text: Furthermore, our Board of Directors, both collectively and through its Risk Committee, holds responsibility for overseeing risk management, including cybersecurity risks. In this capacity, the Board and the Risk Committee, supported by management and third-party cybersecurity advisors, ensure that the risk management processes devised and executed by management are adequate and operational as intended. Annually, the Board reviews and approves our information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy, and business continuity planning policy. These policies are developed and implemented by our management team. To fulfill their duties, the Board receives regular updates from the Risk Committee regarding cybersecurity risks and management's endeavors to prevent, detect, mitigate, and address any cybersecurity incidents, at least quarterly.


text: Management and Strategy have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, hardware, software, third-party hosted services, and data.

companyName: MAYS J W INC

ticker: MAYS

secItem: Item 1C


text: rely on third-party service providers to help manage our information systems, including network security service providers with experienced information technology professionals. We also work with third parties to identify, assess, and manage actual and perceived cybersecurity threats and risks, and we evaluate cybersecurity risk as part of our overall risk management strategy. With the assistance of these third-party service providers, we implement and maintain various technical, physical, and administrative controls and processes to manage and mitigate material risks from cybersecurity threats to our information systems. This includes procedures for incident detection and response, network security controls, access controls, physical security, systems monitoring, and backup and recovery procedures.


text: operations rely on third-party service providers and software programs. For instance, our accounting and financial reporting-related systems use software obtained from third-party service providers, and these systems are necessary for the efficient and consistent operation of our business. We use these systems to communicate with tenants, banks, vendors, and others, and to manage our accounting, financial reporting, and for other recordkeeping purposes. We, thus, maintain a process to identify and evaluate cybersecurity risks and incidents associated with key third-party providers. When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.


text: the effort we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats or incidents which have materially affected or are likely to materially affect our Company, results of operations, or financial condition.


text: Board of Directors maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.


text: Committee receives periodic updates from management on potential risks, threats, and controls to mitigate identified risks. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: management, represented by our Chief Financial Officer, Ward Lyke, provides leadership for implementation and maintenance of our cybersecurity risk management processes. Mr. Lyke has served as Vice President, Chief Financial Officer, and Treasurer since January 2024, and as an Executive Vice President and Officer of the Company since 1984, including as Assistant Treasurer since 2003. Mr. Lyke currently manages the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Lyke oversees the Company's managed IT solutions service provider which includes, among other services: Business


text: continuity – Managed data backup utilizing best practices including cloud based disaster recovery, security protection – Real-time protection against security threats across email, browsers, files, and infrastructure resources, management – Patching for Windows and certain third party application updates, monitoring – 24x7 monitoring, alerting and maintenance of various office and cloud systems.


text: Lyke is notified real time by the managed service provider for matters requiring immediate attention. Mr. Lyke also reviews a standardized monthly report with key IT systems data and statistics, including red flags requiring resolution, if any. Management reports serious cybersecurity incidents to the Committee and our Board.


text: We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, as well as by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of the Risk Factors outlined in Item As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program; Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats; Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time; Managing and maintaining cybersecurity controls utilizing available people, processes and technology; Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers; Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: The Information Security Program, overseen by our Executive Project and Technology Risk Committee ("EPTRC"), plays a vital role in our overall risk management system. It encompasses administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information.


text: We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response team (i) includes subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.


text: Our management team is tasked with the daily management of the cybersecurity risks we encounter and supervises the EPTRC. Our EPTRC, in turn, oversees the assessment of information security, the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company. The EPTRC is comprised of management with the appropriate expertise and authority to ensure effective oversight of the Information Security Program.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, hardware, software, third-party hosted services, and data.


text: We rely on third-party service providers to help manage our information systems, including network security service providers with experienced information technology professionals. We also work with third parties to identify, assess, and manage actual and perceived cybersecurity threats and risks, and we evaluate cybersecurity risk as part of our overall risk management strategy. With the assistance of these third-party service providers, we implement and maintain various technical, physical, and administrative controls and processes to manage and mitigate material risks from cybersecurity threats to our information systems. This includes procedures for incident detection and response, network security controls, access controls, physical security, systems monitoring, and backup and recovery procedures.


