text: Employee Training and Awareness: We conduct regular cybersecurity training and awareness programs for employees at all levels to ensure they understand and follow best practices in identifying and reporting potential cyber threats, including phishing attacks and social engineering tactics.


text: Third-Party Risk Management: We assess the cybersecurity practices of third-party vendors and partners, particularly those with access to sensitive information or critical systems and require them to adhere to security standards that align with our own policies.

companyName: First Savings Financial Group, Inc.

ticker: FSFG

secItem: Item 1C


text: Incident Response: We have a detailed Incident Response Plan that outlines how we would respond to an actual or potential cybersecurity incident. The plan includes the appropriate notification and escalation requirements including timely reporting to our CEO and Board of Directors and engagement of appropriate third parties such as insurance providers and incident response professionals.


text: Resilience and Recovery: We have developed and regularly test our business continuity and disaster recovery plans to ensure a swift recovery in the event of a cybersecurity incident. This includes regular backups, redundant systems, and an established communication protocol.


text: Ongoing Efforts and Improvements We continue to enhance our cybersecurity posture by investing in the latest technologies and partnering with leading cybersecurity experts. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats. Our Information Security Officer has extensive bank operations experience, has attained Certified Information Security Manager certification with the Information Systems Audit and Control Association, and attends relevant cybersecurity training sessions on a regular basis. Our CIO brings over 25 years of extensive experience in the banking industry, encompassing a diverse range of expertise, including software development, managed services and support, independent consulting, penetration testing, and bank management. This multifaceted background equips them with a unique perspective and deep understanding of both the technical and operational aspects of the financial sector. We remain committed to continually improving our cybersecurity infrastructure and to monitoring for new and evolving threats.


text: Risk Management and Strategy The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for the Board of Directors (the "Board"), through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework. The Cybersecurity Program is developed and reviewed by the Company's executive leadership alongside the Company's Audit Committee and carried out and overseen by the senior person in charge of IT at the Company, currently our Chief Compliance Officer ("CCO").

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board through its Audit Committee.


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We continuously monitor threats and unauthorized access to our information security network.


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.


text: We review our cybersecurity risk framework and related policies annually with our senior management to help identify areas for continued focus and improvement. We also engage third parties to review and assess our processes annually.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. discussing issues to be addressed and recommending securities measures to be improved where possible. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Although in the last three fiscal years we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including financial losses, penalties, and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, may materially affect or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled " Quipt's business depends on its information systems, including software licensed from or hosted by third parties, and any failure or significant disruption or effective cyber-attack on any of these systems, security breaches or improper disclosure of or loss of data could materially affect our business, results of operations and financial condition. " and " Quipt currently outsources, and from time to time in the future may outsource, a portion of its internal business functions to third-party providers, which has significant risks, and Quipt's failure to manage these risks successfully could materially adversely affect its business, results of operations, and financial condition." in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Role of the Board of Directors and the Audit Committee As part of the Board's role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management Our CCO is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CCO works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: In the event of a material cybersecurity incident or investigation, management will, in compliance with escalation protocols in place, promptly report to the Audit Committee and the Board, as appropriate, in accordance with the Company's incident response plan, and other policies and determine the timing of action, and necessary response.


text: Our CCO has over 20 years of experience in various roles in information technology and information security. He holds a degree in Legal Studies and holds several relevant certifications, including Certified HIPAA Professional ("CHP").


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that generally aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage these material risks, safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners, and employees.

companyName: Energy Services of America CORP

ticker: ESOA


text: Risk Management and Strategy The Board of Directors is actively involved in oversight of the Company's risk management framework. The Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity awareness. This integration ensures cybersecurity considerations are an integral part of decision-making processes across the organization.


text: The Company's risk management team collaborates closely with its internal IT team to evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures to ensure the prompt escalation of cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive timely and appropriate information.


text: Given the complexity and evolving nature of cybersecurity threats, the Company engages external experts, such as cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. These engagements include audits, threat assessments, and consultations on security enhancements. Such collaboration ensures the Company leverages specialized knowledge to maintain cybersecurity practices aligned with industry standards. Utilizes advanced technology solutions, such as proactive detection tools, to safeguard its assets and identify threats within its environment.


text: Conducts cyber education and awareness training sessions to equip employees with the necessary knowledge and foster a strong security culture. Analyzes internal and external cybersecurity incidents and threat intelligence to assess relevance to its environment and industry. Performs recovery testing to ensure the resilience of critical systems and support business continuity.


