text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our cybersecurity risk management program and the associated controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or malicious employee actions, program failures, and other risks that could materially impact our financial condition, results of operations and/or cash flows. For risks regarding cybersecurity and our information systems, please refer to Item 1A. "Risk Factors" in this annual report.


text: We recognize sophisticated global cybersecurity threats and targeted computer crimes pose a continuously evolving risk to the confidentiality, availability, and integrity of our data, operations and infrastructure. We have implemented comprehensive practices to minimize these risks. Our cybersecurity program is certified to the International Organization for Standardization ISO 27001, a standard for information security management, which covers key areas of management, technical and physical controls, legal, compliance and business continuity management.

companyName: LyondellBasell Industries N.V.

ticker: LYB

secItem: Item 1C


text: Our management utilizes a systematic approach to evaluating and determining risk tolerance and prioritizes the safeguarding of our digital assets. The Vice President of Cybersecurity leads our cybersecurity program and reports to the Executive Vice President and Chief Innovation Officer, who serves on the Executive Committee and reports to the CEO. The Vice President of Cybersecurity has a Master of Science degree in Cybersecurity Operations, is certified as an information security professional with the International Information System Security Certification Consortium (ISC2) and International Association of Privacy Professionals, and has over thirty years of leadership experience in technology, systems architecture, and cybersecurity.


text: Cybersecurity events are continuously monitored by global security operations centers staffed in the United States, European Union, and Asia Pacific regions with events and incidents being managed based upon the MITRE ATT&CK framework, a system for classifying and describing cyber attacks and intrusions. Management provides guidance and is informed of cybersecurity events through a committee with cross-functional representation of executive leadership. The committee meets at least quarterly for activities such as determining policy, reviewing active risks, assessing impact of emerging threats or regulatory changes, and monitoring active incidents. This committee also receives escalated alerts within 24-hours of confirmed cybersecurity events, and will determine the severity of the incident, engage with crisis management as necessary, and disseminate that information internally as appropriate and warranted.


text: Third-party service providers must meet baseline security requirements before they connect to our systems or manage sensitive information. They are evaluated based on risk, which is based on financial, operational, legal/regulatory, capacity, cybersecurity posture, and reputational impact. Additionally, high risk third-party service providers are continuously monitored for security health and active threats.


text: We recognize the risk posed by global cybersecurity threats, and our Board is regularly updated on emerging risks and maintains oversight of our cybersecurity program implemented to address them. In 2023, the Board conducted its annual comprehensive review of specific cybersecurity and process control topics at its September meeting. Cybersecurity risk evaluation is integrated into our enterprise risk management processes and is presented to management and the board as a part of that process.


text: While management is responsible for assessing and managing our day-to-day risks and control systems, the Audit Committee of the Board oversees our information technology and cybersecurity risks. The Committee conducts a comprehensive review of cybersecurity topics and reviews our programs and practices with management at least annually, and receives management's report on our cybersecurity dashboard, which summarizes key security metrics and activities, at each quarterly Committee meeting.


text: To further advance cybersecurity awareness, we are developing solutions to mitigate the impact of third-party fraudulent cyber activity, including public facing portals for potential and current partners with capability to report suspected phishing.


text: Our cybersecurity program includes, but is not limited to: • annual cybersecurity education for all company computer users on relevant policies and standards, best practices at work and at home; • communication processes including how to identify, respond, and report threats or potential vulnerabilities; • protective software installed and configured on Company systems and mobile devices, updated and patched on a regular basis, to provide the highest level of protection against malicious threats; • an established program based on the MITRE ATT&CK framework for dealing with ransomware and other cybersecurity incidents; • regular technical risk assessments of our network, applications and manufacturing facilities, using a combination of trusted suppliers and a dedicated, objective team; • penetration, discovery and vulnerability assessments conducted daily; • mobile threat protection mechanisms and policies; • business continuity plans that are well documented and tested regularly; disaster recovery plans that are also well documented and tested at least annually; and • coverage for non-damage business interruption or liability for data breaches as a part of the Company's combined insurance programs. In addition, in 2023, management conducted ransomware simulation exercises and engaged outside consultants to perform external perimeter penetration testing.


text: While we attempt to mitigate cybersecurity risks by employing a number of measures, as described above, our employees, systems, networks, products, facilities and services remain potentially vulnerable to ransomware or sophisticated espionage. Depending on their nature and scope, such threats could potentially lead to the compromise of confidential information, improper use of our systems and networks, manipulation and destruction of data, defective products, production downtimes and operational disruptions, which in turn could adversely affect our reputation, competitiveness and results of operations or financial condition. No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.


