text: Board of Director Oversight Our Audit & Risk Committee provides oversight of cybersecurity risk in connection with BKV's comprehensive cybersecurity strategy and receives regular quarterly updates on our ongoing assessment of cybersecurity risks, threats, and data security programs to prevent and detect breaches and attacks against BKV. The CIO and other experts, as necessary, provide the Audit & Risks Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers The Audit & Risk Committee meets quarterly to discuss areas that are potentially high risk to the Company.


text: Risk Management and Strategy Cybersecurity risk management is a major component of our overall risk management systems and processes. We have a cybersecurity program and governance structure designed to identify and manage cybersecurity risks and threats.

companyName: Lazydays Holdings, Inc.

ticker: GORV

secItem: Item 1C


text: We have not identified any risks from cybersecurity threats, including any that resulted from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our cybersecurity program encompasses a comprehensive framework that begins with a clear governance structure lead by our Chief Technical Officer (CTO). Our CTO has spent over twenty-five years in the technology industry specializing in information security, cloud transformation, business intelligence and infrastructure. His cybersecurity experience includes having founded and managed a technology security and infrastructure consulting business catering to Fortune 500 companies.


text: Our CTO provides our Board of Directors with quarterly reports on cybersecurity risks and any material cybersecurity incidents. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity program and other cybersecurity developments. Regular reporting mechanisms to our Board of Directors and senior management keep all stakeholders informed about the evolving cyber risk landscape and the program's effectiveness.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We measure our cybersecurity infrastructure against the NIST 800-171 framework and routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ESS Tech, Inc.

ticker: GWH


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: In accordance with our cybersecurity incident response plan ("IRP), our Chief Information Officer, members of our management team, including personnel representative of the following functions – legal, IT, finance, audit, operations, engineering, human resources, communications, and additional executives as applicable under the plan – and external cybersecurity support providers (collectively, "IRP stakeholders"), are primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Chief Information Officer and our IRP stakeholders oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Information Officer has an advanced degree in management information systems and has managed the Company's IT processes and policies inclusive of cybersecurity matters throughout his tenure at the Company, in addition to many years of prior experience in various technology roles at a large U.S. public company. He is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by working with the IT department and external vendors to implement our security risk management, including through the use of both automated and manual tools and reporting, in accordance with the Company's incident response plan and Company cybersecurity policies.


text: Our Chief Information Officer provides quarterly briefings to the audit committee and board of directors regarding our Company's cybersecurity program, including risks and activities, reports of recent cybersecurity incidents and related responses (if any, and if not previously reported to the Board pursuant to the incident response plan), cybersecurity systems testing, the status of third party assessments, general updates in the cybersecurity space, relevant disclosures related to SEC reporting, and the like.


text: The Company's Director of IT is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our Director of IT has over 15 years of experience in information security positions and holds Master's degree in computer information systems. We also have constituted a cross-functional Cybersecurity Committee, comprised of the Director of IT, along with the Chairman, CFO, Management of Business Operations and Human Resources, which meets regularly to review enterprise-wide cybersecurity matters.

companyName: FGI Industries Ltd.

ticker: FGI


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats, derived from the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, access control, and employee training. Risks identified by the Director of IT and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Director of IT also routinely discusses trends in cyber risks and our strategy with our Cybersecurity Committee and management on a regular basis, in addition to an annual review and discussion with the full board.


text: Our Chief Executive Officer, or CEO, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The consultant that operates our SOC updates the CEO regarding the detection of cybersecurity risk exposure and provides advice on the prevention, mitigation and remediation of such risks. The CEO keeps the senior executive leadership team apprised, including our Vice President of Finance, on assessments of risk exposure to ensure that the highest levels of management are kept abreast of potential risks we are facing. The CEO has significant prior business experience in compliance and risk management and coordinates directly with the third party who operates our SOC on issues involving particular cybersecurity expertise.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: Cybersecurity Strategy, Policy and Procedures We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined within Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We utilize information technology ("IT") that enables our teams to access both operational and financial performance data in real time, while at the same time, helping to identify and prevent cybersecurity threats and risks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") framework, and shares common methodologies, reporting channels, and governance processes that apply across the ERM framework to other areas, including legal, compliance, strategic, operational, and financial risk. We assess and identify cybersecurity risk to the organization by: • Employing a cybersecurity policy that sets forth a protocol for assessing, testing, identifying and preventing security risks; • Conducting assessments of risk likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of IT systems and the related information processes, storage, or transmission; • Training personnel on security risks and how to identify and prevent such risks; • Performing risk analysis and security assessments that document the results of the assessment for use and review; • Overseeing and identifying any risk from cyber threats associated with any third-party service provider; • Ensuring security controls are assessed for effectiveness, implemented correctly and operating as intended; and • Continuously scanning for vulnerabilities and remedying vulnerabilities in accordance with the associated risk.


text: Cybersecurity is among the risks identified for Board-level oversight, with the Audit Committee of our Board of Directors responsible for overseeing our policies, practices, and assessments with respect to cybersecurity. Our Audit Committee and Board of Directors receive regular updates throughout the year on cybersecurity from our Finance, Risk and Sustainability (the "FRS") Committee, which is tasked with risk management, data protection, and monitoring compliance with our cybersecurity policy and also responsible for assessing and managing material risks from cybersecurity threats. The FRS Committee is comprised of our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Senior Vice President of IT, and VP of Corporate Development. Our cybersecurity risk management and strategy processes are led by our Senior Vice President of IT and our Chief Legal Officer, who collectively have extensive prior work experience and expertise over multiple decades developing and managing information security and cybersecurity strategy and programs and managing operational risk and incident response strategies.