text: Implements stringent oversight of third-party service providers, including conducting security reviews before engagement and ongoing monitoring to ensure compliance with the Company's cybersecurity standards.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. As discussed below, members of management advise the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Chief Information Officer (" CIO "), Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and recommendations from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity. The Board conducts an annual review of the Company's cybersecurity posture and risk management strategies to identify areas for improvement and maintain alignment with the Company's overall risk management framework.


text: The Company's CIO has over 20 years of experience in the field of technology and security and is instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies. The internal IT team is responsible for the day-to-day implementation of the Company's cybersecurity risk management programs, testing compliance with standards, remediating known risks, and leading employee training programs. The team monitors the latest developments in cybersecurity, including potential threats and risk management techniques, to help prevent, detect, and mitigate cybersecurity incidents.


text: In the event of a cybersecurity incident, the IT team implements the Company's incident response plan to mitigate immediate impacts, implement remediation strategies, and prevent future incidents. The team also ensures that senior management is regularly informed about material cybersecurity risks and incidents to maintain alignment with organizational priorities.


text: As of September 30, 2025, the Company has not encountered cybersecurity incidents that the Company believes to have materially affected or are reasonably likely to materially affect the Company taken as a whole, including its business strategy, results of operations or financial condition.


text: Cybersecurity is an integral part of our overall risk management efforts and is integrated with John Deere's overall risk management framework. We take a comprehensive approach by incorporating industry best practices to guide and evaluate our cybersecurity strategy and posture, involving key stakeholders in oversight and decision making, and assessing the program regularly within a dynamically changing environment. We leverage a multifaceted approach to cybersecurity including measures designed to prevent, detect, and respond to cyberthreats while monitoring and adapting to the evolving threat and technology landscapes.

companyName: DEERE JOHN CAPITAL CORP


text: At the management level, John Deere and we jointly maintain a dedicated global team of cybersecurity professionals (Cybersecurity Team) led and managed by John Deere's Chief Information Security Officer (CISO). The Cybersecurity Team is responsible for overseeing John Deere's and our cybersecurity program, including the assessment and management of risks. The Cybersecurity Team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing, and cyber incident management. John Deere's CISO holds a degree in Management Information Systems and has been with John Deere for over ten years. He has over two decades of extensive experience in information technology and cybersecurity and reports directly to John Deere's Chief Information Officer.


text: In addition, a cross-functional team of senior executives from across the John Deere enterprise known as the Digital Risk Governance Council (DRGC) provides oversight at the management level of our and John Deere's structures for managing digital risk, including the Cybersecurity Team. The Audit Review Committee (ARC) of the Deere & Company Board of Directors (Board) shares oversight responsibilities of our cybersecurity program, including oversight of related risks, with the full Board. Information on trends, strategic initiatives, and metrics is presented quarterly to the ARC by the CISO and/or members of the Cybersecurity Team. The ARC also receives periodic updates and information from subject matter experts in areas such as risk management, identity and access management, product security, and information technology.


text: Risk Management and Strategy Our and John Deere's cybersecurity program is designed to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents with the goal of protecting the confidentiality, integrity, and availability of our critical systems and information. We use a risk-based, multi-layered information security strategy to assess, identify, and manage risks from cybersecurity threats. The Cybersecurity Team meets frequently to monitor, assess, and address cybersecurity threats and incidents. John Deere and we also work with third parties to assess the maturity of our cybersecurity program, leveraging the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).


text: We also utilize third-party service providers as a normal part of our business operations. We have established processes to support us in identifying and managing cybersecurity risks associated with the use of third parties, which include the completion of due diligence before engaging with a third-party, controls for response to mitigate any significant risks, and assessments and reviews throughout the relationship. Monitoring such risks and threats is integrated into our overall risk management program.


text: Also, as part of the program, we periodically conduct cybersecurity awareness training including phishing simulations as well as e-learning for employees. We maintain cybersecurity policies, standards, and procedures, which include a cyber incident response plan. These policies and procedures are regularly evaluated and refined with strategies and protocols designed to adapt to changing regulations and emerging security risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities and improve decision-making, prioritization, monitoring, and overall response effectiveness. As part of our incident response plan, the Cybersecurity Team uses an established protocol to assess the severity of cybersecurity incidents. In addition, a cross-functional Cybersecurity Incident Response Team is responsible for cybersecurity incident oversight and response, as needed, depending on incident severity. Our cyber incident response plan also includes an escalation process to relevant senior management and/or members of the Board if a cybersecurity incident meets specific rating criteria to prompt response to attempt to minimize potential disruptions and protect the integrity of our operations.


