compliance, risk management, and oversight procedures as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company's process allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness, incident response, and disclosure procedures as required by the SEC.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: The Company may review SOC1 or SOC2 reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cyber security and awareness training to our employees to help mitigate the risk of threats posed by bad actor requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.


text: Board of Directors -- The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee and the board of directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or the Senior Vice President of Information Technology.


text: Management -- Under the oversight of the audit committee of the Company's board of directors, the Senior Vice President of Information Technology, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Senior Vice President of Information Technology, are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is ever-changing, the Company must make continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup and recovery systems to restore systems and return to normal operations. However, there can be no assurance that the Company's ability to monitor for or mitigate cybersecurity risks will be fully effective, and the Company may fail to identify cybersecurity breaches or discover them in a timely way."


text: Cybersecurity Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company's information security program is managed by its Vice President, Operations and Technology, whose team is responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program. Advanced security infrastructure with state-of-the-art firewalls and intrusion detection systems. Regular cybersecurity training for employees. Strict data access controls and authentication protocols. Continuous monitoring of our networks and systems for signs of unauthorized activity. Partnerships with leading cybersecurity software and hardware providers for real-time systems monitoring and threat intelligence. Immediate containment and assessment of the incident.


text: Notification to relevant stakeholders, including officers, board members, investors and customers where appropriate, in compliance with legal and regulatory requirements. Cooperation with law enforcement and regulatory bodies as needed. Post-incident analysis and measures to prevent future occurrences.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors".


text: Cybersecurity Governance The Company's Board of Directors oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually. In the event of a cybersecurity incident determined to be significant, management will notify the Board.


text: The Company remains vigilant in its efforts to protect its systems, data, and stakeholders from cybersecurity threats and believes that its proactive and comprehensive approach positions it well to manage these risks effectively.


text: Risk Management and Strategy We outsource substantially all of our IT functions, including cybersecurity, through BankOnIT, LLC ("BankOnIT"), a third-party banking technology service provider. BankOnIT provides significant resources to identify, assess and manage risks from cybersecurity threats, including: Continuous 24/7/365 monitoring of our information systems; Scanning of our information systems; Continuous updating and testing processes; Performing vulnerability assessments; and Maintaining up-to-date firewall and anti-virus protections.

companyName: Bank7 Corp.

ticker: BSVN


text: BankOnIT leverages certain industry and government associations and threat-intelligence resources to keep up to date on, and respond to, the latest cybersecurity threats.


text: We engage in regular assessments of our infrastructure, software systems, and network architecture utilizing third-party cybersecurity professions, including annual penetration testing and audits of our information technology systems to identify vulnerabilities and areas for additional enhancement. Employees receive regular virtual and in-person security awareness training through simulated tests, company communications, and in-person training. We also maintain a third-party vendor management program to identify and assess risks of our third-party service providers.


text: Due to the type and volume of information that we collect and store to provide banking services to our customers, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our customer's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors. We are exposed to cybersecurity risks associated with our internet-based systems and online commerce security, including 'hacking' and 'identify theft.'"


text: Our cybersecurity function is overseen by our Senior Vice President/ Operations & IT Manager who has over 9 years' experience managing such functions. IT functions are also managed through our IT Committee which is comprised of several senior level executive officers and other Company employees and chaired by our Senior Vice President/ Operations & IT Manager. The IT Committee governs all IT functions at the Company and selects, monitors and manages our third-party IT service providers that implement and maintain our cybersecurity functions.


text: We also maintain a Cyber Incident Response Team, which includes a board representative and an executive officer representative and is chaired by our Senior Vice President/ Operations & IT Manager. The Cyber Incident Response Team is charged with developing and implementing incident response and recovery plans to guide our employees, management and the Board in their response to a cybersecurity incident.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, including cybersecurity risks. The full Board receives a network health report at each board meeting from our Senior Vice President/ Operations & IT Manager, which addresses our overall network risk including any relevant cybersecurity threats and incidents.