text: Our management utilizes a systematic approach to evaluating and determining risk tolerance and prioritizes the safeguarding of our digital assets. The Chief Information Security Officer ("CISO") is the Vice President of Cybersecurity leading our cybersecurity program and reports to the Executive Vice President and Chief Innovation Officer, who serves on the Executive Committee and reports to the CEO. The CISO has a Master of Science degree in Cybersecurity Operations, is certified as an information security professional with the International Information System Security Certification Consortium (ISC2) and International Association of Privacy Professionals, and has over thirty years of leadership experience in technology, systems architecture, and cybersecurity.


text: Cybersecurity events are continuously monitored by global security operations centers staffed in the United States, European Union, and Asia Pacific regions with events and incidents being managed based upon the MITRE ATT&CK framework, a system for classifying and describing cyberattacks and intrusions. Management provides guidance and is informed of cybersecurity events through a committee with cross-functional representation of executive leadership. The committee meets at least quarterly for activities such as determining policy, reviewing active risks, assessing impact of emerging threats or regulatory changes, and monitoring active incidents. This committee also receives escalated alerts within 24-hours of confirmed cybersecurity events, and will determine the severity of the incident, engage with crisis management as necessary, and disseminate that information internally as appropriate and warranted. The Company's generative artificial intelligence strategy is to "Generate Responsibly," actively providing education and awareness, encouraging the safe exploration of generative AI tools and resources, consistent with Company data protection policies and standards.


text: We recognize the risk posed by global cybersecurity threats, and our Board is regularly updated on emerging risks and maintains oversight of our cybersecurity program implemented to address them. In 2024, management provided a detailed cybersecurity update to the Board and led discussions on specific cybersecurity and process control topics at its May meeting. The Board also attended a training session led by outside counsel on the challenges public companies face with respect to cybersecurity and ransomware attacks in November.


text: Our cybersecurity program includes, but is not limited to: • annual cybersecurity education for all company computer users on relevant policies and standards, best practices at work and at home; • communication processes including how to identify, respond, and report threats or potential vulnerabilities; • protective software installed and configured on Company systems and mobile devices, updated and patched on a regular basis, to provide the highest level of protection against malicious threats; • an established program based on the MITRE ATT&CK framework for dealing with ransomware and other cybersecurity incidents; • regular technical risk assessments of our network, applications and manufacturing facilities, using a combination of trusted suppliers and a dedicated, objective team; • penetration, discovery and vulnerability assessments conducted daily; • mobile threat protection mechanisms and policies; • business continuity plans that are well documented and tested regularly; disaster recovery plans that are also well documented and tested at least annually; certain key financial applications that are tested at least semi-annually; and • coverage for non-damage business interruption or liability for data breaches as a part of the Company's combined insurance programs. In addition, in 2024, management conducted ransomware simulation exercises and engaged outside consultants to perform external perimeter penetration testing.


text: While we attempt to mitigate cybersecurity risks by employing a number of measures, as described above, our employees, systems, networks, products, facilities and services remain potentially vulnerable to ransomware or sophisticated espionage. Depending on their nature and scope, such threats could potentially lead to the compromise of confidential information, improper use of our systems and networks, manipulation and destruction of data, defective products, production downtimes and operational disruptions, which in turn could adversely affect our reputation, competitiveness and results of operations or financial condition. As of February 27, 2025, we do not believe that any cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors - General Risk Factors for additional information.


text: We face significant and persistent cybersecurity risks due to the widespread use of our websites and mobile applications; the attractiveness of our websites and mobile applications to threat actors, including state-sponsored actors; the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries; the substantial level of harm that could occur to our business, our customers, or our merchants if were we to suffer a material cybersecurity incident; and our use of third-party products and services. Protecting our systems, networks, data and confidential information is a priority at Groupon. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.

companyName: Groupon, Inc.

ticker: GRPN


text: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, but there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in significant costs related to, for example: rebuilding our internal systems, implementing additional threat protection measures, providing modifications to our websites and mobile applications, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing merchants and customers with incentives to maintain a business relationship with us, taking other remedial steps with respect to third parties or incurring significant reputational harm. In addition, these threats are constantly evolving, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in the volume, frequency and sophistication of cyberattacks. We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications; however, we remain potentially vulnerable to known or unknown threats. It is also possible that we, our merchants, our customers or our vendors will be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See Item 1A. - Risk Factors for more information on our cybersecurity risks.


text: The Audit Committee of our Board ("Audit Committee") oversees risks pertaining to cybersecurity. A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters. In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board. We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems. Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection. In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing. We also regularly evaluate and assess our systems and the controls, processes and practices to protect those systems, including recently completing the migration of our public-facing websites and applications and our back-end business intelligence systems to the cloud. We also retain personnel that have in-depth experience in penetration testing and conduct penetration testing against our own systems. Further, we utilize third party partners to help us monitor issues that are internally discovered or externally reported that may affect our websites and mobile applications, and we have processes to assess the potential cybersecurity impact or risk of these issues. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.