text: Based on the information available as of the date of this Annual Report on Form 10-K, cybersecurity risks, including as a result of any previous cybersecurity incident, have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we have seen an increase in cyberattack volume, frequency, and sophistication in the digital environment and future incidents could have a material impact on our business, operations, or financial condition.


text: Cybersecurity Risk Management and Strategy The Company regards information and data as valuable assets. As a result, we have implemented safeguards to protect corporate informational and data assets. Associated and established technology resources maintain the integrity, availability, and privacy of confidential information of the respective assets. Additionally, we maintain a similar risk-based approach to our third-party vendors including identifying and overseeing cybersecurity risks they present.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Integration into Overall Risk Management System The Company employs comprehensive methodologies for risk assessment and diligently identifies and evaluates potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks.


text: The Company continues to expand investments in information technology security, including continuous end-user training, layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting.


text: The Company's Information Technology Technician (the "IT Technician") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the board of directors, in collaboration with relevant information technology personnel, insurance providers, legal counsel and, when necessary, external cybersecurity firms specializing in forensic investigations.


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Training sessions are held regularly at the senior and executive management levels to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended September 30, 2025. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: Cybersecurity Governance The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has oversight responsibilities to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.


text: Board of Directors Oversight The board of directors is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.


text: Management's Role in Managing Risk The IT Technician plays a pivotal role in informing the board of directors on cybersecurity risks. The IT Technician and members of senior management meet regularly and provide comprehensive briefings to the board of directors. These briefings encompass a broad range of topics, including: the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies;


text: incident reports and issued identified from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our regularly scheduled board meetings, the IT Technician regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the board, ensures the board's oversight is proactive and responsive. The board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cyber Risk Management Personnel The IT Technician directly reports to senior management. The IT Technician regularly meets with senior management to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the board of directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with senior management, supported by the Company's IT Technician. The IT Technician, who has prior experience in the banking industry, works with senior management to implement and maintain processes designed to protect the Company's information systems and data. This collaborative approach helps ensure that our cybersecurity strategies are aligned with the Company's overall risk management framework.


text: Monitoring Cybersecurity Incidents The IT Technician and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Technician provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.


text: We are a special purpose acquisition company with no business operations and therefore, prior to the completion of a business combination, do not have any operations of our own that face cybersecurity threats. Since our initial public offering, our sole business activity has been identifying and evaluating suitable targets for a business combination. Therefore, the Company does not consider itself subject to significant cybersecurity risk and has not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing the Company's risk management activities in general and will be informed, promptly and as deemed necessary by our management team, of any cybersecurity threats or risks that may arise, cyber incidents and industry trends, including regarding the appropriate disclosure, mitigation, or other response or actions that our board deems appropriate to take. As of the date of this Report, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy and results of operations. However, any such attack could adversely affect our business. We depend on the digital technologies of third parties and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. A penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss. " in " Item 1A. Risk Factors—General Risk Factors. "

companyName: Rithm Acquisition Corp.

ticker: RAC


text: Risk management and strategy We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurirty risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the board as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant enviornements. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Executive VP and Chief Financial Officer evaluates material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Director of Information Technology, under the supervision of our Executive VP and Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Director of Information Technology is responsible for informing our Executive VP and Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Executive VP and Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Executive VP and Chief Financial Officer.


text: The Company operates in blockchain and digital asset technology sector and the biotechnology sector, which are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including the loss or theft of private keys or breaches of our digital wallets; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We conduct periodic risk assessments using various tools and methodologies to identify and manage the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests, and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: BNB PLUS CORP.

ticker: BNBX


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.


text: Our Chief Executive Officer ( "CEO") conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third party providers. All employees and consultants are directed to report to senior management with any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards. These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: Management reviews the Company's IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; and (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and its other assets or assets of its customers or other third parties in the Company's possession or custody.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected it or are reasonably likely to materially affect it, including its operations, business strategy, results of operations, or financial condition.


text: The Company 's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have established an Information Security Management System ("ISMS") comprised of policies, procedures, and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall enterprise risk management systems and processes. Our ISMS is aligned to generally accepted security standards and is certified by third-party auditors according to ISO/IEC 27001 standards. We routinely assess cybersecurity risks for materiality, including assessing any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: QUALYS, INC.

ticker: QLYS


text: We routinely conduct risk assessments to identify cybersecurity threats and weaknesses, as well as risk assessments of events that could potentially materially change our business practices and affect our information systems that could be impacted by cybersecurity threats and vulnerabilities. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.


