text: Under the leadership of the Company's Chief Technology Officer, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the Company's information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors ( the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part our overall risk assessment process.

companyName: SITE Centers Corp.

ticker: SITC

secItem: Item 1C


text: The Company has experienced issues from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of its information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies—A Disruption, Failure or Breach of the Company's Networks or Systems, Including as a Result of Cyber-Attacks, Could Harm Its Business."


text: Introduction: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We are committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have insurance coverage in place for certain potential liabilities and costs relating to cybersecurity risks, data security incidents and/or network security breaches, but this insurance is limited in amount, subject to a deductible, and may not be adequate to cover us for all costs arising from these incidents.


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. All of the Audit Committee members are independent directors. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer, or CDIO, is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the President of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the President have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.

companyName: HCI Group, Inc.

ticker: HCI


text: Risk Management and Strategy We recognize the critical importance of cybersecurity and data privacy in safeguarding our operations, sensitive data, and maintaining the trust of our stakeholders. We acknowledge the significance of cybersecurity incidents and threats as potential risks that may impact our operations and information systems. We have developed and implemented cybersecurity and data privacy programs in accordance with the requirements of ISO standards 27001:2022 and 27701:2019, which are intended to appropriately preserve the confidentiality, integrity, and availability of information maintained by our company. These programs identify, select, maintain, operate, and improve cybersecurity and privacy controls.

companyName: EXPONENT INC

ticker: EXPO


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are designed to preserve the confidentiality, integrity, and availability of our information systems and the information residing therein. Our cybersecurity incident response plan is based on the NIST 800-61r2 "Computer Security Incident Handling Guide." This plan is used to process security events identified through our real-time, 24x7 monitoring, and is also used to conduct security incident tabletop exercises. The incident response plan includes detailed steps for incident leadership, escalation to established partners, response protocols based on the type of incident, responsibilities for follow-up and reporting, and steps to capture lessons learned and improvement opportunities. Our vulnerability management processes include real-time monitoring for vulnerabilities and standardized reporting for managing remediation efforts. Our cybersecurity risk management processes are integrated into our overall risk management system to ensure alignment with our business objectives and strategies. We engage assessors, consultants, auditors and other third parties to execute certification audits, penetration tests, and security framework risk assessments. These external entities provide specialized expertise and insights to enhance the effectiveness of our cybersecurity risk management processes.


text: We have established processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, including cloud service providers and AI system. We conduct due diligence assessments and evaluate contractual obligations to mitigate potential risks arising from third-party relationships.


text: We leverage industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center for Internet Security ("CIS") framework to inform how we identify, assess and manage cybersecurity risks relevant to our business.

companyName: SKECHERS USA INC


text: Our Cybersecurity Risk Management Program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, and incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • engage ment of third parties for our 24/7 monitoring, detection, and response; regular penetration testing, program controls assessment, and proactive incident preparedness activities.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. Our Senior Vice President ("SVP") of Information Technology and the Vice President ("VP") of Information Security have overall responsibility for assessing and managing our material risks from cybersecurity threats. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity at least annually, and receives an update quarterly on information security and cybersecurity from materials provided by the VP of Information Security.


text: The VP of Information Security oversees the Information Security Steering Committee ("Steering Committee"), which provides education on the Company's cybersecurity programs and controls to key members of the Company. The Steering Committee meets quarterly and is comprised of members from the Executive Leadership Team, including the Chief Financial Officer and Executive Vice President of Business Affairs, as well as the SVP of Information Technology, VP of Information Security, VP of Corporate Communications, SVP of Digital Innovation, and Head of Global Human Resources.


text: Cybersecurity risk management is led by our VP of Information Security and our SVP of Information Technology, who reports to our Chief Operating Officer, who are generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The VP of Information Security manages a team of cybersecurity professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, digital security and regulatory compliance.


text: Our VP of Information Security has over 15 years of experience in technology and information security, serves on the board of directors of the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") and holds several cybersecurity and risk management certifications. Our SVP of Information Technology has over 30 years of information technology management and cybersecurity experience and has held leadership roles overseeing all aspects of information technology operations for multiple Fortune 500 and Fortune 50 global companies, particularly in the retail and media & entertainment sectors.


text: We continue to invest in cybersecurity and resiliency of our networks and adapt our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A "Risk Factors."