text: The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams. Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our Chief Technology Officer ("CTO"), Vojtech Rysanek. Our CTO has served in that position since November 2022, and, prior to Groupon, he was previously the CTO at Aukro, the largest online marketplace in the Czech Republic. Mr. Redmond has served in this position for the last year and has worked at Groupon for over 7 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider. Our Information Security Officer reports to Mr. Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits. Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in VMware Carbon Black, and prior to that held roles in Skyscanner. Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.


text: Our VP of InfoSec and CTO regularly report directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues. In addition, we have an escalation process in place to inform senior management and the Board of material issues.


text: We face significant and persistent cybersecurity risks due to the widespread use of our websites and mobile applications; the attractiveness of our websites and mobile applications to threat actors, including state-sponsored actors; the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries; the substantial level of harm that could occur to our business, our customers, or our merchants if we were to suffer a material cybersecurity incident; and our use of third-party products and services. Protecting our systems, networks, data and confidential information is a priority at Groupon. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.


text: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations or financial condition, but there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in significant costs related to, for example: rebuilding our internal systems, implementing additional threat protection measures, providing modifications to our websites and mobile applications, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing merchants and customers with incentives to maintain a business relationship with us, taking other remedial steps with respect to third parties or incurring significant reputational harm. In addition, these threats are constantly evolving, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in the volume, frequency and sophistication of cyberattacks. We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications; however, we remain potentially vulnerable to known or unknown threats. It is also possible that we, our merchants, our customers or our vendors will be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See Item 1A. - Risk Factors for more information on our cybersecurity risks.


text: The Audit Committee oversees risks pertaining to cybersecurity. A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters. In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board. We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems. Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection. In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing. We also regularly evaluate and assess our systems and the controls, processes and practices to protect those systems, including recently completing the migration of our public-facing websites and applications and our back-end business intelligence systems to the cloud. We also retain personnel that have in-depth experience in penetration testing and conduct penetration testing against our own systems. Further, we utilize third party partners to help us monitor issues that are internally discovered or externally reported that may affect our websites and mobile applications, and we have processes to assess the potential cybersecurity impact or risk of these issues. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.


text: The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams. Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our COO, Filip Popovic. Our COO has served in that position since June 2024. Mr. Redmond has served in this position for the last 2 years and has worked at Groupon for over 8 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider. Our Information Security Officer reports to Mr. Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits. Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in Vodafone, based in Hungary. Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.


text: Our VP of InfoSec regularly reports directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues. In addition, we have an escalation process in place to inform senior management and the Board of material issues.


text: Risk Management and Strategy Information security and privacy are an important part of our culture and foundational to our goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: As a financial institution we collect, store, and transmit sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and personally identifiable information of our customers and employees. This information can be of significant value to criminal actors, and, as described in Item 1A. Risk Factors, cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance.


text: We have implemented a strategy to address threats to Bank assets and confidential information. Our information security program, under the responsibility of the Chief Information Officer and the Chief Compliance & Risk Management Officer, balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Bank and customer information. We annually benchmark our information security program to assess its strength as measured against recommended industry security best practices.


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect our systems and sensitive data. This model is composed of a variety of different components including administrative controls, technical controls and other safeguards. These various components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system. Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.


text: We maintain a variety of programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, as well as various other regulatory requirements and industry-specific standards. The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: The Bank's Information Technology ("IT") and Compliance and Risk Management ("C&RM") teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. Members of these teams have a wide variety of relevant certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certification in Risk Management Assurance and Certified in Risk and Information Systems Control. Our C&RM team provides risk management oversight to the IT team. The Bank's Internal Audit function, using internal and outside expertise, independently oversees, reviews and validates the IT and C&RM activities and reports to the Board of Directors' Audit Committee on the effectiveness of governance, risk management and internal controls.


text: We have established an Enterprise Risk Management program. As part of this program, the C&RM team reviews our IT risk management practices, which are designed to identify, assess, manage, monitor, and report cybersecurity risks. The IT team is responsible for implementing risk management practices set forth in the IT risk management program.


text: As one of the critical elements of the Bank's overall risk management approach, our cybersecurity risk management program and strategy is focused on the following key areas: • Incident Response and Recovery Planning: The Bank has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Bank deploys technical safeguards that are designed to protect the sensitive information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and multifactor authentication and other access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Outside Experts: The Bank routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Bank provides regular, mandatory training for personnel regarding cybersecurity threats on matters such as phishing and email security best practices to equip our personnel with effective tools to address cybersecurity threats, and to communicate the Bank's evolving information security policies, standards, processes and practices.


text: While processes are in place to minimize the chance of a successful cyberattack, the Bank has established incident response procedures to address a cyberattack that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cyber incident that occurs.