text: We have established a Computer Security Incident Response Team ("CSIRT") that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology ("NIST"), Federal Risk and Authorization Management Program ("FedRAMP"), International Organization for Standardization ("ISO"), and Federal Information Security Management Act ("FISMA"). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.


text: Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Qualys' 24x7 Security Operations Center ("QSOC") and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios. This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan. The QSOC and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects. Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.


text: We routinely evaluate the risks posed by third-party providers and engage with those whom fail to comply with our relevant contract requirements, or when we feel further action is needed to keep our risk levels within approved tolerance levels.


text: We engage assessors, consultants, auditors, and other third parties in order to obtain external validation for effectiveness and adequacy of our security posture in compliance with regulatory requirements. These service providers attest to our organization-wide design and implementation of cybersecurity policies and procedures, and annually monitor such policies and procedures from a safety perspective.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our platform, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales." We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.


text: Our board of directors, with assistance from management, monitors and assesses strategic risk exposure, and our management team is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit and Risk Committee of our board of directors ("Audit and Risk Committee").


text: Our CISO and our Security Steering Committee, which includes members from management across all company functions such as security, IT, human resources, sales and marketing, engineering, legal, and finance, are primarily responsible for assessing and managing cybersecurity threats. Our CISO is a cybersecurity industry expert with over two decades of experience in cybersecurity, including work at multi-national technology companies and for a U.S. state government. He holds several industry certifications including CISSP, OSCP, CCSP, and GCFA and is also a graduate of the Carnegie Mellon University's Chief Information Security Officer Executive Program. Our CEO is also a cybersecurity industry expert who has deep insight and over two decades of experience in cybersecurity, technology and information security.


text: Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.


text: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape. Our Audit and Risk Committee provides regular updates to the board of directors on such reports. In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities. Management is committed to notifying the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.


text: We have established a Computer Security Incident Response Team ("CSIRT") that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The CSIRT is responsible for identifying, managing, and responding to security incidents against Qualys' infrastructure and corporate IT systems. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology ("NIST"), Federal Risk and Authorization Management Program ("FedRAMP"), International Organization for Standardization ("ISO"), and Federal Information Security Management Act ("FISMA"). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.


text: Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Qualys' 24x7 Cybersecurity Fusion Center and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios. This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan. The Cybersecurity Fusion Center and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects. Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.


text: We have also established a Product Security Incident Response Team ("PSIRT") that identifies, assesses, and responds to security incidents, risks, and vulnerabilities associated with Qualys' commercial products. The Qualys PSIRT investigates vulnerabilities and incidents across the entire Qualys product portfolio. PSIRT coordinates product impact assessments and fixes based on industry standards such as the Common Vulnerabilities and Exposure ("CVE") and Common Vulnerability Scoring System ("CVSS"). PSIRT operates in alignment with relevant requirements and industry standards and coordinates its activities with the CSIRT.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales." We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.


text: Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT and PSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.


text: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape. Our Audit and Risk Committee provides regular updates to the board of directors on such reports. In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities. Management is required to notify the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.


text: The Company maintains a robust Information Security Program that sets forth the Company's commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing, and protecting sensitive information including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA). The Company uses or adheres to relevant standards and frameworks from the Federal Financial Institutions Examination Council (FFIEC) and National Institute of Standards and Technology (NIST), among others, to assess information security risks and controls, as well as to assess the maturity and effectiveness of the Information Security Program.

companyName: Beacon Financial Corp

ticker: BBT


text: The Board of Directors and Executive Management are responsible for ensuring that the Information Security Program within Enterprise Risk Management identifies, measures, monitors, controls, and reports risk according to significance. If risks are determined to be undesired and beyond stated and aggregated Risk Appetites, the Board of Directors and Executive Management take appropriate action to ensure that excessive risk is mitigated or eliminated, which may include reducing risk exposure. The Board of Directors has final responsibility, after consultation with management, for ensuring the Information Security Program aligns with the overall business strategy and provides oversight to protect the Company from ongoing and emerging threats, including those related to cybersecurity.


text: The Information Security Program is overseen by the Company's Chief Information Security Officer (CISO), who reports directly to the Chief Risk Officer. The CISO is responsible for the implementation, maintenance, and enforcement of the Information Security Program and related policies and standards. The program is evaluated and adjusted at least annually based on the results of testing, monitoring, and the adoption of best practices. Reporting occurs annually on the status of the Information Security Program to the Board's Risk Management, Capital & Compliance Committee. Reporting includes the overall status of the program, material matters related to the program, Key Risk Indicators ("KRIs"), cyber risk assessments results, emerging risks, risk management and control decisions, control testing results, third party security assessments, penetration test results, security breaches or violations, and recommendations for changes to the program.