text: Each member of our Board of Directors and Audit Committee also receives a quarterly report on cybersecurity matters and related risk exposures, and when the report is discussed during an Audit Committee meeting, the chair of the Audit Committee reports on related matters to our Board of Directors. Our Audit Committee also receives regular updates on our cybersecurity posture throughout the year, as appropriate.


text: In accordance with our cybersecurity policy, we have established a monitoring strategy and program which includes: • Defined security metrics to be monitored; • Performance of security control assessments on an ongoing basis; • Engaging third party security consultants to, among other things, conduct periodic reviews of our cybersecurity program, which is overseen by the FRS Committee, for identifying any cybersecurity threats; • Addressing results of both internal and third-party cybersecurity analyses and reporting security status to the executive team; • Monitoring information systems to detect attacks and indicators of potential attacks; and • Identification of unauthorized use of information system resources.


text: We have also implemented procedures set forth in our cybersecurity policy that secure sensitive data in our possession, which include: • Establishing policies governing data security; • Monitoring data access throughout the organization; • Providing annual security training and awareness; • Protecting sensitive data through encryption techniques; and • Designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.


text: Incident Management Plan Our cybersecurity policy includes an incident management plan ("IMP"), which consists of the following processes: • The development, documentation, review and testing of security procedures and incident management procedures, which are regularly re-assessed, updated and tested; • The FRS Committee reviews any identified matters by assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The FRS Committee notifies the Board of Directors and the Audit Committee; • The FRS Committee consults with outside experts, if determined that the incident rises to a significant level; • The FRS Committee initiates containment by making tactical changes to the computing environment to mitigate active threats based on currently known information; • The FRS Committee establishes the root cause of incidents, identification and evidence collection from all affected machines and logs sources, threat intelligence and other information sources; • IT personnel recovers and restores normal business functionality, which includes the reversal of any damage caused by the incident and responding as needed; and • The FRS Committee reviews the closure of each incident and conducts a "lessons learned" analysis to improve prevention and ensure the IMP and cybersecurity plans are more efficient and effective.


text: We have faced and continue to face cybersecurity risks in connection with the conduct of our business. Although we do not believe such risks have materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.


text: Risk Management and Strategy There are no management positions directly responsible for overseeing our cybersecurity risk. The Chief Operating Officer ("COO") who functions as our head of IT and certain members of management assist with our cybersecurity efforts and risk assessments. The COO has over 10 years of prior experience in information technology and security.

companyName: Volato Group, Inc.

ticker: SOAR


text: Risk Management and Strategy Overview Protecting the information systems, assets, data, and communication infrastructure is critical to the Company's operations. Consequently, cybersecurity is prioritized through the implementation of a comprehensive cybersecurity risk management program that is managed by the executive team leadership in conjunction with the IT Department and falls within the boundaries of the overall organization risk management program.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Key Principles of the Cybersecurity Risk Management Program: • Risk Management - a proactive approach to identifying and mitigating risks to protect the organization's assets and integrity through third party assessments, internal assessments and global cybersecurity threat analysis. • Defense Strategy - adopts a robust defense approach to protect systems from potential threats, including an assumption of breach mindset. • Zero-Trust Architecture - implements a zero-trust philosophy, ensuring that no entity is inherently trusted without verification. • Least Privileged Access - employ strict identity and access management principles to limit user access based on necessity. • Mitigation and Management of Incidents or Disasters - our risk management program includes policies and procedures for incident response and mitigation.


text: Key Components of the Cybersecurity Program: • Ongoing Detecting and Monitoring - Continuous surveillance of networks to identify threats and intrusions in real-time. • Vulnerability Assessment - Regular assessments conducted by both internal teams and external partners to identify system vulnerabilities. • Employee Training - Regular cybersecurity training and awareness campaigns are undertaken to equip employees with the knowledge needed to mitigate risks. • IT Leadership - The IT Department leads the implementation of the cybersecurity risk management program, ensuring adherence to Company and regulatory standards.


text: Compliance Framework The cybersecurity program aligns with the National Institute of Standards and Technology's Cybersecurity Framework. The IT Department, in collaboration with external vendors, diligently works to detect vulnerabilities, identify compromised devices, and maintain compliance across the organization's IT systems.


text: External Engagement The Company engages with third-party organizations to conduct regular assessments of compliance, controls, and overall risk management strategies, ensuring a comprehensive approach to cybersecurity. Quarterly vulnerability assessments are performed on external and internal systems, as well as a larger annual audit of system security and compliance.


text: Responsibility and Communication The Company promotes a culture where cybersecurity awareness is recognized as everyone's responsibility. Regular communications about cybersecurity risk mitigation and intrusion prevention measures are shared with senior management and the Board of Directors.


text: Incident History The Company has not experienced any cybersecurity incidents during the year ended December 31, 2024, or in any prior year that resulted in interruptions to normal business operations or breaches of systems.


text: IT Director's Role • The IT Director leads the cybersecurity risk management program with over 25 years of experience in managing cybersecurity programs, auditing, and IT operations within the US mining and manufacturing sectors. They possess a bachelor's degree in computer information security and a master's degree in management information systems.


text: Board of Directors Involvement • The Board is actively engaged in overseeing the cybersecurity program, receiving regular updates and assessments concerning governance and compliance. Quarterly updates from the IT Director cover the status of cybersecurity controls, exposures, and overall program results. The Board insists on being informed about any material cybersecurity incidents.


text: This structured overview distills the essence of the cybersecurity risk management and governance processes within the Company, emphasizing the proactive approach to cybersecurity management and the involvement of leadership at all levels.