text: Our operations rely on third-party service providers and software programs. For instance, our accounting and financial reporting-related systems use software obtained from third-party service providers, and these systems are necessary for the efficient and consistent operation of our business. We use these systems to communicate with tenants, banks, vendors, and others, and to manage our accounting, financial reporting, and for other recordkeeping purposes. We, thus, maintain a process to identify and evaluate cybersecurity risks and incidents associated with key third-party providers.


text: When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.


text: Notwithstanding the effort we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats or incidents which have materially affected or are likely to materially affect our Company, results of operations, or financial condition.


text: Our Board maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.


text: The Committee receives periodic updates from management on potential risks, threats, and controls to mitigate identified risks. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on the cybersecurity risk management program as needed.


text: Our management, represented by our Chief Financial Officer, Ward Lyke, provides leadership for implementation and maintenance of our cybersecurity risk management processes. Mr. Lyke has served as Vice President, Chief Financial Officer, and Treasurer since January 2024, and as an Executive Vice President and Officer of the Company since 1984, including as Assistant Treasurer since 2003. Mr. Lyke currently manages key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Lyke oversees the Company's managed IT solutions service provider which includes, among other services:


text: Business continuity – Managed data backup utilizing best practices including cloud-based disaster recovery, Multi-vector security protection – Real-time protection against security threats across email, browsers, files, and infrastructure resources, Patch management – Patching for Windows and certain third-party application updates, Infrastructure monitoring – 24x7 monitoring, alerting and maintenance of various office and cloud systems.


text: Mr. Lyke is notified real time by the managed service provider for matters requiring immediate attention. Mr. Lyke also reviews a standardized monthly report with key IT systems data and statistics, including red flags requiring resolution, if any. Management reports serious cybersecurity incidents to the Committee and our Board.


text: The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually.


text: The Company has a Governance, Risk, and Compliance (GRC) function to address enterprise risks, and cybersecurity is a risk category addressed by that function.


text: Additionally, cybersecurity risks and threats that could have a material impact on the Company are discussed further in the Item 1A Risk Factors. Those sections of Item 1A should be read in conjunction with this Item 1C. Governance.


text: The Global Head of IT is the management position with primary responsibility for the development, operation, and maintenance of our information security program. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Company's IT infrastructure are appropriately secured and managed. It also encompasses ensuring that all employees are educated in IT best practices around incident management and security, ensuring the security of the internal and external IT systems, as well communicating to senior management and planning for future IT strategy and IT security.


text: The Company has an established Information Security Committee to manage the information security risk assessment framework. This framework includes a defined methodology and tolerable level of risk documented within the Information Security Management System ("ISMS") and relevant controls addressing business risks. The committee is informed of all security incidents and ensures appropriate remediation activities are implemented. The Company's ISMS are audited by both internal and external parties on a regular basis. Results of audits and material security incidents are presented to the Board of Directors on a quarterly basis.


text: The Company has established an information security program to address and mitigate material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. These policies and procedures undergo an annual audit to ensure compliance with ISO 27001 controls. A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.


text: The Global Director of Information Technology (GDIT) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Company's IT infrastructure are appropriately secured and managed. It also encompasses ensuring that all employees are educated in IT best practices around incident management and security, ensuring the security of the internal and external IT systems, as well communicating to senior management and planning for future IT strategy and security.


text: Cybersecurity risk management and strategy Cybersecurity and risks associated with information security are operational risks included in the Company's ERM Framework. Under the ERM Framework, the Company's Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company's ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with information security in accordance with our Risk Appetite Statement, as approved by the BOD.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: The Risk Committee of the BOD and ORMC are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. The Company's CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD's Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CISO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.


text: Cybersecurity assessments The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness, GLBA Safeguards Rule to protect user data, and Swift security control requirements. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to Center for Internet Security benchmarks for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.


text: Cybersecurity operational measures Led by our CISO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC's oversight through SIEM, and with support of the Company's CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity risk management and strategy Cybersecurity and risks associated with information security are operational risks included in the Company's ERM Framework. Cybersecurity risks may also include fraud, harm to employees or customers, violation of privacy or security laws and other legal risks, and reputational risk. These risks are all considered in the Company's ERM Framework as part of the Company's overall risk assessment process. Under the ERM Framework, the Company's Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company's ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with cybersecurity and information security in accordance with our Risk Appetite Statement, as approved by the BOD.