text: The Company maintains a robust Third-Party Risk Management program to manage risks related to third-party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments to ensure sensitive information is safeguarded appropriately.


text: The Company has a dedicated internal Security Operations Center ("SOC") and a Managed Detection and Response ("MDR") third party service that provides 24/7/365 monitoring of its environment to investigate and respond to security alerts. Log sources are mapped to the MITRE ATT&CK framework to ensure appropriate security monitoring and gap analysis to detect and respond to attacks. Threat intelligence is used with contextual risk approaches to identify threats and prioritize response. Threat hunts operate both proactively and reactively to look for relevant behaviors and indicators of compromise from cybersecurity events or zero-day vulnerabilities. An Incident Response Plan is in place to ensure the timely and effective handing of security incidents. This includes providing the Company with a detailed outline of how to respond to a security incident, team responsibilities, contact information for key resources, definitions for determining the severity and escalation of security incidents, and pre-built playbooks to respond to the most common types of security incidents including ransomware. Incident response and escalation plans are tested and reviewed for improvements at least annually. An incident response retainer with an approved third party is contracted to assist in responding to security incidents and to conduct forensic investigations involving the potential compromise of sensitive data or information assets. All employees are required to complete privacy and information security awareness training upon joining the Company and on an annual basis. This includes incident response training on how to communicate potential or actual incidents.


text: The Company continues to face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, or reputation. Although such risks have not materially affected us, we have experienced threats to and breaches of our data, including breaches caused by human error or breaches affecting third parties of the Company. For more information about the cybersecurity risks we face, see Item 1A-RISK FACTORS.


text: The Information Security Program is overseen by the Company's Information Security Officer ("ISO"), who reports directly to the Chief Risk Officer. The ISO has held this position with the Company since May, 2024, and has worked at the Company in cybersecurity for almost 12 years and in the information technology industry for more than 16 years. The Chief Risk Officer has held the position at the Company since October 2016, when he joined the Company from the FDIC where he was employed for 24 years and held multiple positions including Senior Risk Examiner for the Division of Risk Management Supervision and Acting Regional Manager for the Division of Insurance and Research. During his tenure with the FDIC, the CRO served from time to time as the Examiner-in-Charge for Berkshire Bank and numerous other banks throughout New England. The ISO is responsible for the implementation, maintenance, and enforcement of the Information Security Program and related policies and standards. The program is evaluated and adjusted at least annually based on the results of testing, monitoring, and the adoption of best practices. Reporting occurs annually on the status of the Information Security Program to the Board's Risk Management, Capital & Compliance Committee. Reporting includes the overall status of the program, material matters related to the program, Key Risk Indicators ("KRIs"), cyber risk assessments results, emerging risks, risk management and control decisions, control testing results, third party security assessments, penetration test results, security breaches or violations, and recommendations for changes to the program.


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, to enhance our cybersecurity oversight.

companyName: CURIS INC

ticker: CRIS


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: In an effort to deter and detect cyber threats, we annually provide all employees with cybersecurity and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management, including our head of information technology, regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have material affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards. Our head of information technology, who has 25 years of information technology management experience, reports to our chief financial officer, oversees and manages the day-to-day functions of our cybersecurity risks, and works with an incident response team to evaluate security and privacy incidents and the implementation of appropriate actions.


text: In an effort to deter and detect cyber threats, we annually provide all employees with cybersecurity and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: As a global leader in CRM technology, our services involve the storage and transmission of our customers' and our customers' customers' data. As such, we have in the past been, and likely will in the future be, the target of cybersecurity threats and other efforts to breach or compromise our services and underlying infrastructure. With trust as our foremost value and the foundation of everything we do, we recognize the importance of maintaining the safety and security of our systems and data, as our customers trust our technology to deliver the highest levels of security, privacy, performance, compliance and availability at scale.

companyName: Salesforce, Inc.

ticker: CRM


text: Management is responsible for the day-to-day administration of the Company's cybersecurity policies, processes, practices and risk management. The Board, including through its dedicated Cybersecurity and Privacy committee (the "Committee"), oversees the various cybersecurity risks facing the Company and the Company's efforts to mitigate those risks.


text: During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy When a company purchases our service offerings, they gain a trusted digital advisor who will work together with them in efforts to protect customer data. We aim to provide the most secure and compliant enterprise cloud platform on the market and we work to build trust and in-depth defense into all of our systems. Among other things, we employ a diverse, experienced team of cybersecurity professionals, engage in community events and offer free online cybersecurity incident prevention training to enable our customers to focus on their business, knowing their data is safe and accessible as needed.