text: Accordingly, we recognize the critical importance of protecting and securing these information systems and have implemented multiple layers of cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risk. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Efforts to assess, identify, and manage cybersecurity risk are led by our dedicated Chief Operating Officer ("COO"), and supported by an experienced team, other members of management, and the Board. From time to time, we engage consultants, auditors, and other third parties to assist us in these efforts.

companyName: Torrid Holdings Inc.

ticker: CURV


text: We assess our information security program using an industry-leading cybersecurity framework, the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). A risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on us and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: To test our cybersecurity program, we perform periodic vulnerability testing, engage an independent third party to perform periodic internal and external penetration testing, and engage other third parties to conduct periodic assessments of our cybersecurity capabilities. We continuously expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing simulation campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers used in different capacities to provide or operate some of our cybersecurity and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments and external monitoring sources, including performing dark web analyses, to better inform us during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place that are designed to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups, including the legal and finance functions, the Board, and external breach counsel, and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans for certain critical applications and services to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Our cybersecurity risk management and strategy processes are led by our COO, assisted by our Vice President of Infrastructure and Operations. Together, they have over 20 years of combined professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and managing multiple industry and regulatory compliance environments.


text: At least quarterly, the Audit Committee, Chief Executive Officer and senior finance and legal management, evaluate, review and discuss with the COO our cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, recent cybersecurity incidents at other companies and the emerging threat landscape. Significant cybersecurity incidents are reviewed and discussed with the Audit Committee and senior finance and legal management as required by our cybersecurity incident response plan.


text: The Program integrates seamlessly with the Company's enterprise risk management program. Continuous threat and vulnerability assessments inform system and control updates, effectively mitigating risks. Layered security controls work together to protect customer information and transactions. Additionally, third-party experts conduct periodic program evaluations through penetration testing, audits, and best practice consultations, with results driving program improvement initiatives. As a regulated entity, California Bank of Commerce undergoes regular bank regulatory examinations evaluating the information security program and its compliance with federal regulations.

companyName: California BanCorp \ CA

ticker: BCAL


text: While no material cybersecurity incidents have been identified during the reported fiscal year, the Company acknowledges the ongoing and evolving nature of cyber threats and remains vigilant in its efforts to defend against them.


text: The ISO leads program development, implementation, and reporting to the Board. The ISO possesses extensive experience with over 25 years of securing information systems and data, and holds many industry certifications including Microsoft Certified Software Engineer + Security, Exchange Security, Comptia Security+, Pentest+, Cyber Security Analyst(CYSA+), Cisco Certified Network Admin + Security enhancement, Cisco Certified Design architect and Certified Ethical Hacker. Recognizing cybersecurity as a shared responsibility, the Company conducts periodic management-level simulations and tabletop exercises with external resources and advisors as needed.


text: The Board of Directors provides ultimate oversight and monitoring of the Program and its policies. The ARC Committee oversee areas like information technology activities, cybersecurity-related risks, and disaster recovery processes. Additionally, management-level technology and security personnel oversee program management and related assessments, while operational committees manage specific cybersecurity-related risks.


text: Risk Management and Strategy The Company has developed and implemented a cybersecurity program (the "Program") designed to identify, assess, and mitigate material cybersecurity related risks. The Company's program leverages recognized frameworks and standards, including the National Institute of Standards and Technology, Cyber Security Framework, the Center for Internet Security Critical Security Controls, and the Payment Card Industry Data Security Standards, to assess, organize, and improve our program. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we leverage various security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: As part of the Program, the Company maintains various safeguards to help protect the confidentiality, integrity, and availability of its information systems and data, including: • layered technical controls designed to help detect, prevent, and mitigate cybersecurity threats to Company assets; • utilization of a third-party managed detection and response service provider to monitor for cybersecurity threats, ingest threat-intelligence, and coordinate incident response efforts; • policies, procedures, and standards that are utilized to outline the Company's expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity training and education for our employees; • practices for monitoring cybersecurity risks of key third-party service providers; and • incident response plans that provide a framework for the Company's response to cybersecurity incidents.


text: During the period of this Annual Report, the business strategy, results of operations and financial condition of the Company have not been materially affected by risks from any known cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risks Related to Information Technology and Cybersecurity at Item 1A. Risk Factors.


text: The Company also maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through internal management and external service providers. Our cybersecurity risk management and strategy processes are led by our Chief Administrative Officer. This individual has over 30 years of prior work experience in various roles involving managing information systems and security, developing information security strategy, implementing effective information and cybersecurity programs, as well as a degree focusing on computer science. The Chief Administrative Officer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management and participation in the Company's cybersecurity risk management and strategy processes including the operation of our incident response plan. This management team member routinely discusses trends in cyber risks and our strategy with management and reports to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Our information security program includes, among other aspects, antivirus and malware protection, encryption and access control, and employee training. Risks identified by the Chief Administrative Officer and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and provide security awareness training and supplemental training as needed.


text: The Company is committed to protecting its information system and data from cyber threats. We utilize third party technical tools to control system access and filter, restrict and regulate content that may pose a material risk to the Company. Employees are required to use multi-factor authentication to access Company systems and undergo annual security training. Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk.

companyName: Lovesac Co

ticker: LOVE


text: Cybersecurity Governance Cybersecurity is an important part of our risk management and an area of focus for our Board and management. Our Board of Directors is responsible for the risk oversight of the Company, including cybersecurity risks. The Board receives updates on a quarterly basis from senior management, including leaders from our Information Technology and Security, Risk Management. Finance, and Legal teams and our Chief Information Officer regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Board of Directors, as a whole and at the Audit Committee level, oversee the most significant risks facing the Company and our processes to identify, prioritize, assess, manage and mitigate those risks.