text: The Risk Committee of the BOD and ERM Committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cybersecurity and information security. The Audit Committee of the BOD oversees the audit control functions of which cybersecurity practices may be a part. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company's senior leadership in this area have over 75 years of experience. The Company's CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. The Company's CIO has over 30 years of technology executive leadership, technology experience focused on strategy, design, development, implementation and support of application systems, and overseeing transformative technology changes, including digital transformations and fraud and BSA/AML capabilities. While the CIO and information technology organizations collaborate with the CISO organization as described herein, to create independence between the CISO and CIO functions, the CISO reports to the Company's Chief Administration Officer and the CIO reports to the Company's Chief Banking Officer for National Business Lines. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD's Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CISO and CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.


text: Cybersecurity assessment The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: Cybersecurity operational measures Operationally, the Company's overall cyber risk strategy is a collaborative process between the CIO and the information technology teams, and the CISO led data protection, information and cyber teams. The CIO oversees the establishment and implementation of the technical plan for cyber risk strategy which the CISO and his team reviews and critiques. After they have established a joint cyber risk plan, the Company's second line of defense reviews and challenges the plan. Thereafter, the CISO and CIO teams cooperate with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. As an ongoing operation, the Company's SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC's oversight through SIEM, and with support of the Company's CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to detect, manage, respond to, resolve and recover from events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: Cyber threat actors and cybersecurity incidents are a reality and the Company and our third parties face cybersecurity threats in the normal course of business. As of the date of this report, we are aware of the incident described in Item 9B "Other Information" of this report and, as of the date of this report, we have not experienced material losses or consequences relating to material cybersecurity incidents experienced by us or our third parties. However, we expect businesses will continue to experience cybersecurity risks that could result in adverse impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by third parties, will not have a material adverse impact on the Company, including its business strategy, results of operations and/or financial condition. Future cybersecurity threats and incidents could have a material impact on our service, systems or business and are discussed in "Risk Factors" to this report.


text: We recognize that cyber threats are constantly evolving, and we must stay ahead of risks and threats to our business systems, data, infrastructure, and employees. We take a holistic approach to cybersecurity to proactively mitigate and respond to cyber threats. Building a robust security program and security controls are critical components that are in the core foundation of our products, culture, and management oversight. As a financial transaction processor, we ensure security is embedded and regarded with importance across the organization and within our products and services. We recognize the criticality of maintaining the safety, security, and integrity of our systems and data to protect our customers, employees, partners, and shareholders. The security program and cybersecurity strategies are strongly supported by both executive management and our Board of Directors. Our executive management fosters a strong culture of security awareness and responsibilities from the tone at the top and across all functional teams at all levels. The security team leadership also conducts segment level Board and/or periodic meetings with segment business leadership to share security key performance indicators ("KPIs") and risk considerations, as well as align with business strategies and gain approval for financial support for cybersecurity resources and tools. Security leadership is also involved in financial forecasting for security needs and costs, and the Chief Technology Officer ("CTO") and Chief Financial Officer or executive management team is involved in understanding and approving security related investments and strategies. We invest in our cybersecurity personnel and protections to address critical risks to our infrastructure and systems, and we remain dedicated to continuous improvement in our cybersecurity program.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: The Company's CTO reports to our Chief Executive Officer and has been with Euronet 16 years and is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors (the "Board"). Many on our Information Technology ("IT") security team leadership have over a decade of cybersecurity and IT control experience, certifications, and external and internal IT audit experience. The Chief Information Security Officer ("CISO") reports to executive management independent of IT and is responsible for management of cybersecurity risk, security governance and compliance, security policies, security training, and the overall protection and defense of our networks, systems, and company data. The CISO manages the global security governance, risk, and compliance teams and is responsible for ensuring we meet our regulatory and compliance requirements as related to PCI DSS, ISO 27001, and other certifications we hold globally that support our business products and services. The Global Director of Cybersecurity reports to the CTO and manages our security toolbelt and implementations, incident response, alert management, and various technical security teams. The CISO and Global Director of Cybersecurity manage teams of cybersecurity professionals with broad experience and expertise, including PCI and other regulatory compliance, threat assessments and detection, forensic investigations, mitigation technologies, cybersecurity training, incident response, insider threats, third party risk, penetration testing, and security engineering expertise. Many members of the security leadership team across the organization have been with Euronet for more than 10 years. The global and segment security leadership teams work closely with legal, privacy, audit, and compliance teams to ensure we meet regulatory requirements and work together to address cyber risks in all functional areas of the organization. We also conduct strategic in person and virtual annual, quarterly, and monthly security meetings with key members of security and IT leadership to align on security priorities, initiatives, and requirements.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually. The CTO attends all quarterly Board meetings and presents to the Board at a minimum of twice per year on security and cybersecurity KPIs and threat mitigations. The Audit Committee oversees risks including cybersecurity risks. Our internal audit team reports on cybersecurity risks and internal and external audit results to the Audit Committee. Internal Audit performs IT security and compliance audits for SOX 404 purposes, as well as testing Euronet's security standards, and performs pre-assessments for ISO 27001. We also engage third party independent assessments for penetration testing, vulnerability assessments, and certification such as PCI DSS, ISO 27001, VISA PIN and SOC Type 1 and Type 2 audits. The CTO and CISO also have weekly and monthly meetings with senior executive management to discuss security strategy, projects, and concerns. We have an established incident response process led by our CISO governing our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our Chief Executive Officer, executive management team, and the Board as well as regulatory notifications depending on the jurisdiction and specifications of the incident.