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel identify and oversee material risks from cybersecurity threats associated with our use of such entities.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Compliance Officer regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management team, including our Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats.


text: Members of our management team possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, information technology management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit Committee (the "Committee"). The Committee has primary responsibility for overseeing our risk management practices, programs, policies, and procedures related to data privacy, data protection, and cybersecurity. The Committee reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect our business. The Committee regularly discusses with management, legal counsel, and the internal audit department our major risk exposures. This includes potential financial impact on us and the steps taken to monitor and control those risks. Reviews with management are done annually, which includes a summary of legal and regulatory compliance matters and risk management activities, and a review of our cybersecurity program. Additionally, the Committee oversees the process by which our Board of Directors is informed regarding the risks facing us and coordinates with our legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Our IT Manager has been designated as our Chief Information Security Officer ("CISO"), who is responsible for identifying, assessing and managing our risks from cybersecurity threats. The CISO has been with the Company for over five years and has many years of experience in technology. The CISO is supported by our outside IT consulting firm and its cybersecurity team that is staffed with personnel experienced in cyber security, security operations and incident management.


text: The CISO reports to the CFO, who provides the Committee with bi-annual updates about our cybersecurity program and material risks.


text: Risk Management and Strategy Processes for identifying and assessing cybersecurity risks The CISO, with the support of the outside consultant's cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on our critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO.


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our IT processes. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through this process, cybersecurity risks are presented to the executive leadership team, including the CEO and CFO, as well as reported to the Committee.


text: Risk Management and Strategy We employ a cybersecurity program which we believe is appropriate for the potential of cybersecurity threats faced by us and is built upon a set of policies, procedures and standards supported by training and education Our information systems employ local and cloud storage and recovery services from various third parties. We have engaged third-party consultants to assess and gather threat intelligence and cyber risk trends and conduct assessments and testing of our cybersecurity procedures and protections.

companyName: FEMASYS INC

ticker: FEMY


text: Governance and Role of Management and the Board Our Chief Operating Officer leads our cybersecurity program and reports, with respect to cybersecurity incidents, to the Company's Chief Financial Officer. Our Chief Financial Officer reports directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversight, including cybersecurity risks. The Chief Financial Officer briefs the Board and Audit Committee on the effectiveness of our cybersecurity program quarterly. We have not experienced any cybersecurity threats or incidents that have had a material impact on our business to date.


text: Risk Management and Strategy We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As we grow, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: Our cybersecurity program is overseen by our head of human resources, information technology (IT) and facilities, who manages our third-party providers of IT services. We have engaged contractors to provide cybersecurity standards, architecture and processes. As part of our service agreement with our contractors, we receive identification and reporting of risks to our management and board. Our information technology team maintains a security operations center intended to identify anomalous activity. Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. Our business depends on the availability, reliability and security of our and our third-party contractors' information systems, networks and data.


text: As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: "Our business and operations would suffer, and could be negatively affected, in the event of system failures or cyberattacks."


text: Our management oversees and reviews any reports of cybersecurity risks or breaches provided by our third-party providers of IT services. Additionally, management assesses potential improvements to our cybersecurity policies and procedures based on recommendations from third-party experts, including our providers of IT services, in a matter that's suitable for a company our size and nature.


text: One of our Board's key functions is informed oversight of our risk management process, including risks from cybersecurity threats. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various Board standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee has the responsibility to review and discuss with management and KPMG LLP, the Company's independent auditors, as appropriate, our guidelines and policies with respect to risk assessment and risk management, including our major financial risk exposures and the steps taken by management to monitor and control these exposures, including as it concerns risks from cybersecurity threats. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk management and strategy We have policies and processes designed to protect our information technology systems, which are managed by outside consultants. Our cybersecurity consultants resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: As part of our broader risk management framework, from time to time, we seek to identify potential cybersecurity risks to our business and improve our policies and processes to address such risks. We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality reviews and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are also engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Cybersecurity Governance Our Nomination and Corporate Governance Committee has specific oversight responsibility for cybersecurity The Nomination and Corporate Governance Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. We utilize cybersecurity consultants to monitor and report cybersecurity threats or incidents to our chief financial officer and to resolve issues arising from such threats or incidents. Our chief financial officer updates the Nomination and Corporate Governance Committee on any risks related to cybersecurity as needed.