text: The Bank engages in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, penetration tests and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are analyzed by the cybersecurity team and the Information Technology Oversight Committee ("ITOC") and provided to the Bank's Board of Directors. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We have implemented a third-party risk program to oversee and manage information security and privacy risks associated with third-party relationships. The program includes the assessment of third parties that provide key services or will access, store, process, or transmit sensitive information during initial onboarding and throughout the lifecycle of the relationship, and management of applicable contractual requirements relating to confidentiality, integrity, availability and privacy obligations, including timely notification of incidents. Third-party services related to advice, assessments, auditing, testing and support related to cybersecurity and information technology processes and services, where appropriate, are also subject to the third-party risk program.


text: Like other financial institutions, the Bank experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware. The Bank also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Unauthorized access to our computer systems or stored data could result in theft, including cyber theft, or improper disclosure of confidential information, and the deletion or modification of records could cause interruptions in our operations. The impact of a material information technology event could have a materially adverse effect on our competitive position, reputation, results of operations, financial condition or cash flows.


text: Board Governance The members of the Boards of Directors of the Company and the Bank are identical. The Bank's Board of Directors oversees cybersecurity risk management and strategy for both entities through management updates regarding the policies, practices and security results related to the Gramm-Leach-Bliley Act, IT risk management, IT security metrics, penetration testing, tabletop exercises, IT risk assessments, disaster recovery testing, and security awareness testing and training. Management is responsible for designing and implementing policies, processes and procedures, and deploying physical and virtual technology and safeguards to measure, monitor, and control cybersecurity risk. The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents. The Bank's Chief Technology Officer provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any. Cyber incidents with (i) the potential of materiality; (ii) anticipated publicity; or (iii) anticipated written notices to a significant number of customers; have been promptly reported to the Board with ongoing updates during regular Board meetings. The Bank's Chief Information Officer presents updates on new security measures, programs and services to ITOC. The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal. The Bank's Information Security Officer provides the Board of Directors an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc. This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses. The Board of Directors also participates in an annual evaluation of risk and is presented with management's assessment of the top risks, which generally includes several cybersecurity components.


text: Material Cybersecurity Incidents As of September 30, 2024, we were not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank, including its business strategies, results of operations or financial condition. For more information on our cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third Parties, and Technology".


text: Risk Management and Strategy Information security and privacy are an important part of our culture and are foundational to our goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.


text: As a financial institution we collect, store, and transmit sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and personally identifiable information of our customers and employees. This information can be of significant value to criminal actors, and, as described in "Item 1A. Risk Factors - Risks Related to Cybersecurity, Third Parties, and Technology", cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance. Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect our systems and sensitive data. This model is composed of a variety of different components including administrative controls, technical controls and other safeguards. These components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system.


text: We maintain programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, Cyber Risk Institute Profile, as well as various other regulatory requirements and industry-specific standards. The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.


text: Like other financial institutions, the Bank is targeted with malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware. The Bank is also targeted with large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Unauthorized access to our computer systems or stored data could result in theft, including cyber theft, or improper disclosure of confidential information, and the deletion or modification of records could cause interruptions in our operations. The impact of a material information technology event could have a materially adverse effect on our competitive position, reputation, results of operations, financial condition or cash flows.


text: Board Governance The members of the Boards of Directors of the Company and the Bank are identical. The Bank's Board of Directors oversees cybersecurity risk management and strategy for both entities through management updates regarding the policies, practices and security results related to the Gramm-Leach-Bliley Act, IT risk management, IT security metrics, penetration testing, tabletop exercises, IT risk assessments, disaster recovery testing, and security awareness testing and training. Management is responsible for designing and implementing policies, processes and procedures, and deploying physical and virtual technology and safeguards to measure, monitor, and control cybersecurity risk. The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents. The Bank's Chief Information Officer or delegate provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any. Cyber incidents with (i) the potential of materiality, pursuant to SEC cybersecurity disclosure rules; (ii) anticipated publicity; or (iii) anticipated written notices to a significant number of customers; have been promptly reported to the Board with ongoing updates during regular Board meetings. The Bank's Chief Information Officer presents updates on new security measures, programs and services to ITOC. The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal. The Bank's Information Security Officer provides the Board of Directors with an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc. This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses. The Board of Directors also participates in an annual evaluation of enterprise risk and is presented with management's assessment of the top risks, which generally include several cybersecurity components.


text: Material Cybersecurity Incidents As of September 30, 2025, we were not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank, including its business strategies, results of operations or financial condition. For more information on our cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third Parties, and Technology".