text: While we evaluate all security incidents and consider the materiality of individual or combined incidents, to date, no incidents or combination of incidents have materially affected the Company or our financial position, results of operations, and/or cash flows. We continue to invest in cybersecurity to enhance the design and effectiveness of our internal controls and processes to protect our systems, networks, and integrity of our data.


text: Risk Management and Policies - Our policies, standards, processes, and practices for assessing, identifying, and managing risks, including material risks, from cybersecurity threats are integrated into our overall security and risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other applicable industry standards and best practices. We regularly review and update policies and procedures with input from IT and security leadership and industry security standards including PCI DSS and ISO. Business segments and local entities also maintain local policies and procedures that include global requirements and local, statutory, or contractual requirements and escalations. All employees must sign and acknowledge a Corporate Information Security Policy that outlines their responsibilities related to IT security, cybersecurity, and protection of company assets and data. In addition to the enterprise risk assessment presented to the Board, local entity IT and security teams maintain detailed risk assessments that are shared with local management and are provided for applicable regulatory requirements, as well.


text: Information Sharing and Collaboration - We subscribe to financial services cyber intelligence and collaboration services, and we work closely with cyber intelligence and managed security service providers to augment our own security program and controls. We investigate intelligence sharing platforms to assess potential risks as credible or emerging risks.


text: Continuous Monitoring – We have security team members across all of our geographic business operations that support our key IT processing centers. We have teams dedicated to investigating all security alerts and incidents at a global level or within our business segments. Further, we have managed security service providers who provide 24x7 advanced threat detection and monitoring services to augment our security analyst teams.


text: Incident Response – We have a global incident response policy that is shared with key stakeholders and outlines our classification, escalation, investigation, reporting, and overall response procedures depending on the classification and severity of incidents. Local IT teams must also create a local incident response plan and playbooks for addressing various types of incidents and handling escalations and reporting obligations locally. Further, we engage external forensic investigations as necessary to augment our incident reporting process if deemed critical and/or necessary for prompt response to security incidents which may require a higher technical level of forensics and/or resources to quickly assess and respond to certain incidents.


text: Training and Awareness - We provide security awareness training to our employees and contractors to help identify, mitigate, and report on cybersecurity threats. Our employees with network access must complete quarterly security awareness training which includes multiple interactive and video training modules with passing scores required to complete training compliance. We require annual PCI DSS and GDPR training as well as any other regulatory required security training. We also perform simulated phishing campaigns to further test security training effectiveness. We also periodically host tabletop exercises with IT and management to test and evaluate our incident response plan or playbooks.


text: Insider Threats - We implement insider threat controls designed to identify, assess, and address potential risks from within our Company. We implement controls and tools to alert on suspicious or unusual insider activity, and we have rigorous controls in place to prevent data loss and external sharing of company information. We consider and evaluate potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations.