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained our second ISO 27001 certification.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: BOARD AND AUDIT COMMITTEE OVERSIGHT One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.

companyName: Outset Medical, Inc.

ticker: OM


text: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our VP of Information Technology manages our information security program.


text: Executive leadership Our VP of Information Technology and the information security team periodically present information about the Company's information security program, including program goals and actions, progress against key initiatives and key risks, to our executive leadership team. As described above, significant risks related to cybersecurity are escalated to the Audit Committee and/or the full Board as appropriate.


text: Cross-functional management engagement We have established a committee comprised of leaders from key functions across the Company including, but not limited to, information security, IT, engineering, legal, privacy, finance, and people operations. Members of this committee generally meet regularly to review the Company's cybersecurity program, the evolving threat landscape and key related action items.


text: Governance of information security risks We have also established a risk governance committee, which generally meets on a quarterly basis. This committee, which is sponsored by our VP of Information Technology, is comprised of Company leaders from information security, information technology (IT), legal, privacy, finance, operations, and other functions, who have experience in managing cybersecurity risks, who review the cybersecurity threat landscape, and who evaluate key emerging data security risks. The committee reviews certain cybersecurity-related risks facing the company; discusses open policy exceptions and key risk indicators; and manages cybersecurity risks presented by the information security team and proposed mitigation actions. Members of this committee review the key risks identified as an outcome of our cybersecurity risk management strategy described below.


text: We have operationalized key processes to help us identify, assess, manage, and mitigate reasonably foreseeable risks from potential cybersecurity threats. For example: • USE OF THIRD PARTIES: We engage third-party cybersecurity consulting firms to assist us with various aspects of our cybersecurity risk management program. For example, we currently consult with third party firms to assist with our annual penetration testing for the Tablo device, Tablo cloud and IT infrastructure. In addition, In addition, we used a third-party audit firm accredited by the American Institute of Certified Public Accountants (AICPA) to support us in the SOC 2 certification process for Tablo cloud. • VENDOR ASSESSMENT: We leverage a third-party risk assessment tool to help us identify cybersecurity, privacy, and operational related risks associated with our use of certain third-party service providers. • INCIDENT PREPAREDNESS AND RESPONSE: We maintain a Cybersecurity Incident Response Plan (IRP) which establishes a framework designed to enable us to respond to cybersecurity incidents in a consistent, timely and effective manner. Our IRP outlines procedures for identifying, reporting, investigating, assessing, and responding to cybersecurity incidents, including incident response team formation, roles and responsibilities by department, and communication and escalation protocols. Depending on the severity of the cybersecurity incident, our IRP contemplates escalation to our executive leadership team and the Audit Committee and/or the full Board, as well as periodic briefings on developments related to the incident response. We periodically review and update our IRP and have conducted training of key team members regarding the IRP. In addition, we have conducted a tabletop exercise to simulate a response to a cybersecurity incident. • SECURITY STANDARDS: Our IT and Tablo cloud security architecture are designed to comply with the HIPAA Security Rule. In addition, our Tablo cloud security architecture leverages recognized frameworks designed to protect customer data. For example, we have received SOC 2 certification for Tablo cloud and we are working to align our processes, protocols and product software with the FDA's recent cybersecurity guidance finalized in September 2023. We periodically examine our security controls and take steps to review, prioritize and address key compliance gaps where identified, using a risk-based approach. • TECHNICAL SAFEGUARDS: We perform information security maturity assessments and penetration testing for the Tablo device and Tablo cloud (including in connection with new product features and services), as well as for our IT infrastructure. We conduct vulnerability scans across key assets, core infrastructure, and endpoints to identify potential vulnerabilities and potential cybersecurity events. We assess and prioritize the remediation of vulnerabilities and other cybersecurity risks identified through these activities, using a risk-based approach. • THREAT LANDSCAPE AWARENESS: We regularly receive and review threat landscape bulletins from Health Information Sharing and Analysis Center (H-ISAC), Cybersecurity and Infrastructure Security Agency (CISA) and others, and incorporate enhancements into our ongoing cybersecurity program based on this review. • INSURANCE: We maintain information security risk insurance coverage to mitigate potential losses in the event of a business disruption.


text: • TRAINING: All Outset employees are assigned HIPAA and information security training as part of the new employee onboarding process and refresher training is assigned annually. Our IT team also conducts continuous automated phishing simulation campaigns, which can trigger additional training for employees on how to recognize social engineering attempts (e.g., phishing, smishing, etc.). We track employee performance on phishing exercises to help us monitor the awareness of our employees and inform future training priorities. For employees whose jobs require access to sensitive data, including PHI, additional security training may be required.