text: We seek to address material cybersecurity risks through a company-wide approach that assesses, ranks and prioritizes cybersecurity threats, vulnerabilities and issues as they are identified to maintain the confidentiality, integrity and availability of our information systems and the information that we collect and store. The Company's cybersecurity policies, standards, processes and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including SOC 1, SOC 2, SOC 3, ISO 27001, 27017 and 27018, CSA STAR and others.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also publishes attestations of its various certifications, audits, and penetration tests on its global compliance webpage.


text: Board Oversight and Governance As mentioned above, the Board established the Committee to provide dedicated oversight of cybersecurity-related management, strategy, initiatives, risks, threats and remediation activities. The Committee receives regular presentations, reports and updates from the Company's Chief Trust Officer ("CTrO") and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics. After each quarterly meeting of the Committee, the Board receives a report from the Chair of the Committee with an update on the Company's oversight of cybersecurity risks and mitigation efforts. The Committee also receives periodic reports from an experienced outside consultant with information security expertise providing insights on key focus areas to aid in the Committee's oversight of the Company's cybersecurity program.


text: The Company's processes also allow for the Board and the Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Committee are scheduled on a quarterly cadence, the Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the Committee. The Company's policy is for the Board and the Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: Management Oversight and Governance The CTrO, reporting to the Company's Chief Engineering Officer ("C/E"), is responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management. The CTrO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 15 years, including serving as the Chief Security Officer of two other large public technology companies. He also holds an undergraduate and master's degree in computer science. We believe the Company's business leaders, including our CEO, CFO, C/E and CLO, who have experience managing cybersecurity risk at the Company and at similar companies, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CTrO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CTrO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Committee and Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems we control from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including the public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company maintains several plans designed to prepare the Salesforce Security Response Center (SSRC) with the proper training, processes and capabilities needed to effectively respond to incidents.


text: As a global leader in CRM technology, our services involve the storage and transmission of our customers' and our customers' customers' data. As such, we have in the past been, and likely will in the future be, the target of cybersecurity threats and other efforts to breach or compromise our services and underlying infrastructure. With trust as our foremost value and the foundation of everything we do, we recognize the importance of maintaining the safety and security of our systems and data.


text: During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Items 1A-C, "Risk Factors."


text: Cybersecurity Risk Management and Strategy When a company purchases our service offerings, they gain a trusted digital advisor who will work together with them in their efforts to protect their data. We aim to provide a secure and compliant enterprise cloud platform and we work to build trust and in-depth defense into all of our systems. Among other things, we employ an experienced team of cybersecurity professionals, engage in community events and offer free online cybersecurity incident prevention training to help enable our customers to focus on their business, knowing their data is safe and accessible as needed.


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results and evolving industry practices. The Company also publishes attestations of its various certifications, audits, and penetration tests on its global compliance webpage.


text: The Company's processes also allow for the Board and the Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Committee are scheduled on a quarterly cadence, the Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the Committee. In between meetings, the Board and the Committee receive information regarding relevant cybersecurity risks (including cybersecurity incidents) that meet pre-established reporting thresholds, as well as ongoing updates regarding any such risks.


text: Management Oversight and Governance The CTrO, reporting to the Company's Chief Engineering & Customer Success Officer ("C/E"), is responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management. The CTrO has extensive experience in the management of cybersecurity risk programs, having served in various leadership roles in information technology and information security for over 15 years, including serving as the Chief Security Officer of two other large public technology companies. He also holds an undergraduate and master's degree in computer science. We believe the Company's business leaders, including our CEO, CFO, C/E and CLO, who have experience managing cybersecurity risk at the Company and at similar companies, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: The CTrO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to help protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CTrO and senior management are able to be informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Committee and Board, as appropriate, based on the severity level of a cybersecurity incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks and incidents to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems we control from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including the public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize cybersecurity incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company maintains several plans designed to prepare the Salesforce Security Response Center (SSRC) with the proper training, processes and capabilities needed to effectively respond to incidents.