text: Third Party Risk Assessments - We conduct information security assessments before sharing or allowing the hosting of data in computing environments managed by third parties or allowing third parties to connect to our environment. We also review and amend legal terms and conditions to ensure there are contractual provisions requiring certain security protections and incident reporting. We also perform vendor risk assessments to assess the risk of new and existing vendors we conduct business with.


text: External Assessments – We engage external assessors to evaluate, test, and conclude on the design and effectiveness of security controls and processes. We engage quality assessors for vulnerability and penetration testing as well as for security certification and/or regulatory requirements. Further, we have external audits performed by customers, banking and government regulators, and public accounting firms as part of financial and statutory audit purposes. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on security and cybersecurity threats we face, please see "Risk Factors."


text: have no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Profusa, Inc.

ticker: PFSA


text: Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Longeveron Inc.

ticker: LGVN


text: The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Management and Strategy the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance:


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's Vice President, Business Operations ("VPBO"), other members of management and relevant management committees, including Company's Senior Leadership Team ("SLT"). The Company, as part of cost-cutting initiatives in 2024, has eliminated the VBPO position;


text: the obligations of that position as it relates to cybersecurity oversight and risk management will be undertaken by the Company's General Counsel.


text: Approach: The Company, through its information technology partner, has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Safeguards: The Company, through its information technology partner, deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti- malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Response and Recovery Planning: The Company, with its information technology partner, maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident.


text: Education and Awareness: The Company, through its information technology partner, provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company with our information technology partner regularly engages assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the VPBO who shares data with the SLT, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: in coordination with the SLT, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The VPBO and the SLT, through its information technology partner receives regular reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations. On an annual basis, the Audit Committee and the Board discuss the Company's approach to cybersecurity risk management with the members of the SLT, which includes the Company's VPBO, Chief Financial Officer ("CFO"), and General Counsel.


text: in coordination with the SLT, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the Company's information technology partner, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Company's SLT and Audit Committee, when appropriate.


text: information technology partner has worked in information technology and information security for over 30 years with over 300 employees with six locations in the United States. A virtual Chief Information Officer ("vCIO") from the partner works directly with the VPBO for align business and technical strategies, decisions, and implementations. The VPBO has over 35 years in the pharmaceutical and biotech industry managing programs and projects across a variety of implementation methodologies and risk factors and holds undergraduate degrees and certifications in his respective field. The Company's Chief Executive Officer, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at similar companies, including risks arising from cybersecurity threats.


text: threats, including the results of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: BlueRiver Acquisition Corp.


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: The Investment Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us and to protect the systems, data and other digital assets of the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Investment Advisor's Chief Operating Officer ("COO") and Chief Compliance Officer ("CCO") regarding the overall state of the Investment Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Our management, including the COO and CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, IT management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.


text: The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Company's overall risk management processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Company's cybersecurity systems.


text: Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events.


text: This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, CFO, and CISO, and CTO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO, CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CTO and CISO have served in various roles in information technology and information security for over 28 and 25 years respectively and hold relevant professional certifications. The Adviser's CCO and CFO, each hold undergraduate and graduate degrees in their respective fields, and each have over 15 and 28 years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, closely monitor emerging data protection laws and implement changes to our processes designed to comply; undertake regular reviews of our consumer facing policies and statements related to cybersecurity; proactively inform our customers of substantive changes related to customer data handling;

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; maintain and follow an internal information security and incident response program;


text: follow common industry security standards, such as having two-factor authentication for all accounts, using corporate VPN for service minimize the period of time customers' personal information is stored in our database.


text: Our information security program coordinates the activities we take to prepare for, detect and respond to cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Where necessary, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Please see the risk factor entitled " We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors. " in Part I, Item 1A. Risk Factors in this report for more information.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We have not been faced with any penalties or settlements related to cybersecurity.


text: The audit committee of the Board is responsible for the oversight of risks from cybersecurity threats. Beginning fiscal year 2024, at least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee will generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and will discuss such matters with our VP of Software Platform. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks will also be considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our VP of Software Platform. This individual has over 20 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs in the healthcare and robotics industries.


text: The VP of Software Platform is informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. The VP of Software Platform reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Risk Management and Strategy Our Information Security team manages our Information Security Program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and our Board of Directors (the "Board"), as described below under the sub-heading " Governance."