text: We regularly monitor for, defend against, and respond to cybersecurity threats to our networks and information systems, as well as other types of security threats and incidents. Despite our information security efforts, our facilities, systems, servers, platforms and data, as well as those of our third-party cloud and other service providers and Tablo's two-way wireless communication system, may be vulnerable to privacy and information security incidents and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. These include data breaches, viruses or other malicious code, exploitation of known or unknown vulnerabilities, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, insider threats or other security or IT incidents caused by threat actors, technological vulnerabilities, or human error. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information to gain access to the data and personal information we maintain. As of the date of this Annual Report, we are not aware of any material adverse impact to our business or operations from cybersecurity threats or incidents. We do, however, recognize that the cybersecurity landscape evolves rapidly and that we are not immune to such incidents. If we, or any of our third-party service providers, fail to comply with laws requiring the protection of sensitive personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, or if our incident response, containment or mitigation measures are inadequate in the face of a particular data breach or cybersecurity incident, we may face significant business interruptions, incur reputational damage, and be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, and mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. If we are unable to prevent or mitigate the impact of such security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Committee members receive presentations on cybersecurity topics from our Senior Vice President, Information Technology & Facilities, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.

companyName: 4D Molecular Therapeutics, Inc.

ticker: FDMT


text: Cybersecurity Risk Management and Strategy We utilize third party cybersecurity consultancy firms to manage and execute our cybersecurity programs. These third party firms are led and supervised by our Chief Information Officer ("CIO"). Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. On a quarterly basis, our third party cybersecurity consultancy firms perform phish testing and on demand information security training. On a yearly basis, our third party consultancy firms perform, among other trainings and assessments, information security awareness training, internal cybersecurity risk assessments, internal and external penetration tests, key vendor risk assessments, incident response tabletop exercises, written information security and business continuity plan policy gap analysis reviews and revisions as well as incident response plan reviews and revisions. The results of the assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Management's Role Our CIO, who has 15 years experience in technology, has primary responsibility for assessing and managing material cybersecurity risks, including overseeing and identifying cybersecurity risks associated with our use of third party cybersecurity consultancy firms, and are members of management's IT Steering Committee, which consists of management team members and certain employees who drive alignment on technology and security decisions across the Company. The IT Steering Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The IT Steering Committee also considers and makes recommendations to management, the Board of Directors and the Audit Committee on security policies and procedures, security service requirements, and cybersecurity risk mitigation strategies.


text: All companies utilizing technology are subject to threats of breaches of cybersecurity. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make proactive and strategic investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are imbedded into our overall risk management governance and are reviewed at least annually by the Audit Committee of our board of directors.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Risk Management and Strategy We have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email fraud. We have engaged consultants with significant expertise and certifications in cybersecurity related to our industry. For continuous cybersecurity monitoring across our information technology environment, we have invested in advanced technologies that are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our information security policy is based on recognized industry standards and cover areas such as risk management, data backup, and data recovery. We engage consultants and IT managed service providers (IT MSP), to help us design and implement our cybersecurity policies and procedures. IT MSP assist us with monitoring security threats and vulnerabilities and responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee. We conduct cybersecurity penetration testing as warranted to identify and remediate cybersecurity gaps.


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our current IT consultants and IT MSP, who report to our Chief Development Officer.


text: We evaluate each third-party service provider to verify the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures, and to promptly report any suspected breach of security measures that may affect the Company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.


text: Our Chief Development Officer periodically meets with our IT consultants and IT MSP about ongoing compliance and risk management, and our Chief Executive Officer provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Managing Material Risks and Integrated Overall Risk Management We have developed an Information Security Program (the "Program") as part of our overall Enterprise Risk Management ("ERM") framework to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: As part of our Risk Governance, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on Program effectiveness. In addition to Board Oversight, we also have Governance, Risk, Information Technology, Information Security, and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.


text: Risk from Cybersecurity Treats We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and also regularly communicate with our customers and employees. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.


text: While to-date we have not experienced a material cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers, we are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.


text: Risk Management Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: We have begun to conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers. Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Information Officer with the responsibility of managing the cybersecurity risk assessment and mitigation process with the oversight of the Chief Financial Officer responsible for the consolidated financial statements for the year ended November 30, 2024. As part of our overall risk management program, we provide cybersecurity training to employees in high-risk.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Our Chief Information Officer is primarily responsible for assessing and managing material risks from cybersecurity threats on a day-to-day basis.