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risk. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Audit Committee receives reports, briefings and presentations from senior management, including our Chief Information Officer, at periodic committee meetings, including, more in-depth presentations on specific areas of risk and regular enterprise risk management updates.


text: Although the Company endeavors to mitigate cybersecurity risks, the nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Legal, Tax and Regulatory Risks."


text: Information about cybersecurity risks and Innventure's risk management processes is collected, analyzed and considered as part of Innventure's overall enterprise risk management program. In connection with Innventure's risk management process, the Audit Committee of the Board (the "Audit Committee") discusses with management and the independent auditors the Company's underlying policies and guidelines with respect to risk assessment and risk management, including with respect to cybersecurity.

companyName: Innventure, Inc.

ticker: INV


text: Innventure is in the process of implementing measures to mitigate potential risks associated with information technology disruptions and cybersecurity threats, and Innventure plans to periodically assesses these risks, implements controls, and performs business continuity and disaster recovery planning. Innventure's current risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of cybersecurity technologies. These measures are designed to help protect Innventure's proprietary systems and customer data from both internal and external cybersecurity threats.


text: Innventure engages third parties to perform various cybersecurity services and risk assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, Innventure performs diligence on third-party service providers that provide critical data.


text: As of the date of this Form 10-K, Innventure has not identified risks as a result of prior cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, Innventure's operations, business strategy, results of operations, or financial condition. Innventure faces certain ongoing risks from cybersecurity threats and interruptions that, if realized, are reasonably likely to have a material adverse effect on Innventure's business, financial condition, results of operation, and prospects. See "Risk Factors—Cyber-attacks or a failure in Innventure's information technology and data security infrastructure could adversely affect Innventure's business and operations."


text: Cybersecurity Governance The Audit Committee is responsible for overseeing the Company's guidelines and policies with respect to risk assessment and risk management to assess and manage the Company's exposure to enterprise risk. The Audit Committee periodically reviews and discusses with management the Company's policies with respect to risk assessment and risk management, including but not limited to cybersecurity and enterprise risk, and steps management has taken to monitor and control such exposures.


text: Our Vice President, Finance is responsible for assessing and managing risks from cybersecurity threats. Innventure's Vice President, Finance has a Bachelor's degree in Accounting and a Master of Business Administration degree. Our Vice President, Finance is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from an external consultant. The external consultant has 20 years of cybersecurity experience. The external consultant also has an Associate's degree in Database Administration and Network and System Administration. The external consultant also maintains the industry-recognized CompTIA Security+ certification. The Vice President, Finance reports any exposure to risks from cybersecurity threats to our CFO. The Company intends for the CFO to regularly provide updates on risks related to cybersecurity to the Audit Committee.


text: The ISMP was developed by the Company's information security team in collaboration with cross functional stakeholders, and is designed to ensure the organization's security posture and practices are in alignment with contractual, regulatory and industry requirements. Risk assessments against specified criteria are conducted no less than annually, and sooner if there are significant changes in the environment. Security services are delivered through a combination of internal and third party resources. Formal periodic meetings are held with Company's executive leadership to review relevant components of the ISMP, formal annual reviews of the policies are conducted, formal reviews of the entire ISMP and risk register are conducted at least annually, and more frequently if there are significant changes to the environment. Also, an independent review of the ISMP is conducted in the following ways: (i) an annual Health Insurance Portability and Accountability Act (HIPAA) risk assessment conducted by a third party; and (ii) a Health Information Trust Alliance (HITRUST) risk based two year assessment conducted by a third party.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's cybersecurity team briefs the Audit Committee on the effectiveness of the Company's cybersecurity risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Company's Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.


text: We have, from time to time, experienced threats to and breaches of our data and systems, including breaches of our data within third party vendor's system. As of the filing date of this report, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, security breaches, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A of this report.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our information security function, which includes our Vice President of Information Technology ("IT") and third-party service providers, legal department and security committee, helps identify, assess, and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: using automated tools, conducting audits, evaluating threats, and performing vulnerability assessments.


text: Depending on the environment, systems, and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: cybersecurity insurance, physical security, incident detection and response, access controls, employee training, penetration testing, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Vice President of IT, works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and supply chain resources. We have a vendor management process to manage cybersecurity risks associated with certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of diligence designed to help identify cybersecurity risks associated with a provider such as risk assessments and reviewing security assessments and reports.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled: If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; material disruption of our product development programs; and other adverse consequences.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of IT, who holds a Bachelor of Science in Computer Methods from California State University-Long Beach and has previously served as a Director and Associate Director of IT for large pharmaceutical companies.


text: Our management, including our Chief Operating Officer and Vice President of IT, is responsible for hiring appropriate information security personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and helping prepare for cybersecurity incidents.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President of IT and General Counsel, who work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: Risk Management and Strategy We have implemented a cybersecurity program for assessing, identifying, and managing cybersecurity risks aligned with the National Institute of Standard and Technology Cybersecurity Framework (NIST CSF) and where appropriate we have integrated these processes into our enterprise risk management framework. We have implemented administrative, technical, and physical safeguards designed to protect our information systems and protect the confidentiality, integrity, and availability of our data. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: We engage external parties, such as consultants, to enhance our cybersecurity oversight as required. We conduct periodic risk assessments to evaluate our cybersecurity posture, including through annual third-party vulnerability assessment and penetration tests performed by reputable service providers. We conduct risk assessments, as appropriate, on critical third parties who maintain material data or information to help assess and validate the information security capabilities of these third parties. We maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. We also have implemented administrative, technical, and physical safeguards designed to protect our information systems and protect the confidentiality, integrity, and availability of our data.