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Information Technology Security Policy that is available to all employees through our Quality Management System. We also conduct regular cybersecurity awareness and training campaigns for existing employees.


text: Internal and external stakeholders can access Jasper's Information Technology helpdesk 24/7 online or by phone, to report any security incidents for escalation.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain a cyber incident response plan with formalized workflows and playbooks. We conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems and test our Information Technology infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies, and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: Our risks associated with cybersecurity threats are set forth under " Risk Factors " in Part I, Item 1A in this report. Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: The Board, in coordination with the Audit Committee of the Board (the "Audit Committee"), oversees our risk management program, including the management of cybersecurity threats.


text: The Board and the Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Audit Committee discuss our approach to overseeing cybersecurity threats with our CFO and other members of senior management. Our CEO, CFO and other members of our senior management collectively have several decades of experience managing risk at our company or similar companies and assessing cybersecurity threats.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management.

companyName: Cyngn Inc.

ticker: CYN


text: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our Board of Directors.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Management and Strategy of December 31, 2023, we have implemented a set of cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities. Our employees have received cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. Important security measures such as multifactor authentication, firewalls, Endpoint Detection and Response (EDR), encryption, etc. have been implemented. We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Currently we are in the process of expanding our risk management procedure to include a broader cybersecurity risk management process. The updated risk management process will include annual review by our Board of Directors Governance


text: Board of Directors are currently implementing as oversight procedure for IT governance and cyber security risk management. It is expected that IT governance and cybersecurity will be included in the company's quarterly management review meetings under the supervision of our senior leadership, including our Chief Executive Officer and Chief Financial Officer, with regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Threat Disclosure date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, " Risk Factors."


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the NIST cybersecurity framework, to which risk management in relation to our information systems is aligned. We categorize our information systems as either Tier 1 (critical) or Tier 2 or Tier 3 (essential), depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to monitor, assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with advanced identification-enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team; monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.

companyName: SB FINANCIAL GROUP, INC.

ticker: SBFG


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, and financial condition. For more information about these and other risks, see ITEM 1A. RISK FACTORS.


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit & Risk Management Committee and the Board provides structured oversight of the Company's risk management program, which focuses on the most significant short, intermediate, and long-term risks the Company faces. The Company has an Information Security Council (the "Council") that is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company's information systems and the nonpublic information stored within them. In addition, the Council plays a crucial role in the governance of the cybersecurity risk management process. This involves collaborating with third-party industry experts and the Company's internal audit team to conduct risk assessments of the Company's information security program (the "Program"). The assessments encompass an evaluation of the Company's adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company's information security policy and procedures. Reports of the Council are shared regularly throughout the year with the board of directors. Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our designated Chief Technology & Innovation Officer ("CTIO").


text: The Company routinely engages third-party industry experts to perform risk assessments of the Program. At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity. The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the Audit & Risk Management Committee for input. The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors.


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: AMAZE HOLDINGS, INC.

ticker: AMZE


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cadrenal's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on Cadrenal's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Cadrenal acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K. Governance Disclosure.

companyName: IMMERSION CORP

ticker: IMMR


text: Our Board is periodically informed of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the Board on such reports.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: AirJoule Technologies Corp.

ticker: AIRJ


text: Company has processes in place for assessing, identifying, preventing, and managing material risks from cybersecurity threats, including related to the use of third party service providers. In addition, the Company leverages the security and monitoring tools of third party service providers. These processes are integrated into the Company's overall risk management program and systems, as overseen by the Board, primarily through the Audit Committee.

companyName: CorMedix Inc.

ticker: CRMD


text: maintain physical, technical and administrative safeguards to prevent and identify cybersecurity risks, and have implemented practices and procedures to address cybersecurity risks. To this end, among other things, we: provide annual mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: regular simulation modules for all employees to enhance awareness and responsiveness to possible cybersecurity management and incident training for employees involved in our systems and cyber liability insurance that is intended to provide protection against the potential losses arising from a cybersecurity incident. are currently working with outside counsel to further develop a formal cybersecurity incident response plan.


text: we are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services and loss of investor confidence.


text: Board executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and the Board has authorized the Audit Committee to oversee risks related to cybersecurity threats. Our Audit Committee has primary oversight responsibility for cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the overall data protection program.