text: Risk management and strategy Cybersecurity risk management is an important and rapidly evolving part of our overall risk management efforts. We believe we are a particularly attractive target as a result of the types and volume of personal data and content on our systems and the evolving nature of our products and services. Our products and services reach millions of users and involve the collection, storage, processing, and transmission of large amounts of data. In addition, our business and operations span numerous geographies around the world, involve hundreds of employees, contractors, vendors, developers, partners, and other third parties, and rely on software and hardware that is highly technical and complex. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Bumble Inc.

ticker: BMBL


text: Our Information Security Management System ("ISMS"), the foundation of our security framework, is designed to protect critical assets (including our users' personal information) and assess, identify, manage and mitigate material risks from cybersecurity threats.


text: Finally, the ISMS incorporates an Incident Response Plan, which outlines the procedures that we use to investigate and respond to cybersecurity events and alerts, an Incident Response Policy, which sets out high-level principles and requirements that apply to cybersecurity incident response, and a Business Continuity Plan, which sets out high-level steps in protecting the services, assets and employees of the Company during an event that disrupts business continuity. The Incident Response Plan includes clearly defined roles and responsibilities, including guidance for reporting up the chain to senior management and, where appropriate, to the Audit Committee and the Board. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. The Incident Response Plan comprises four high-level phases: identification and investigation of a cybersecurity incident (including suspected personal data breaches); containment to lessen any ongoing harm; eradication of the root cause; and, post-recovery, supplementation of the cybersecurity incident record with lessons learned in order to improve our incident response capabilities. The Business Continuity Plan defines the procedures to be followed if there is a critical failure that results in operations at one of our corporate offices being suspended, as well as the procedures to be followed if there is a critical failure of our services or underlying hosting infrastructure that results in significant degradation of a service provided, with an aim to operate at existing service levels throughout the duration of the incident.


text: While we do not believe that, as of the date of this Form 10-K, we have experienced a cybersecurity threat or incident, including as a result of any previous cybersecurity incident, that has materially adversely affected our business strategy, results of operations or financial condition, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner. For more information on risks to us from cybersecurity threats, see Part I, "Item 1A—Risk Factors—Risks Related to Information Technology Systems."


text: Our Chief Information Security & Trust Officer ("CISO") leads our cybersecurity program across the Company and oversees the ISMS. He is supported by our Information Security team, which includes the first responders to cybersecurity incidents. Our CISO provides quarterly updates to the Audit and Risk Committee, as well as an annual report to the Board, regarding the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies, while maintaining the confidentiality, integrity, and availability of information, including user information under our custody. There are also scheduled monthly meetings where, among others, our CISO, Head of Privacy and a representative of the Sponsor attend, in order to discuss our cybersecurity program, including evaluating the implementation of additional controls, processes, policies, and procedures, as appropriate, as well as any notable security incidents, if any. Our CISO joined the Company in April 2024, and has over 20 years of experience in the field of cybersecurity.


text: Risk Management and Strategy The Company continuously seeks to identify threats, vulnerabilities, and cybersecurity risks on information assets. Threats are identified through experience, regulatory alerts, information sharing, third party vendors, internal and external security assessments, and industry periodicals.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Training and Awareness The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. All employees with network access participate annually in required training, including spear phishing and other awareness training. The Company also periodically conducts walkthrough exercises with management and other employees to practice cyber incident response.


text: As of December 31, 2024, the Fund is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Fund's business strategy, results of operations, or financial condition.

companyName: BlackRock Private Credit Fund


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Therefore, we rely on the cybersecurity strategy, expertise and policies provided and implemented by 26North, the indirect parent company of our Adviser and affiliate of our Administrator, as well as other service providers.

companyName: 26North BDC, Inc.


text: Each of the Company, 26North and our industry generally is highly dependent on information systems and technology and as a result, could be prone to cybersecurity threats and attacks. In response, 26North maintains a cybersecurity program that includes policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated.


text: As part of its overall risk management efforts, 26North has developed and implemented a cybersecurity risk management program (the "RMP") that applies to our business and operations. The RMP is designed to protect the confidentiality, integrity and availability of the critical systems involved in our business and the information stored in those systems. The RMP leverages a combination of standards and best practices from the National Institute of Standards and Technology Cybersecurity Framework, the International Organization for Standardization, and the Center for Internet Security, among others.


text: 26North utilizes technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, including from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. In addition, 26North has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats. Such controls help us and 26North protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.