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management advisors, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Schrodinger, Inc.

ticker: SDGR


text: The audit committee of our board of directors provides direct oversight over cybersecurity risk and provides regular updates to the board of directors regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our vice president of information security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our employees to address cybersecurity risks, including phishing attacks, ransomware, data breaches, and insider threats. Our vice president of information security has over 15 years of information security experience, including in developing, overseeing and managing information technology and information security teams. He has been with our company since 2017 and has served as our vice president of information security since April 2023. He previously served as our executive director of information security from January 2022 through April 2023, senior director of information security from February 2019 through January 2022 and director of information security from June 2017 through February 2019. Prior to joining our company, our vice president of information security worked at several technology companies and served in roles of increasing responsibility with respect to information security during his tenure.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a cybersecurity awareness program, which covers timely and relevant topics, including social engineering and phishing, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks throughout our information security systems. These tools are integrated into our comprehensive security framework, used to bolster our employee-based cybersecurity programs and are regularly updated to respond to evolving threats.


text: Risk Management Strategy While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our cybersecurity strategy that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees, or other key stakeholders.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Process — We use a multi-layered defensive cybersecurity strategy based on best practices to identify risks, protect technology assets, detect anomalies, respond to, and recover from cybersecurity incidents. Our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: • Identify - We identify risks from cybersecurity threats by first developing and maintaining an understanding of assets and systems essential to our operation and reputation, as well as assets and systems that could provide value to threat actors. Any attempt by a threat actor is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or system which would result in decreased information security or a disruption in our operations. • Assess - We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or system, or a threat actor's ability to gain access to an asset or system. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation. • Manage - We mitigate risks from cybersecurity threats by applying multiple layers of defense to maximize our continued ability to access or utilize an asset or system and minimize threat actors' ability to gain or increase their access to an asset or system. We prioritize defensive mechanisms, including administrative, physical, and technical controls, according to their relative cost and reduction in risk.


text: We further monitor, test, assess, and update these processes, including working with technology partners, government agencies, regulators, law enforcement, industry groups, and peers to implement practices to guard against an evolving cyber threat environment and to ensure we remain compliant with relevant regulatory requirements. We offer cybersecurity training for staff at key sites, focusing on reducing human risk through anti-phishing and social engineering exercises. We also carry cybersecurity insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: Integration into our Risk Management Program — Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our risk management program, which includes technology as one of the five primary risk categories addressed by our risk program, with cybersecurity risks being one of the three subcategories within the technology risk category. As a result, our risk management leadership team works with the Chief Information Officer ("CIO") and Vice President of Information Technology Security ("VPIT"), which we refer to collectively as "Cybersecurity Leadership," to define the top areas of risk in both the technology and cybersecurity areas, with such risks incorporated into our risk management program. Our risk management leadership team also meets on a quarterly basis with our cross-functional technology risk working group, comprised of leaders across the information technology, operations, internal audit, information security and legal departments, to monitor developments on an ongoing basis in the threat landscape in order to identify and prioritize key cybersecurity threats that may impact the Company.


text: Incident Response The Company has a dedicated cybersecurity incident response team, overseen by Cybersecurity Leadership, which is responsible for managing and coordinating the Company's cybersecurity incident response plans and efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks potentially material cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board as appropriate. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide training for the participants and to help the Company assess its processes and capabilities in addressing major cybersecurity incidents.


text: Use of Third Parties The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and risk assessments to identify weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company's dedicated security operations team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization.


text: We also rely on third-party service providers to support our business and operations, which may include processing of confidential and other sensitive data. We are committed to continuing to develop and enhance our onboarding and monitoring processes for third-party vendors to ensure alignment with best practices. Despite our efforts, it's important to note our service providers are ultimately responsible to establish and uphold their respective cybersecurity programs. We have limited ability to monitor the cybersecurity practices of our service providers and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks, or other assets owned or controlled by our service providers. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of our information systems.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Further, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For a detailed discussion of the Company's cybersecurity related risks, refer to "Operational Risk" within Part I, Item 1A. Risk Factors of this Annual Report.


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate such risks. The Board's oversight of major risks, including cybersecurity risks, occurs at both the full Board level and at the Board committee level through the Nominating and Corporate Governance Committee.


text: The Board — The Chief Executive Officer, the Chief Financial Officer, the CIO, members of senior management, and other personnel and advisors, as requested by the Board, report on the risks to the Company, including cybersecurity risks, at regularly scheduled meetings of the Board and its committees. Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations. Additionally, the Board committees have opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.