text: Our ECVs are fitted with a networking device connecting the vehicle to our proprietary cloud-based software, which enables end-users to collect data about vehicle configuration, vehicle status and user efficiency through a system of digitally enabled components, which we sometimes refer to as "smart components." With the permission of the end-users of the vehicles, we received data collected from approximately 950 Metro units that we put into service through a company affiliated with our former parent company, CAG Cayman, in the Chinese market. This data included vehicle-specific data collected for operational analysis, which we used to make improvements in the quality and durability of such components. We enable end-users to collect, store and analyze data using tools that we have developed but we do not have access to this end-user collected data unless we request and receive access from the end-user. We do not currently collect, use or store any vehicle-specific or driver-specific data in any region and do not intend to do so in the future.

companyName: Cenntro Inc.

ticker: CENN


text: While to our knowledge no previous cybersecurity incidents have occurred, we seek to continuously expand and improve our information technology systems, including implementing new internally developed and/or external industry standard enterprise resource planning systems ("ERP systems"), to assist us in the management of our business. We maintain information technology measures designed to protect us against intellectual property theft, data breaches and other cyber-attacks. The implementation, maintenance and improvement of these systems require significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving and expanding our core systems as well as implementing new systems, including the disruption of our data management, procurement, manufacturing execution, finance and supply chain processes. Elements our cybersecurity information technology measures include efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through: • Cybersecurity risk assessments for identification of material cybersecurity risks to our critical systems, information, products, and our technology environment; • Security personnel and vendors responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Training and awareness programs for our personnel and senior management to drive adoption and awareness of cybersecurity processes and information technology measures; • A cybersecurity monitoring program responsible for tools that produce alerts and reports of suspicious activity for the prevention of and response to cybersecurity incidents; • Internal testing and assessments, where appropriate, of our cybersecurity information technology measures; • Management of external consultants and services engaged by us, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity information technology measures; and • A third-party risk management process for evaluating cybersecurity threats associated with our use of service providers, suppliers, and vendors.


text: Despite network security and back-up measures, our information technology systems are potentially vulnerable to physical or electronic break-ins, computer viruses and similar disruptive problems. Despite precautionary measures to prevent unanticipated problems that could affect our information technology systems, sustained or repeated system failures that interrupt our ability to generate and maintain data could adversely affect our ability to manage our data and inventory, procure parts or supplies or manufacture, sell, deliver ECVs, or achieve and maintain compliance with, or realize available benefits under, tax laws and other applicable regulations.


text: We cannot assure you that any of our new information technology systems or their required functionality will be effectively implemented, maintained or expanded as planned. If we do not successfully maintain our information technology or expand these systems as planned, our operations may be disrupted, our ability to accurately or timely report our financial results could be impaired, and deficiencies may arise in our internal control over financial reporting, which may adversely affect our ability to certify our financial results. Moreover, our proprietary information could be compromised or misappropriated, and our reputation may be adversely affected.


text: If these systems or their functionality do not operate as we expect them to, we may be required to expend significant resources to make corrections or find alternative sources for performing these functions.


text: We acknowledge the increasing importance of cybersecurity in our operations and having processes in place to manage risks and threats associated with potential unauthorized occurrences on our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems and data. We continuously invest in and enhance our cybersecurity infrastructure to mitigate risks and protect against unauthorized access, data breaches, and other cyber incidents that could disrupt our business or compromise sensitive information. We have implemented various cybersecurity measures to safeguard our information technology infrastructure and data assets: Governance and Oversight:

companyName: GSE SYSTEMS INC


text: The Audit Committee of the Board of Directors oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The board recognizes the importance of cybersecurity in safeguarding the company's assets and operations. GSE's Risk Management Plan includes an assessment of, and mitigation plans related to, the operational risk of business disruption due to factors including cybersecurity breaches and related events.


text: Under the supervision of our chief technology officer, we conduct assessments of our IT systems and networks to identify potential vulnerabilities and threats to our systems and assets. Based on these assessments, we prioritize and allocate resources to mitigate cyber risks and reduce exposure.