text: 26North conducts annual cybersecurity awareness training for all employees and conducts quarterly phishing exercises to assess employee cybersecurity awareness. 26North also performs tabletop exercises and disaster recovery tests to simulate a response to a cybersecurity incident, and uses the findings therefrom to improve practices, procedures, and technologies. 26North also assesses the risks from cybersecurity threats that impact our third-party service providers and has established oversight processes to identify and manage cybersecurity risks associated with the products or services we or 26North procure from such suppliers.


text: An independent third-party also assesses and reports on 26North's internal incident response preparedness, adherence to best practices and industry frameworks, and compliance with applicable laws and regulations. The external independent third-party helps identify areas for continued focus and improvement. Finally, 26North carries cyber security insurance that provides a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: 26North has also developed an incident response plan that provides guidelines for preparing for, responding to and recovering from cybersecurity incidents, and facilitates coordination across multiple operational functions. The incident response plan includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan includes notification to the applicable members of 26North's technology leadership team, including 26North's General Counsel ("GC") and Chief Technology Officer ("CTO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the Risk Committee (as defined below) or the board of directors of 26North, as well as to our Chief Compliance Officer, the Audit Committee of our Board of Directors and to our full Board of Directors, if appropriate.


text: Since our commencement of operations, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Past or future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report.


text: Our Board of Directors has overall responsibility for risk oversight and has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The leadership team at 26North has delegated oversight of cybersecurity and related risks to a committee (the "Risk Committee"). The Risk Committee is a cross-functional committee that governs and oversees the RMP. The Risk Committee includes members of 26North's senior executive team, including its CFO, CTO, Chief Compliance Officer and senior partners from 26North's legal, operations, finance, investment and strategy teams. The Risk Committee, will, through regular consultation with 26North's internal cybersecurity team assess, discuss, and prioritize the approach to high-level risks, mitigative controls, and ongoing cybersecurity efforts. Further, our Chief Compliance Officer works closely with 26North's CTO to monitor ongoing cybersecurity threats and provide regular updates to our Board of Directors.


text: 26North's CTO regularly updates the full Risk Committee and oversees a team of dedicated professionals responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The CTO has a Bachelor of Science in Computer Engineering from the University of Virginia and 25 years of experience leading technology teams, maintaining IT infrastructure within financial services firms, and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures to mitigate these threats.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented and utilize a risk-based approach that incorporates various information security processes designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity and availability of information technology systems and the data residing therein. The critical data contained on our information systems include intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive, personal information that we collect, use, store and transmit digitally in the ordinary course of our business. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to monitor and evaluate our threat environment, prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our cybersecurity program is informed by certain industry standards and best practices as outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We use email security tools, managed detection and response, third party managed security services, regular vulnerability scans and threat intelligence feeds. We also have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We assess third-party service providers with a cyber security questionnaire and a follow up meeting or audit based upon the risk profile of the third party with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices intended to be consistent with applicable legal standards and industry best practices.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To mitigate the aforementioned consequences of cybersecurity incidents, we carry cyber attack insurance. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Senior Vice President of Information Technology, a certified CISSP, who reports directly to the Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which comprises solely independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Information Technology. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Our information security function, which is led by our Vice President of Information Technology, or VP of IT, helps identify, assess and manage our cybersecurity threats and risks. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example: cybersecurity consultants, managed cybersecurity service providers, and professional service firms, including legal counsel, forensic investigators, and penetration testing service providers.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor and impose contractual obligations related to cybersecurity on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has over 25 years of experience in information technology including IT leadership in Department of Defense Research. Our VP of IT who reports to our Chief Financial Officer, or CFO, who has 23 years of experience as a CFO, including supervisory responsibility over IT and cybersecurity functions.


text: Our board of directors' audit committee receives annual reports from our CFO concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Management of Cybersecurity Risks and Cybersecurity Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: Key elements of our cybersecurity program includes but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • ad hoc internal review of the cybersecurity practices of key service providers, suppliers, and vendors who have access to our critical systems and information based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those used by our third party research institution collaborators, CROs, CMOs, or other contractors or consultants, may fail or suffer cyberattacks or security breaches."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity program.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Senior Director of Infrastructure and Cybersecurity, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our Senior Director of Infrastructure and Cybersecurity (20 years of cybersecurity risk management experience) and Chief Information Officer (five years of cybersecurity risk management experience), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes demonstrated expertise in cybersecurity, life sciences, and security industry certifications such as Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP).