text: Risk management and strategy Cybersecurity risk for all Registrants is managed at the enterprise-level. Management of material risks from cybersecurity threats is integrated into the Registrants' overall risk management processes and is monitored as an enterprise risk. Exelon's Chief Information Security Officer (CISO) and cybersecurity management team regularly hold meetings with senior management of each Registrant, facilitated by Exelon's enterprise risk management team, to discuss issues pertaining to cybersecurity risk management, including changes in the nature and origin of threats, threat actor and risk mitigation activities, and regulatory developments. Exelon Legal and compliance professionals engage with the CISO and cybersecurity management team to address tactical and strategic cybersecurity risks. Exelon monitors cybersecurity risks through key risk indicators to identify potential changes in risk exposure and provide the Board of Directors with information about the monitoring of key risks in connection with its oversight of the Registrants' enterprise risk management system.

companyName: EXELON CORP

ticker: EXC


text: The CISO, through Exelon's Cyber Information and Security Services (CISS), reviews external and internal sources to obtain cyber threat intelligence to develop strategic and tactical threat assessments that inform the enterprise-wide cyber risk mitigation programs and actions. Exelon uses a wide range of tools, including endpoint, anomaly and network detection, logging and monitoring of security events, network segmentation, firewalls, hardening and securing devices, cyber vulnerability detection and patch management, cyber threat hunting, malware forensic analysis, industry-specific reports, and tabletop exercises to inform the cybersecurity management team. Exelon protects assets critical to grid reliability and national security through the implementation of the North American Electric Reliability Corporation's Critical Infrastructure Protection requirements, and gas pipeline security under the U.S. Department of Homeland Security's Transportation Safety Administration's Security Directives. Exelon maintains security relationships with law enforcement and U.S. intelligence agencies, coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC) and participates in the Department of Energy's Cybersecurity Risk Information Sharing Program (CRISP) to strengthen the security of the energy grid, develop and deploy new technologies, share information, design and participate in drills and exercises such as the bi-annual Grid Security Exercises and facilitate cross-sector coordination. Exelon applies stringent employee and contractor screening, and advances security awareness through training and monitoring programs that address both cyber and physical threats. Exelon employees are subject to annual mandatory training addressing security awareness, including cybersecurity and phishing. Exelon maintains cyber insurance coverage at limits consistent with the utility industry and reviews policy coverage and limits on an annual basis.


text: In assessing the effectiveness of its cybersecurity risk management program, the CISO makes use of external perspectives from regulatory compliance audits and inspections, external audits of the Registrants' financial systems, and third-party incident response and detection analytics. Cybersecurity risks associated with the Registrants' use of certain third-party service providers are evaluated and managed through CISS' Third Party Security team that leverages security risk assessments, contractual terms and conditions, and security awareness training for such providers. Additionally, those providers are required to report cybersecurity incidents, including the unauthorized use or disclosure of Registrants' confidential information to Exelon's security operations center. Third Party Security investigates certain third-party cybersecurity events as part of Exelon's incident response program.


text: The Exelon Board of Directors is responsible for oversight of risks from cybersecurity threats. As part of its responsibility and as documented in the 2022 Cybersecurity Oversight Policy, the Board of Directors oversees Exelon's cybersecurity program and Exelon's enterprise-wide risk related to cybersecurity, including management's identification, assessment, and mitigation of cybersecurity risks. At each regular quarterly meeting, the Board of Directors engages with the CISO and a cross-functional management team regarding the risks from cybersecurity threats. The CISO and professionals from the legal and compliance departments brief the Board of Directors on relevant topics, including information security and operational security, legislative and regulatory developments, and notable external cyber events relevant to Exelon and the industry more broadly. Management engages with the Board of Directors on risks from cybersecurity threats as appropriate outside of the quarterly meetings.


text: The CISO manages Exelon's enterprise-wide cybersecurity programs and reports to Exelon's Chief Information Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Exelon since 2018 and was named to the current role in 2022. The CISO has 25 years of information technology and cybersecurity experience in the critical infrastructure sector, of which 23 years have been in the utility industry. The CISO leads CISS, which manages centralized information technology and operational technology security programs for the Registrants. The programs are aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and integrate cyber asset identification; threat assessment; risk assessment; risk management; and risk monitoring. CISS operates a security operations center for monitoring, identifying, and mitigating potential cybersecurity events or incidents.


text: Exelon maintains a single, centralized cybersecurity incident response program and plan that aligns with NIST CSF by integrating the identify, determine/classify, escalate and respond functions (which track the lifecycle of an event or incident). Security threats and incidents are identified and assessed to determine potential impact and escalated to senior cybersecurity management and the CISO. The CISO directs the security incident response team to contain, eradicate, and recover from an active threat. Exelon leverages the expertise of dedicated incident response vendors that can provide timely and specialized support to respond and recover from an event. The CISO and a cross-functional team convene as needed to evaluate cybersecurity events, including third-party events. The legal and compliance departments provide incident response support to the CISO, manage cybersecurity-related legal and compliance issues, and direct materiality evaluations using both qualitative and quantitative factors for each Registrant.