text: Nominating and Corporate Governance Committee — The Nominating and Corporate Governance Committee, which is comprised entirely of independent directors, reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile both at its regularly scheduled meetings and, if appropriate, in real time. Cybersecurity Leadership, members of the cybersecurity team, or other advisors, as requested by the Nominating and Corporate Governance Committee, report at least quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Nominating and Corporate Governance Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Reporting to the Nominating and Corporate Governance Committee is multi-format and includes both live presentations and memoranda. The Board believes that this regular cadence of reporting helps to provide the Nominating and Corporate Governance Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Nominating and Corporate Governance Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities, including our cybersecurity and business interruption insurance coverages, and the effectiveness of the Company's escalation procedures. Based on these management reports, the Nominating and Corporate Governance Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated by management on as needed basis to the Nominating and Corporate Governance Committee. The Nominating and Corporate Governance Committee may also escalate such issues to the full Board at any time.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by Cybersecurity Leadership who are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department, including responsibility for leading organization-wide cybersecurity strategy, policy, and processes. Our CIO has served in this role since the 2017 Merger, has been at Swift since 2003, and has over 25 years of cybersecurity experience, including technology positions at AlliedSignal, Sara Lee, and J-Del. • The VPIT, reporting to the CIO, is responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our VPIT has served in this role since 2020 and has significant relevant experience and professional certifications, including 18 years of cybersecurity and infrastructure experience. The VPIT, along with our cybersecurity team, has guided the organization through building a multi-layer cybersecurity program.


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams, in coordination with third parties, conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. The results of these tests are reviewed with the Nominating and Corporate Governance Committee. Leaders from each team regularly meet with Cybersecurity Leadership to provide visibility into major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board, as appropriate. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.


text: Risk Management Strategy While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our cybersecurity strategy that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or delay our operations or systems; or otherwise cause harm to the Company, our customers, employees, vendors, or other key stakeholders.


text: Process — We use a multi-layered defensive cybersecurity strategy based on best practices to identify risks, protect technology assets, detect anomalies, respond to, and recover from cybersecurity incidents. Our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: • Identify - We identify risks from cybersecurity threats by first developing and maintaining an understanding of assets and systems essential to our operations and reputation, as well as assets and systems that could provide value to threat actors. Any attempt by a threat actor is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or system which would result in decreased information security or a disruption in our operations. • Assess - We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or system, or a threat actor's ability to gain access to an asset or system. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation. • Manage - We mitigate risks from cybersecurity threats by applying multiple layers of defense to maximize our continued ability to access or utilize an asset or system and minimize threat actors' ability to gain or increase their access to an asset or system. We prioritize defensive mechanisms, including administrative, physical, and technical controls, according to their relative cost and reduction in risk.


text: We further monitor, test, assess, and update these processes, including working with technology partners, government agencies, regulators, law enforcement, industry groups, and peers to implement practices to guard against an evolving cyber threat environment and to ensure we remain compliant with relevant regulatory requirements. We offer cybersecurity training for corporate employees at headquarters and terminal locations, focusing on reducing human risk through anti-phishing and social engineering exercises. We also carry cybersecurity insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: Incident Response The Company has a dedicated cybersecurity incident response team, overseen by Cybersecurity Leadership, which is responsible for managing and coordinating the Company's cybersecurity incident response plans and efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks potentially material cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, government agencies, regulators, law enforcement, vendors, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board as appropriate. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide training for the participants and to help the Company assess its processes and capabilities in addressing major cybersecurity incidents.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Further, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Our business and operations could be materially and adversely impacted by cybersecurity incidents. For a detailed discussion of the Company's cybersecurity related risks, refer to "Operational Risk" within Part I, Item 1A. Risk Factors of this Annual Report.


text: Nominating and Corporate Governance Committee — The Nominating and Corporate Governance Committee, which is comprised entirely of independent directors, reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile both at its regularly scheduled meetings and, if appropriate, in real time. Cybersecurity Leadership, members of the cybersecurity team, or other advisors, as requested by the Nominating and Corporate Governance Committee, report at least quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Nominating and Corporate Governance Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Reporting to the Nominating and Corporate Governance Committee is multi-format and includes both live presentations and memoranda. The Board believes that this regular cadence of reporting helps to provide the Nominating and Corporate Governance Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Nominating and Corporate Governance Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities, including our cybersecurity and business interruption insurance coverages, and the effectiveness of the Company's escalation procedures. Based on these management reports, the Nominating and Corporate Governance Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated by management on an as needed basis to the Nominating and Corporate Governance Committee. The Nominating and Corporate Governance Committee may also escalate such issues to the full Board at any time.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by Cybersecurity Leadership who are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department, including responsibility for leading organization-wide cybersecurity strategy, policy, and processes. Our CIO has served in this role since June 2024 and has over 25 years of cybersecurity experience, including technology positions at the US Army, Accenture, Advance Auto Parts, Finishline Shoes, and PF Chang's. • The VPIT, reporting to the CIO, is responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our VPIT has served in this role since 2020 and has significant relevant experience and professional certifications, including nearly 20 years of cybersecurity and infrastructure experience. The VPIT, along with our cybersecurity team, has guided the organization through building a multi-layer cybersecurity program.


text: Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SideChannel, Inc.

ticker: SDCH


text: Inc. has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, SideChannel, Inc. engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Third-party Risk we are aware of the risks associated with third-party service providers, SideChannel, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.