text: Our management team takes steps to stay informed about and monitor supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our VP of Information Technology, who reports to our General Counsel & Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: We engage third parties like a penetration testing firm and our managed service provider in connection with our risk assessment processes. These service providers assist us in identifying vulnerabilities to design and implement, suggesting remediation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Our VP of Information Technology, and our management committee on cybersecurity, which includes our audit committee, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The VP of Information Technology has twenty years of experience in IT on-premise and cloud infrastructure, enterprise applications, and operations across large and mid-size life science companies with a focus on IT controls for compliance and security.


text: Our VP of Information Technology provides annual briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our VP of Information Technology or department designee provides annual briefings to the board of directors on cybersecurity risks and activities.


text: Our information security processes are designed to assess, identify and manage material risks from cybersecurity threats. In conducting our business activities, we are entrusted with confidential information from our clients, business partners and employees. Confidential information may include sensitive business, proprietary and technical information, as well as personal information. Our Information Security Management System ("ISMS"), based on ISO/IEC 27001, is an integral part of our overall enterprise risk management system, and serves as a framework for handling cybersecurity threats and incidents, including such threats and incidents associated with our use of services by information technology suppliers. The ISMS is operated by our Global Information Security team headed by our Global Chief Information Security Officer ("CISO"). We maintain physical, electronic and procedural safeguards designed to guard confidential and proprietary information contained within our information systems from loss, misuse, unauthorized access, disclosure, alteration or destruction. We have layered defenses designed to protect against intrusions that could affect the confidentiality, integrity and availability of information.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: We perform information technology supplier risk assessments on a periodic basis. Information technology suppliers to SS&C that access, handle, transmit, process or store personal information or other customer data on our behalf are assessed and are also subject to periodic due diligence procedures.


text: Our CISO is responsible for our overall information security strategy, policy, security engineering, operations, cybersecurity threat detection and response. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. Global Information Security team members provide regular reports to our CISO with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents, and otherwise aid our CISO in operating the ISMS. Global Information Security team members have relevant education, certifications, and industry experience.


text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operating results, cash flows or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - We face risks from cyber-attacks, breaches of digital security, IT system failures and network disruptions that could adversely affect our reputation and our business." for more information about these risks.


text: We face risks associated with security breaches through cyberattacks, cyberintrusions or otherwise, and other significant disruptions of information technology networks and related systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Risk Factors in Part I, Item 1A for a disclosure of our cybersecurity risks. We continue to monitor cybersecurity risks to prevent and mitigate materially negative impacts on the Company's reputation, financial performance, customer or vendor relationships and potential litigation or regulatory investigations or actions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: As part of its regular oversight of risk management, our audit committee is responsible for the oversight of cybersecurity risk and threat mitigation related to our information technology and information systems including protection and security of employee and customer data. Our Senior Vice President – Technology Solutions is responsible for the day-to-day management of our cybersecurity program and reports directly to our President. Our Senior Vice President – Technology Solutions has served in this role for over four years and has more than 25 years of experience in the aggregate, including more than ten years with the Company, in various information technology roles. Our audit committee is responsible for overseeing cybersecurity risks, and our management team reports to our audit committee on the Company's cybersecurity program, current cybersecurity projects and industry trends and efforts to mitigate cybersecurity risk on at least a semi-annual basis.


text: Cybersecurity Risk Management and Strategy We have designed and implemented a comprehensive program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed this program based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We monitor and regularly assess our cybersecurity risks and adjust our program accordingly.


text: We maintain a cybersecurity incident response plan which outlines our response and action in the event of a major cybersecurity incident. The cybersecurity incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to varying levels and personnel within the Company depending on the severity of the threat, effectively communicating to stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the Senior Vice President – Technology Solutions would, as soon as practicable, inform the Cybersecurity Incident Response Team, the members of which would then collaborate with the Senior Vice President – Technology Solutions to manage material risks.


text: We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary.


text: We contract with an independent cybersecurity provider to perform an annual cybersecurity risk and vulnerability assessment. We regularly test areas of potential vulnerability, utilizing penetration testing, ransomware-focused disaster recovery tests as well as testing exercises for other higher risk areas.


text: We conduct annual reviews of third-party hosted applications where sensitive Company data is shared. Additionally, cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.