text: Under the supervision of our chief technology officer, we employ a multi-layered approach to cybersecurity, deploying a suite of technologies to protect our endpoints, applications, data, and network. We in corporate various security controls and technologies such as firewalls, encryption mechanisms, next-generation anti-virus, multi-factor authentication and access controls. Furthermore, we invest in threat detection and prevention solutions to proactively identify and mitigate continuously changing cyber threats.


text: We recognize the critical role of employees in maintaining cybersecurity resilience. Accordingly, we provide cybersecurity training and awareness programs to educate employees about security best practices, phishing awareness, and the importance of safeguarding sensitive information.


text: In the event of a cybersecurity incident, we have established incident response protocols to facilitate timely detection, containment, and remediation. Additionally, we maintain business continuity and disaster recovery plans to minimize the impact of cyber incidents on our operations and stakeholders.


text: We continuously monitor and assess our cybersecurity posture to adapt to evolving threats and technologies. We conduct periodic reviews and assessments of our cybersecurity posture to identify gaps and implement enhancements to strengthen our defenses.


text: Our commitment to cybersecurity is integral to our overall risk management strategy and reflects our dedication to protecting the confidentiality, integrity, and availability of our IT systems and data assets. We remain vigilant in addressing cybersecurity threats and adapting to emerging challenges to minimize the likelihood and impact of cyber threats and to safeguard our business operations and stakeholders' interests.


text: Cybersecurity Risk Management, Governance And Risk Assessment The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company intends to establish a cybersecurity program (the "Program") that will be designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: Cybersecurity Risk Management The Program will be based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we will meet any particular technical standards, specifications, or requirements. The Program will be aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness.


text: The Company will designate a Chief Information Security Officer (the "CISO"). The Program will be implemented and managed by the Company's executive management under the leadership of the CISO.


text: The Company will contract with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies.


text: The Company's cybersecurity policies and procedures will be reviewed by the CISO and updated at least annually and will include an incident response plan ("IRP") for detecting, responding to and limiting the effects of a cyber security event. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. Cybersecurity policies and procedures will also be subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company will require employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises.


text: The CISO will be responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO will have the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The Program will be overseen by the Company's Board of Directors.


text: Cybersecurity Risk Assessment The CISO will be responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company will conduct regular risk assessments to identify, evaluate, and prioritize material cybersecurity risks to the Company, including its health plans and state contracts, shared services and IT operations, or business strategy. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for an initial business combination. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing our risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. Since our initial public offering, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy and results of operations.

companyName: DevvStream Corp.

ticker: DEVS


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive cyber and information security program to manage such risks and safeguard our systems and data, including the data of our customers.

companyName: COMMUNITY WEST BANCSHARES /


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our directors, officers, employees, temporary workers, business partners, contractors, vendors, service providers, and individuals affiliated with third parties. The Information Security Program includes a dedicated Cybersecurity Incident Response Plan (the "CIRP"), which sets forth the rules and requirements for detecting, investigating, containing, eradicating, and resolving information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) a collection of Security Incident Forms (the "Security Incident Forms"), which delineate the processes for reporting, classifying, investigating, documenting, and communicating information security incidents and (ii) Security Guidelines and Baseline Protections, that establish the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual) in connection with security incidents.


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable and unacceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a IT Management, and / or member of the Information Security Team, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Chief Risk Officer (CRO) and/or Information Security Officer in accordance with the Cybersecurity Incident Response Plan (CIRP).


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level " S1-Critical," "S2-Moderate," or "S3-Low" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the CRO and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the CRO or ISO will engage the Company's designated Breach Coach to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, legal, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on a periodic basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below.


text: The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating, or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee, Enterprise Risk Management Committee, and the Board of Directors Audit Committee. The ISO reports to the Chief Risk Officer.


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. The ISO performs information security assessments for third party service providers that store and/or process our confidential data. These information security assessments, include a review of any service organization controls (SOC) reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.


text: Cybersecurity Risk Oversight Our business unit managers with oversight and guidance from our risk management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on an annual basis and subject to oversight by our board of directors.