text: The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. CISO and the Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks.


text: They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies;


text: reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee, CISO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of SideChannel, Inc. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Bill Roberts. With over 25 years of experience in the field of cybersecurity, Mr. Roberts brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: CISO, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing SideChannel, Inc. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: have a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. These security measures include controls, security processes and monitoring of our manufacturing systems. We have cloud security tools and governance processes designed to assess, identify and manage material risks from cybersecurity threats. In addition, we maintain an information security training program designed to address phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Company is committed to maintaining the highest standards of cybersecurity to protect our data, intellectual property, and customer information from cyber threats. As part of this commitment, we leverage a sophisticated cybersecurity framework that integrates the robust capabilities of the Microsoft cloud ecosystem with the specialized services of a leading third-party cybersecurity service provider.


text: Microsoft cloud ecosystem, including Microsoft 365, Azure, SharePoint Online, Microsoft Defender, and Microsoft InTune, forms the backbone of our cybersecurity infrastructure. These platforms offer advanced security features such as data encryption in transit and at rest, network security controls, identity and access management, and threat protection capabilities. Microsoft's constant investment in cybersecurity research and development ensures that we benefit from cutting-edge security technologies and practices.


text: addition to utilizing the Microsoft cloud ecosystem, we have engaged a third-party service provider to enhance our cybersecurity posture further. This provider brings additional layers of security through services including: Software Security Management: Ensuring that applications such as Office 365 and Azure are configured, maintained and following best security practices.


text: Monitoring and Consultation Services: Continuous monitoring of our systems for suspicious activities and providing expert consultation to address and mitigate potential threats.


text: Storage and Backup of Source Systems: Implementing robust data storage solutions and backup protocols to ensure data integrity and availability. Policy Management: Developing and enforcing comprehensive security policies that govern all aspects of our cybersecurity efforts. Response Management: Rapid identification and response to security incidents to minimize impact. Software Implementation: Deployment of state-of-the-art security software solutions that complement the security features of the Microsoft cloud ecosystem.


text: approach to cybersecurity is proactive and multifaceted, combining the scalability and reliability of the Microsoft cloud services with the agility and expertise of our third-party cybersecurity partner. Together, these resources form a comprehensive defense mechanism against a wide range of cyber threats, from phishing and malware attacks to sophisticated nation-state sponsored cyber-attacks. We continuously evaluate and adapt our cybersecurity strategy to respond to evolving threats and to align with best practices and regulatory requirements.


text: Our commitment to cybersecurity is integral to our business operations, and we believe our strategic investments in this area significantly mitigate the risk of cybersecurity incidents that could impact our company's reputation, financial position, or operational capabilities.


text: management of the Company is responsible for overseeing risk for the Company and has delegated to the VP, Engineering & Technology ("VPE&T") the responsibility for overseeing the cybersecurity risk management strategy for the Company. Management receives regular updates on our cybersecurity risk management process from the VPE&T. The VPE&T reviews our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol that provides for the notification, escalation and communication of significant cybersecurity events to the management team. Company's cybersecurity program is overseen by our VPE&T, who is responsible for global information technology, including cybersecurity.


text: Our VPE&T, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. The information security organization is comprised of internal IBIO employees and external security suppliers who provide security monitoring and response.


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of any information residing therein.

companyName: Bone Biologics Corp

ticker: BBLG


text: require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats. Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy"


text: above. Under such policies and processes, our Chief Financial Officer is responsible for reporting to our Board of Directors regarding any cybersecurity incidents.


text: believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Canton Strategic Holdings, Inc.

ticker: CNTN


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Processes We continue to strengthen our cybersecurity measures to safeguard our information systems based on industry standards. Our measures include policies to promote internal compliance by our employees, policies and procedures to regularly evaluate the security of our information systems and implementation of third-party products, including intrusion prevention and detection solutions, multifactor identification and anti-virus software, to help detect and protect against potential cybersecurity threats. We educate our staff on cybersecurity matters with periodic risk awareness information, phishing awareness campaigns, and training materials. Moreover, given the rapid growth of our global operations in 2023 due to the Ibeo acquisition, and our expectations for near- and long-term strategic growth, our Information Technology, or IT, team is prioritizing enhancements to our response system and continuity plans.

companyName: MICROVISION, INC.

ticker: MVIS


text: key dimension to the security and effectiveness of our information system is our compliance with standards that are unique to the industries in which we operate. For instance, it is critical that our information system achieves TISAX certification. Established by the German Association of the Automotive Industry, Trusted Information Security Assessment Exchange, or TISAX, is a globally recognized assessment and exchange mechanism for information security in the automotive industry. Automotive OEMs rely on the TISAX label to ensure that suppliers and partners have a solid information security management system in place. To successfully complete the TISAX assessment process in our German and U.S. operations, we are actively evaluating our cybersecurity measures and seeking enhancements, including engaging a third-party auditor and global standardization of our cybersecurity training program, to ensure a comprehensive and robust system.