text: We maintain cybersecurity risk insurance coverage; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Risk Management & Strategy Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers' and employees' information. Wesbanco's Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to enhance incident response capabilities, evaluate framework and compliance assessments, provide continuous monitoring, provide guidance on strategies, evaluate compliance with existing laws and regulations, design and implement cyber policies and procedures, and provide threat intelligence services.

companyName: WESBANCO INC

ticker: WSBC


text: As detailed in Item 1A "Risk Factors - Risks Related to the Use of Technology", third-party technology relationships pose a risk to the organization. As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco's sensitive information, systems or networks. This process is also intended to provide for the security and integrity of Wesbanco's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco's information assets and reducing the overall risk of cyber threats. Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization. The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.


text: Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization. The bank invests in continuing education of the security team and in technologies that help protect its systems and data. Required security awareness training is provided to all employees to ensure that corporate policies are understood and followed. The bank's cybersecurity strategy and roadmap are frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents. Incident Management and Response is led by a cross functional incident response team that handles critical incidents inclusive of cybersecurity incidents. In addition to handling critical incidents, the response team coordinates an annual tabletop exercise aimed at continually practicing documented incident response processes. These tabletop exercises include participation from executive leadership and periodically members of the board of directors. The Incident Response team is chaired by the Chief Security Officer and membership of the Incident Response team includes representation from Human Resources, Information Technology, Fraud and BSA, Corporate Communications, Risk Management, Investor Relations, Retail Banking, Compliance, Bank Operations, Legal Counsel, Customer Support, and Digital Banking and Payments.


text: Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Technology Governance Committee, a management level steering committee also receives periodic reports from the Chief Security Officer for security risk assessments, security program effectiveness evaluations, occurrence and response to cyber incidents, effectiveness of mitigation strategies, regulatory compliance, and external assessments and benchmarking. As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls.


text: The Enterprise Risk Management Committee is a board-level committee focusing on enterprise risk, including cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations. The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program, and has decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications. Several members of the Information Security team also hold multiple security certifications that tie directly to their job responsibilities. These certifications include, but are not limited to, ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), ISACA Certified Information Security Manager (CISM), EC-Council Certified Ethical Hacker (CEH), CompTIA Security+, CompTIA CySA+, CompTIA CASP+, and CompTIA PenTest+.


text: While Wesbanco and its third-party providers have in the past experienced cybersecurity incidents, Wesbanco is not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect Wesbanco, including its business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Interruption to Our Information Systems or Breaches in Security Could Adversely Affect Wesbanco's Operations." for additional detail.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program is designed to assess, identify, and manage material risks from potential unauthorized breaches of or access to our electronic information systems, and the information we store on our systems. Our program includes a wide variety of mechanisms, controls, technologies, methods, systems and other processes as further described below that are designed to prevent, detect, or mitigate unauthorized access, data loss, theft, misuse or other security incidents and vulnerabilities affecting our systems and the information we store on our systems. The information we store includes confidential, proprietary, business, and personal information of ours, our customers, our employees and other third parties that we collect, process, store and transmit as part of our business. Our program is aligned with the National Institute for Standards and Technology Risk Management Framework (NIST RMF), other industry-recognized standards and our contractual requirements. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds and other similar resources to inform and guide our cybersecurity processes and resource allocation. Additionally, we use processes and third-party technologies to oversee and minimize impact to our data, including two-factor authentication, encryption, Company secured email and dedicated cybersecurity support personnel.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: As part of our risk management process, our cybersecurity risk management team oversees our vulnerability management practices and conducts routine application security assessments, yearly penetration testing, periodic security audits and ongoing risk assessments designed to identify cybersecurity risks to our environment. We continue to leverage third-party services for security operations through a dedicated managed security service provider to monitor and respond to cyber threats. This provider plays a critical role in, mitigating threats to our environment, as well as alerting and responding to events and incidents in close coordination with our internal team. For example, this provider performs searches across live and historical data to provide analysis based on threat intelligence and use cases to develop trends and data models to reduce false positives and enhance search criteria for future use. In addition to our routine practices, we also conduct testing, audits and assessments in connection with acquisitions, the implementation of new software, processes or activities requiring changes in our information technology environment, new cybersecurity events or developments and receipt of new risk intelligence. Further, we have adopted an enterprise-wide cybersecurity training and awareness program requiring all employees to complete annual cybersecurity training. The program is supported with monthly education and simulations with remedial training assignments to increase user awareness.


text: We maintain an incident response plan (IRP) aligned with NIST RMF when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, key stakeholders, and senior management, including our General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying, and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.