text: Governance Related to Cyber Security Risks The Audit Committee of the Board has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, our Chief Information Security Officer ("CISO") shares quarterly updates regarding any changes around our cybersecurity defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively address these threats with the Audit Committee. During these meetings, the CISO provides the Audit Committee updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively address these threats. Our Board has delegated primary responsibility for the oversight of cybersecurity matters to the Audit Committee; however, the full Board reviews significant cybersecurity matters as appropriate. The Audit Committee provides updates to the Board on a quarterly basis on the activities that the Audit Committee oversees, including Cybersecurity.


text: Our Chief Information Security Officer is responsible for strengthening and continuously monitoring the effectiveness of our cybersecurity program. The individual currently serving in the role of Chief Information Security Officer has over 30 years of information systems and cybersecurity experience within complex and international business verticals such as technology, financial services, biotech, and other scientific organizations. He also holds the Certified Information Systems Security Professional (CISSP) certification. In addition, our cybersecurity steering committee assists in managing certain technical aspects related to cybersecurity. Our cybersecurity steering committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through monthly meetings and frequent communications. Regular members of the steering committee consist of participants from the IT infrastructure, Business Systems, AI and Modelling and Scientific Computing teams. Participants from other teams attend on an as-needed basis.


text: To date, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. However, as discussed more fully under "Item 1A. Risk Factors", the sophistication of cyber threats continues to increase and we cannot assure that our systems and processes will be successful, that we will be able to anticipate or detect all cyberattacks or other breaches, that we will be able to react to cyberattacks or other breaches in a timely manner or that our remediation efforts will be successful.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. As of Fiscal 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For more information about the Company's assessment of cybersecurity risks, see the risk factor titled "A privacy breach, through a cybersecurity incident or otherwise, or failure to comply with privacy laws could have a material adverse effect on our business" in Part I, Item 1A, "Risk Factors".

companyName: Childrens Place, Inc.

ticker: PLCE


text: Our CTO's background includes more than 20 years of experience in the technology domain, with 15 years in the retail industry, leading e-commerce implementations and large scale transformation projects such as adopting cybersecurity best practices. Our VP, IT has more than 30 years of experience implementing security in complex manufacturing and retail environments. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.


text: Our Board of Directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the Risk and Governance Committee. Throughout the year, at each quarterly Risk and Governance Committee meeting, or as needed, the committee is updated on IT security by senior management, including industry IT breaches, cybersecurity incidents and employee cybersecurity training. Our SVP, IT Operations & Security, is a Certified Information Systems Security Professional who has provided technology-related infrastructure and application management services for over 25 years and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our SVP, IT Operations and Security, reports directly to our Chief Financial Officer.

companyName: Aircastle LTD

ticker: AYR


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: The Audit Committee receives periodic reports from our Vice President of Cybersecurity and Information Technology on our cybersecurity risks, updates, as necessary, regarding any cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our Vice President of Cybersecurity and Information Technology is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and Information Technology was the Leader of Global Information Security for New Balance.


text: Our Vice President of Cybersecurity and Information Technology supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity Executive Council ("Council"), which is led by the Chief Information Security Officer ("CISO") and includes our Chief Information Officer ("CIO"), Chief Operating Officer ("COO"), General Counsel ("GC"), Chief Compliance Officer ("CCO"), SVP of Research & Development, Senior Director of Engineering, SVP of Global Services Operations, and AVP of Engineering, oversees NetScout's cybersecurity program, including strategy, threats, risks, and mitigations. The CISO, who reports to the CIO, and the Senior Director of Engineering, who reports to the SVP of Research and Development, with oversight by the Council, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and NetScout's risk profile using various methods such as implementing manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of certain threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments to identify vulnerabilities, and engaging in tabletop incident response exercises.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things: incident response, identity and access management, vulnerability management, logging and systems monitoring, disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls for certain systems; data segregation and access controls for certain systems; physical security measures; asset management; annual employee training; certain testing; and IT and software development lifecycle training. NetScout also employs certain proprietary detection tools, enabling enhanced visibility and warning systems in response to certain cybersecurity threats.


text: We also use third-party service providers to assist us from time to time to identify, assess, audit and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and certain testing firms.


text: We use third-party service providers to perform a variety of other functions throughout our business, such as application providers, hosting companies, and supply chain resources (such as shipping). We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve risk assessments, data privacy and security questionnaires, risk assessments, and imposition of cybersecurity-related contractual obligations on the vendor.


text: Our risk-based assessment and management of material risks from cybersecurity threats are integrated into NetScout's overall risk management processes. Cybersecurity risks are addressed as a component of NetScout's enterprise risk management program and our enterprise risk management processes include an Enterprise Risk Management Steering Committee ("Steering Committee"), led by the CCO and includes all members of the Council as well as other members of management, that meets quarterly and considers ways to mitigate cybersecurity threats that are more likely to lead to a material impact to our business. The Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and provides a risk register report to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of NetScout's management, including our CISO, who reports to the CIO and has over 25 years of experience, the CCO, who reports to the General Counsel, and the Senior Director of Engineering, who reports to the SVP of Research and Development, for security.