text: our third-party information system providers, as well as any other provider that may have access to our data, for their maturity and reliability, and as a matter of policy we choose to only work with reputable vendors.


text: from Cybersecurity Threats have not encountered cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations or financial condition. Any material cybersecurity incident could have a material impact on our operations by causing a disruption to our ability to function as a global organization, by interrupting our internal and external communications and reporting or managing our operations. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Our operations could be adversely impacted by information technology system failures, network disruptions, or cybersecurity breaches," for additional discussion about cybersecurity-related risks.


text: of Directors and Audit Committee delegated authority from our Board of Directors and in accordance with its charter, our Audit Committee is charged with the oversight of enterprise risk, including risk related to cybersecurity threats. Our Audit Committee Chair is expected to report regularly to our Board of Directors about our Audit Committee's oversight of enterprise risk. Beginning in 2024, our Audit Committee Chair will report quarterly to our Board of Directors specifically about our cybersecurity incident management and governance.


text: Management, and specifically our Chief Financial Officer, reports to our Audit Committee on cybersecurity, including initiatives and strategies, and incident reporting and any lessons learned. Beginning in 2024, our Chief Financial Officer will make this report on a quarterly basis.


text: From time to time, management will also engage in informal discussions with members of the Audit Committee about our cybersecurity practices and risks, including informing our Audit Committee Chair in a timely manner about any cybersecurity incidents that management determines may have a significant impact on our operations or that may trigger any reporting obligations. Audit Committee will conduct an annual review of our cybersecurity measures and the effectiveness of our risk management strategies.


text: Verma, joined MicroVision in 2021 as our Chief Financial Officer. He is an experienced risk management professional and currently oversees the Company's accounting and finance strategies, including risk management. Mr. Verma also oversees our IT team and, with regular communication with the team, is responsible for approving the IT budget, hiring of IT personnel, including third-party consultants, and approving cybersecurity processes and other cybersecurity-related matters. Although we do not currently employ a chief information security officer, we are working with an outside consulting firm that is serving in this role and assisting our internal team with the primary responsibility of overseeing our cybersecurity measures and risks.


text: day-to-day responsibility for assessing, monitoring and managing our cybersecurity risks resides with our IT team. Across the IT team we have employees who have in-depth knowledge and decades of cybersecurity industry experience, including prior experience with developing and overseeing cybersecurity polices and processes for companies required to comply with NIST SP800-171, cybersecurity standards for companies that store sensitive unclassified information on behalf of the United States government, and former Ibeo employees having experience with TISAX compliance. Yet, we recognize the evolving and increasing threat that cybersecurity will have on our operations. As part of our long-term growth strategy, we expect to establish a dedicated cybersecurity team to oversee our cybersecurity risk management.


text: IT Team Director regularly meets with the Chief Financial Officer and as appropriate the Chief Executive Officer to discuss cybersecurity risks. This ensures that management is informed about our current cybersecurity measures and aware of any potential risks facing our operations. In the event of a cybersecurity incident, we have put in place a reporting structure to inform the Chief Financial Officer, Chief Executive Officer and General Counsel promptly of any incident so that they may assess the appropriate response to the incident and any reporting concerns that may be triggered by the incident.


text: Company's cybersecurity risks are theft of intellectual property, theft of other business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational risk, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if the Company were to sustain a breach of its systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: enVVeno Medical Corp

ticker: NVNO


text: Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible for managing our efforts in this area. Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise in cybersecurity. Rather, the Company retains an outside technical expert to support our information technology systems including addressing cybersecurity risks.


text: conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance.


text: many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our email, file storage or other business applications.


text: In the normal course of our relationships with the providers of these services, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.


text: of our business partners also maintain data related to our trials and ongoing product development on servers they maintain. We require these partners to comply with all HIPAA standards for maintaining security of their systems where this data resides.


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1.A – Risk Factors – Risks Related to Our Business Operations – Our business and operations would suffer in the event of computer system failures, cyber-attacks Governance

companyName: InspireMD, Inc.

ticker: NSPR


text: board of directors provides oversight of our cybersecurity program and helps guide our strategy for managing cybersecurity risks in the context of our overall risk management system. Our cybersecurity program is managed by our Senior Vice President of Finance, our internal IT team and our external Chief Information Security Officer ("CISO") whose is responsible for leading enterprise-wide cybersecurity strategy, protocols, framework, standards and processes. The Senior Vice President of Finance reports to our board of directors, as well as our Chief Executive Officer and Chief Financial Officer and other members of senior management as appropriate.


text: Management and Strategy regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the board of directors. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes and to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned " Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed " in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: Lipocine Inc.

ticker: LPCN


text: board of directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.