text: As of December 31, 2024, we were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity and Data Privacy Oversight Montrose maintains a dedicated cybersecurity team, led by our CISO and reporting to our CIO. Our CIO has deep expertise in cybersecurity and data management, as well as technical strategy and infrastructure, as part of his over 20 years of experience serving in this and similar roles across multiple organizations. Furthermore, our CISO is a Certified Information Security Manager (CISM) and brings over 25 years of experience in information technology, governance, compliance, and risk management.


text: The CISO is responsible for developing and deploying Montrose's overall cybersecurity and data privacy strategy, policies, procedures, and threat detection and response actions, with the support of Montrose's cybersecurity team. The cybersecurity team implements Montrose's cybersecurity and data privacy policies and procedures, including governance, compliance, and risk management practices, to safeguard Montrose's information systems and data. Collectively, the CISO and the cybersecurity team manage and evolve Montrose's cybersecurity posture with the objective of preventing cybersecurity incidents and increasing system resiliency to minimize business impact should an incident occur.


text: At the management level, Montrose's Enterprise Cybersecurity Council, consisting of our CIO, CISO, Director of Information Security, Director of Infrastructure, and senior security architects and engineers, meets monthly to review and assess cybersecurity risks and evaluate performance metrics to identify areas for continual improvement and system strengthening. Furthermore, the Council reviews project implementation status for targeted cybersecurity measures and tracks employee cybersecurity training completion and phishing email response rates. Council members have extensive cybersecurity experience and hold certifications including CISM, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH) and Cisco Certified Network Associate (CCNA).


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. The Audit Committee maintains delegated oversight of cybersecurity risks, bringing in third-party expertise as needed to advise on cybersecurity infrastructure, policies, and practices. Our CIO and CISO brief the Audit Committee quarterly, at a minimum, on Montrose's cybersecurity risks, business-impacting incidents, and ongoing and future cybersecurity project implementations. In addition, the Audit Committee's third-party cybersecurity advisor meets regularly with the CIO and CISO to review our cybersecurity strategy and our continued progress toward meeting our objectives. The full Board of Directors receives quarterly updates from the Audit Committee regarding its oversight of cybersecurity risks and is also periodically briefed on our cybersecurity risk management program directly by our CIO and CISO.


text: In accordance with our Incident Response Plan, in the event of a potentially material cybersecurity event, the Audit Committee as well as our General Council, Chief Financial Officer, and CEO would be notified, briefed, and involved in oversight of mitigation, reporting, and recovery measures as appropriate.


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I. Item 1A. "Risk Factors—General Risks—Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity risks including oversight of management's implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee's oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Vice President of Information Technology and Security Officer, who reports to the Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President of Information Technology and Security Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Information Technology and Security Officer's experience includes 15 years of experience across digital and cyber defense, and has most recently led the cyber function for the last six years at two emerging biotechnology companies.


text: Our management team takes efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for advising on our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Annexon, Inc.

ticker: ANNX


text: Our cybersecurity risk assessment and risk management processes are managed by certain members of our management, including our CFO (who has prior experience in strategic business operations). Our CFO has supervisory responsibility over IT and cybersecurity functions. Our management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, helping prepare for and respond to cybersecurity incidents, and reviewing security assessments and other security-related reports. Our incident response team is responsible for remediating cybersecurity incidents of which they are notified.


text: We maintain a cybersecurity policy, reviewed with our audit committee, which is designed to address cybersecurity risks to us (including by escalating certain cybersecurity incidents to members of management and the board of the audit committee, in each case depending on the circumstances). We also maintain incident response procedures designed to assist us in responding to cybersecurity incidents.


text: We recognize the critical importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), has day-to-day responsibility for our cybersecurity programs. Given the significant risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

companyName: Repay Holdings Corp

ticker: RPAY


text: Risk Identification and Assessment We employ structured processes and procedures to identify and assess cybersecurity risks and events. Our CISO oversees a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.


text: Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the "SIRP") that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business. During the past year, we conducted a tabletop exercise with our executive management team that simulated a cybersecurity incident to evaluate the effectiveness of our SIRP, identify potential improvements and enhance our incident response readiness.


text: Employee and contractor compliance is bolstered by hiring, onboarding and termination procedures that are designed to align with cybersecurity objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.


text: We utilize a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. Our systems include third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. These firms also provide educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER


text: We design and assess our program based on recommendations from trusted sources, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2024, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.