text: Although the Registrants have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect each Registrant's business strategy, results of operations, or financial condition, as further discussed in the risk factor entitled "The Registrants are subject to physical and cybersecurity risks" in ITEM 1A. of this report.


text: The CISO, through Exelon's Cyber Information and Security Services (CISS), reviews external and internal sources to obtain cyber threat intelligence to develop strategic and tactical threat assessments that inform the enterprise-wide cyber risk mitigation programs and actions. Exelon uses a wide range of tools, including endpoint, anomaly and network detection, logging and monitoring of security events, network segmentation, firewalls, hardening and securing devices, cyber vulnerability detection and patch management, cyber threat hunting, malware forensic analysis, industry-specific reports, and tabletop exercises to inform the cybersecurity management team. Exelon protects assets critical to grid reliability and national security through the implementation of the North American Electric Reliability Corporation's Critical Infrastructure Protection requirements, and gas pipeline security under the U.S. Department of Homeland Security's Transportation Safety Administration's Security Directives. Exelon maintains security relationships with law enforcement and U.S. intelligence agencies, coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC) and participates in the Department of Energy's Cybersecurity Risk Information Sharing Program (CRISP) to strengthen the security of the energy grid, share information, design and participate in drills and exercises such as the bi-annual Grid Security Exercises and facilitate cross-sector coordination. Exelon applies stringent employee and contractor screening, and advances security awareness through training and monitoring programs that address both cyber and physical threats. Exelon employees are subject to annual mandatory training addressing security awareness, including cybersecurity and phishing. Exelon maintains cyber insurance coverage at limits consistent with the utility industry and reviews policy coverage and limits on an annual basis.


text: The Exelon Board of Directors is responsible for oversight of risks from cybersecurity threats. As part of its responsibility and as documented in the Cybersecurity Oversight Policy, the Board of Directors oversees Exelon's cybersecurity program and Exelon's enterprise-wide risk related to cybersecurity, including management's identification, assessment, and mitigation of cybersecurity risks. At each regular quarterly meeting, the Board of Directors engages with the CISO and a cross-functional management team regarding the risks from cybersecurity threats. The CISO and professionals from the legal and compliance departments brief the Board of Directors on relevant topics, including information security and operational security, legislative and regulatory developments, and notable external cyber events relevant to Exelon and the industry more broadly. Management engages with the Board of Directors on risks from cybersecurity threats as appropriate outside of the quarterly meetings.


text: The CISO manages Exelon's enterprise-wide cybersecurity programs and reports to Exelon's Chief Information Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Exelon since 2018 and was named to the current role in 2022. The CISO has 26 years of information technology and cybersecurity experience in the critical infrastructure sector, of which 24 years have been in the utility industry. The CISO leads CISS, which manages centralized information technology and operational technology security programs for the Registrants. The programs are aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and integrate cyber asset identification; threat assessment;


text: risk assessment; risk management; and risk monitoring. CISS operates a security operations center for monitoring, identifying, and mitigating potential cybersecurity events or incidents.


text: Cybersecurity is an important component of our overall risk management program. Our cybersecurity policies and practices are integrated into our risk management program and are based on recognized frameworks. ON24 is certified under ISO 27001:2013 and 27701:2019, which sets forth a strict framework for managing security and privacy risks, including the necessary internal process and policies to deal with cybersecurity risks and incidents.

companyName: ON24 INC.

ticker: ONTF


text: Risk Management and Strategy Our cybersecurity program focuses on the following key areas: • Governance: Our Chief Information Officer ("CIO") leads our cybersecurity risk management program, with oversight from our board of directors. Our CIO closely collaborates with Information Security and Legal/Privacy leaders with the support of other members of management and teams comprised of personnel with a broad range of experience in the technology industry. • Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention, data leak prevention and detection systems, anti-malware functionality and access controls. • Incident Response and Recovery Planning: We have established and maintain comprehensive cybersecurity incident response and recovery plans, including legal obligations to report incidents, which we test and evaluate from time to time. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors and customers, that could adversely impact our business in the event of a cybersecurity incident affecting third-party systems. • Education: We provide regular, mandatory training for staff regarding cybersecurity and privacy awareness.


text: We periodically assess and test our cybersecurity policies and practices. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess our cybersecurity measures.


text: Our board of directors oversees cybersecurity as part of its risk oversight function. Our board of directors receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.