text: Our cybersecurity incident response policy and plan are designed to escalate certain cybersecurity incidents to a Security Incident Response Team ("SIRT"), comprised of the CIO, CISO, GC, CCO and Senior Director of Engineering. The SIRT works with NetScout's incident response team to help NetScout mitigate and remediate cybersecurity incidents of which they are notified. In addition, NetScout's incident response plan includes reporting to the CEO and Chair of the Audit Committee of the Board of Directors for certain cybersecurity incidents. NetScout's Cybersecurity Disclosure Committee, which includes the SIRT and the Chief Financial Officer, assess the materiality of cybersecurity incidents for potential disclosure requirements according to an escalation process defined in NetScout's Cybersecurity Protocol for Disclosure Controls and Procedures.


text: To date, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect NetScout and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report.


text: Risk Management and Strategy Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal information security program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: a.we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology cybersecurity framework and the International Organization for Standardization ("ISO");

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: b.we maintain a dedicated cybersecurity team under the direction of our Chief Technology Officer ("CTO") and supported by our Chief Information Security Officer ("CISO"), each of whom has expertise related to data and network security, data governance and risk management; c.we regularly test our internal IT controls; d.we regularly conduct internal vulnerability assessments as well as third-party penetration tests;


text: e.we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; f.we conduct pre-engagement and targeted recurring reviews of the security controls and security-compliance posture of applicable third-party service providers; g.all employees are required to complete periodic trainings that cover security and privacy best practices and company policies;


text: h.we regularly review our business continuity and other back-up plans, including as they relate to cybersecurity incidents; and i.we perform periodic simulations of attack scenarios by an internal "Red Team" to test the efficacy of both security controls and our tactical incident response procedures.


text: c.if deemed appropriate, reporting by our CISO to the Company's Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and d.informing the Audit Committee of our Board of significant or material cybersecurity incidents, as appropriate.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee, cybersecurity and information security risk management and controls. As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company's risk assessment and risk management policies, including related to cybersecurity. At least quarterly (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board, respectively, addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information systems. Our cybersecurity risk management program is integrated into our broader Information Security Management System ("ISMS"), which is designed to identify, assess and manage risks across the organization and to enhance our resilience and support the achievement of our strategic security objectives. Our cybersecurity risk management program includes a cybersecurity incident response plan and engagement of third-party cybersecurity experts who assist the organization with preparedness and on an as-needed basis. The audit committee of our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our Chief Security Officer ("CSO"), who reports directly to our Chief Executive Officer. The CSO and his team are responsible for leading enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our CSO has over 20 years of and cybersecurity and infrastructure experience, including serving as the Chief Information Security Officer ("CISO") at Calendly, VP of Information Security and CISO at Ripple, and Senior Director of Enterprise Security at Salesforce. • a cybersecurity vulnerability assessment process that includes internal testing, as well as engagements with outside security researchers, for identification, evaluation and management of cybersecurity risks. For example, we conduct penetration tests, manage a bug bounty program, conduct table top and run red team/purple team exercises to evaluate the effectiveness of our ISMS and cybersecurity practices. • Our CSO and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with our defined Privacy and Security Incident Response plan, which is reviewed along with other plans relevant to our cybersecurity risk management on an annual basis. • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data. • a training program that includes updates on current security topics, including social engineering, phishing, password protection, protecting personal data, appropriate use of assets, and • an annual certifications program by an accredited third-party auditor for compliance with ISO/IEC 27001:2013 for an ISMS, ISO/IEC 27701:2019 for a patient information management system, as well as the requirements and control implementation guidance within ISO/IEC 27018:2019 for cloud computing.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Cybersecurity Team and Strategy — The cybersecurity team, led by the CSO, is responsible for managing the day-to-day cybersecurity strategy of the organization, including oversight of our cybersecurity tools and controls to protect company assets. We have implemented an iterative and multi-layered cybersecurity strategy that incorporates both proactive review of the evolving cybersecurity threat landscape and reactive management of cybersecurity threats. Our proactive management of cybersecurity risks includes access limitations, data loss prevention programs, correction of potential cybersecurity risks, and programs for employee education regarding cybersecurity risks. Our reactive management of cybersecurity risks includes continuous logging and alerting, utilization of enterprise cybersecurity technology, and personnel dedicated to incident response.


text: Third-Party and Vendor Management Review Processes — We have implemented processes to assess cybersecurity controls while on-boarding and managing third-party vendors. Additionally, we have implemented a process for annual review and enforcement of the cybersecurity controls for third-party vendors that provide essential services and/or store data that presents a business risk to us and/or our customers.


text: Cybersecurity Incident Response Plan — In October 2023, we experienced a cybersecurity incident in which certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization. Following the Cyber Incident, we implemented changes to our information systems and processes to provide additional protections to our environment, including enhancements to our Security Operations, reset customer passwords, required two-step verification for new and existing customers, enhanced our detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats which may materially impact our operations. For more information about our cybersecurity related risks, see "We have experienced a criminal cyber incident and could in the future experience other security breaches, disruption to our business, or reputational harm" in Part 1, Item 1A, Risk Factors of this Form 10-K.


text: Board Oversight — Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CSO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews our cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the audit committee, we have protocols by which we escalate certain cybersecurity incidents to the board and the audit committee.


text: Management Oversight — We have implemented a cross functional ISMS governance committee that drives awareness and alignment across broad governance and stakeholder groups for effective cybersecurity risk management. The CSO and acting Data Privacy Officer ("DPO") co-chair the ISMS Governance Committee. The ISMS Governance Committee acts in alignment with the Data Protection Governance Committee, another cross-functional governance committee, which provides strategic direction and oversight over the company's program related to data protection. These governance committees have responsibility for oversight, resource allocation, capabilities and planning. Members of the ISMS committee review newly identified cybersecurity risks, evaluate the appropriate treatments, monitor the on-going status of risk remediation. The CSO and acting DPO regularly report to the audit committee on these matters.


text: Risk Management and Strategy We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. This cybersecurity risk management process includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access and other security incidents and vulnerabilities.

companyName: Digital Turbine, Inc.

ticker: APPS


text: We require employees with access to information systems, including all corporate employees, to undertake data protection, cybersecurity, privacy and compliance programs at least annually. We maintain a team of dedicated security and compliance professionals who oversee cybersecurity risk management, mitigation, incident prevention, detection, and remediation, which is led by our Chief Information Security Officer. The team has deep cybersecurity experience with an average tenure of over 20 years with expertise in protecting critical assets for top firms in a myriad of different industries.


text: We achieved SOC 2 Type 2 attestation this fiscal year, demonstrating the operating effectiveness of our internal security controls and our commitment to industry-leading information security standards. This attestation provides assurance to stakeholders that Digital Turbine's systems and processes are regularly audited by independent third parties to verify compliance with rigorous security and privacy requirements.


text: Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. Senior management regularly discusses on at least a quarterly basis and otherwise as needed, cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Part I, Item 1A Risk Factors of this Annual Report on Form 10-K, including the risk factor titled "System security risks, data protection breaches, cyber-attacks, and systems integration issues could disrupt our internal operations or information technology services provided to customers, and any such disruption could reduce our expected revenue, increase our expenses, damage our reputation, and adversely affect our stock price."


text: The Company's Board of Directors provides ultimate oversight of the Company's cybersecurity risk management. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CIO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: GMS Inc.


text: Our commitment to security is evidenced by our certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171 and FedRamp Additionally, we subject our standards-based certifications to annual audits by third parties and have successfully undergone examinations such as the Health Insurance Portability and Accountability Act (HIPAA), validated by qualified third-party assessors. There were no material cybersecurity incidents experienced by C3 AI during the fiscal year ended April 30, 2025.

companyName: C3.ai, Inc.

ticker: AI


text: Our cybersecurity program utilizes the International Organization for Standardization Information Security Management Systems (" ISO 27001") framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness. Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls. It is a mutually supported environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.

companyName: KORN FERRY

ticker: KFY


text: As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Item 1A "Risk Factors" under the heading "Risks Related to Technology, Cybersecurity and Intellectual Property," which should be read in conjunction with the foregoing information.


text: Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer. Our Chief Information Officer has more than two decades of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities. The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional. He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise. The team is additionally supported through external services and on demand incident response capabilities. These capabilities include pre-established relationships with industry leading providers for incident containment, forensic analysis, systems recovery, legal advice, and external communications assistance.


text: We leverage a structured process framework based on ISO 27001 to minimize cyber risks and facilitate continuous improvement. We adhere to the principle of least-privilege when provisioning access to systems, seeking to limit potential abuse of system privileges by internal or external threats. We train our employees annually in cybersecurity awareness and responsibilities and we engage them throughout the year with phishing awareness exercises, additional focused training, and messaging about current and persistent threats. Employees with privileged access to systems are further trained in security-by-design principles, centered on best practices for securely developing and managing software systems.


text: Our software development processes are governed by a structured systems development lifecycle process that is designed to review new features and system changes for adherence to security requirements prior to deployment. Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation. Lastly, the use of third-party software in our environment is governed by our third-party risk management program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.


text: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. We also use third-party service providers from time to time in connection with our risk assessment processes.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity breaches, cyberattacks and other disruptions to information technology systems could disrupt our operations, compromise the confidentiality of our data or our intellectual property, and adversely affect our business, reputation, operations and financial results" and "Our business may be impacted by information technology system failures or network disruptions and lack of redundancy" in this Annual Report on Form 10-K for additional information about our cybersecurity-related risks.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee of the Board (the NCG Committee) overall oversight of cybersecurity matters and other policies and internal controls regarding cybersecurity risks. The Audit Committee of the Board (the Audit Committee) is responsible for oversight of disclosure controls with respect to potential cybersecurity incidents as well as the Company's compliance with SEC rules applicable to cybersecurity risk management.


text: In fiscal 2025 the Audit Committee and the NCG Committee received reports on our cybersecurity risk management initiatives. In addition, our management team updates the Board with respect to the Company's overall cybersecurity risk posture and initiatives in order to improve our cybersecurity risk controls. As necessary, the Audit Committee will oversee management's responses to any significant cybersecurity incidents including any disclosures required by law. The full Board also receives a briefing from management on our cyber risk management program at least annually.


text: Our management team, which includes our IT management team, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer, Chief of Staff and internal audit function, as needed. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of IT has served in various roles in information technology and information security for over 15 years.


text: Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief of Staff, Chief Legal Officer and Chief Financial Officer. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber security attacks, internal system or service failures, and misappropriation of data or other breaches of information security may adversely impact our business and operations" in Item 1A. Risk Factors.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: Risk Management and Strategy We believe we maintain an information technology and security program appropriate for a company of our size, taking into account our operations and risks. We recognize the critical importance of maintaining the trust and confidence of our investors, employees, customers and vendors. We have implemented cybersecurity processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes include mechanisms, controls, and certain technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with an outside information technology consultant on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: Our Board of Directors oversees our risk management process. The Audit Committee, by way of Board delegation, retains oversight of the Company's cybersecurity risks. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board, as applicable. Our Vice President of Technology and/or Manager of Information Technology are responsible for leading the assessment and management of cybersecurity threats and periodically updating the Audit Committee as needed.


text: Our information security program is designed to meet the needs of our clients who entrust us with their sensitive information. We maintain International Organization for Standardization 27001 certification for our enterprise-wide information security management system and program. Where applicable, we align to other industry standards or frameworks, including the Cloud Security Alliance's Cloud Controls Matrix, the Payment Card Industry Data Security Standard, the Health Insurance Portability and Accountability Act, and the CSF HiTRUST Common Security Framework.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") process which provides an ongoing procedure, effected at all levels of the Company and across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action. Central to our risk management process is the Risk Committee, a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks. The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Technology Officer, Chief Compliance Officer, and other senior executives of the Company. Our Risk Committee collaborates with subject matter experts, as needed, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigations.


text: We take the following actions, among others, to demonstrate our commitment to maintaining the highest levels of information security, provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to identify, protect against, detect, respond to, and recover from cybersecurity incidents: • leverage encryption, data masking technology, data loss prevention technology, authentication technology, entitlement management, access control, network and application segmentation, anti-malware software, and transmission of data over private networks, among other systems and procedures, designed to protect against unauthorized access to information; • conduct annual reviews with many of our clients on our cybersecurity and data security policies, practices and controls, and engage with regulators across the world, to remain apprised of cybersecurity and data security standards and best practices; • utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. The NIST Framework outlines security controls and outcomes over five functions: identify, protect, detect, respond, and recover; • conduct network and endpoint monitoring, vulnerability assessments, and network penetration testing; • conduct quarterly information security management and incident training, and regular phishing email simulations for all associates to enhance awareness and responsiveness to possible threats; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures; • conduct information security reviews and due diligence on key service providers to identify, assess, mitigate, and monitor risks associated with our use of third-party software and services; and • maintain global information security policies and procedures, including an incident response and crisis management plan that include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.


text: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches or cybersecurity incidents could adversely affect our financial results and our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation," included as part of our risk factor disclosures at Item 1A. of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Our information security program and team are currently managed by our Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer. Our CISO has more than 25 years of experience in managing and leading cybersecurity functions including cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China. Our CISO is responsible for developing, implementing, and overseeing our overall information security program, including cybersecurity risk management, governance and compliance, security policies and training, and the overall protection and defense of our networks, systems, and confidential data. With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.


text: The responsibilities of the Company's Board include oversight of our risk management processes. The Board has two primary methods of oversight. The first method is the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company. The second is through the functioning of the Board's committees. The Audit Committee assists the Board in its oversight of the Company's information security program, including cybersecurity and data privacy risks and controls. Our CISO provides reports on the Company's cybersec urity program to the Audit Committee, which includes all members of the Board, on a quarterly basis. In addition, our Internal Audit function regularly audits our technology and cybersecurity programs and reports to the Audit Committee on its findings.


text: From time to time, the Company experiences cybersecurity threats and attacks. Although no cybersecurity incident has materially affected the Company's businesses to date, FOX expects to continue to be subject to cybersecurity threats and attacks and there can be no assurance that the Company will not experience a material incident. For more information, see Item 1A., "Risk Factors—Risks Relating to Cybersecurity, Piracy, Privacy and Data Protection."

companyName: Fox Corp

ticker: FOXA


text: Risk Management and Strategy CACI is committed to maintaining a robust cybersecurity management and oversight program to mitigate cybersecurity risks to our systems and to protect both our and our customers' confidential and sensitive information. We employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: CACI's cybersecurity program is integrated into our overall risk management program and is primarily managed by our Chief Information Security Officer (CISO) who is responsible for coordinating cross-functional internal and external resources to establish processes and procedures to monitor potential cybersecurity risks, identify cybersecurity incidents, implement appropriate mitigation measures, report cybersecurity breaches, and maintain our cybersecurity program. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from experienced cybersecurity professionals in the information security team, supplemented by technological tools and software. We continuously monitor cybersecurity threats and assess the robustness of our mitigation and prevention measures through routine internal and independent audits, threat simulations, vulnerability and penetration testing, and employee cybersecurity training. Our cybersecurity program is designed to be aligned with applicable industry standards, and we continue to invest in capabilities to protect all information assets in our possession.


text: As a government contractor, we have designed our cybersecurity risk management program to align with the National Institute of Standards and Technology (NIST) standards and comply with extensive regulations, including but not limited to U.S. government cybersecurity regulations. Additionally, our cybersecurity program is routinely assessed by the government, and our network is penetration tested biannually by a third-party independent assessor. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks. We require them to comply with applicable laws and regulations, including implementing certain security controls and complying with certain reporting obligations. Although we perform due diligence on all service providers to identify potential cybersecurity risks and establish controls through onboarding procedures and contractual requirements, our ability to monitor the cybersecurity practices of our service providers and ensure that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks, and other assets owned or controlled by our vendors is limited.


text: In the event of a cybersecurity incident, the Company has established an incident response plan to address the matter promptly and effectively. Our CISO leads our Cybersecurity Incident Response Team (CIRT) that is responsible for leading and coordinating CACI's response to cybersecurity incidents in accordance with CACI's established cybersecurity incident response plan and response processes. In accordance with these policies, cybersecurity events and data incidents are evaluated, ranked by severity, and prioritized for escalation to CACI's Executive Incident Assessment Committee. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.


text: Board of Directors Oversight The Audit and Risk Committee ( Audit Committee) has oversight responsibility for risks and incidents relating to cybersecurity, including compliance with regulatory requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee receives regular briefings on our cybersecurity posture, cybersecurity trends, and cybersecurity risks from management and, if they occur, is briefed regarding any material cybersecurity incidents. The Audit Committee reports any findings or recommendations to the Board of Directors, as appropriate.


text: Cybersecurity Threats To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A, Risk Factors of this Annual Report on Form 10-K.