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. The Company's Senior Manager, IT, has 24 years of experience in enterprise IT and has primary responsibility for managing our cybersecurity program and efforts, and our finance and IT teams are responsible for the testing and audit of our information-technology related internal controls.


text: Item 1A, Risk Factors, for additional information on the Company's cybersecurity risk profile, in particular the risk factors under the headings entitled " Risks relating to data privacy could create additional liabilities for us " and " Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer ".


text: In connection with the Acquisition, we recently reshaped our Board of Directors, which is addressing the implementation of a number of internal policies and procedures, among them cybersecurity and risk assessment. While we presently do not have formal cybersecurity and risk assessment policies and procedures in place, which may make us susceptible to heightened cybersecurity risks, we do not at this time anticipate collecting or storing any significant personal information, personal data or confidential information related to customers, consumers, employees, or vendors. Moreover, we have invested in measures to reduce these risks and we intend to have our Board of Directors develop, adopt and implement a cybersecurity risk management program and formal processes for assessing risk, which may be implemented by Company personnel or which we may outsource to be managed by third party service providers. In addition, pursuant to applicable SEC transition guidance, certain disclosures required in this item will only be applicable to the Company from the fiscal year ending on December 31, 2024. See "Risk Factors" for additional information.

companyName: Charging Robotics Inc.

ticker: CHEV


text: the ordinary course of our business, we receive, process, use, store and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary and personal information. We depend largely upon our information technology systems in the conduct of all aspects of our operations. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: To this end, we have implemented processes and systems designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems to prevent adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.


text: In 2023, we did not identify any cybersecurity breaches that materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: Our management team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents. Our chief technology officer has over 40 years of experience and has held various leadership roles in information technology, including serving as a chief information officer and chief technology officer for the last 12 years. He has successfully implemented and managed large enterprise resource planning systems, e-commerce websites, stores and enterprise infrastructure, both cloud-based and on-premise. His expertise extends to evaluating and hiring cybersecurity personnel and outsourced managed services, defining incident response plans, conducting tabletop exercises, and establishing communication protocols with internal executives, board members, and vendors. He has firsthand experience in responding to actual cybersecurity incidents, showcasing a deep understanding of the challenges and complexities within the cybersecurity landscape in the retail sector. Our senior director of cybersecurity and compliance has a 15-year track record as an information technology and information security professional, complemented by an Executive MBA. His career is distinguished by a decade of leadership as the commander of the United States Army cyber protection team (174 CPT), where he gained cybersecurity experience at USCYBERCOM and ARCYBER. He holds multiple professional certifications, including CISSP, PMP and multiple SANS certifications. Our chief technology officer and senior director of cybersecurity and compliance report to the Audit Committee on these matters.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. For example, a comprehensive cyber risk assessment, both physical and logical, was conducted by a third party, serving as an external penetration test to validate our security posture. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. Additionally, we have established a Technology Review Committee ("TRC")


text: tasked with the role of evaluating new software tools and technologies before their implementation. The TRC consists of experts from various domains within our organization, including information technology security, compliance, legal, and operations. This TRC conducts assessments to ensure that any new software tools meet our standards for security, compliance and operational efficiency.


text: The oversight of our cybersecurity is assigned to the Audit Committee of our Board of Directors. The Audit Committee receives regular reports and briefings from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. In addition, management updates the Audit Committee as necessary regarding any material cybersecurity incidents as well as any incidents with lesser impact potential. The Audit Committee received one report from our Senior Director of Cybersecurity and Compliance in 2023.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program, in conjunction with our enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology, or IT, environment including systems, hardware, software, data, people and processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, and processes and controls supporting data protection requirements under applicable law. We have an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists developed a risk mitigation plan to address such cyber risks, and, where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: maintain policies over areas such as protecting and handling confidential information, processing of personal data, access on/off boarding, user management, acceptable use, and IT change control management to help govern the processes put in place by management designed to protect our IT assets, data and services from threats and vulnerabilities. We employ additional key practices within the cyber risk management program including, but not limited to maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access to privileged accounts, and physical security measures at our facilities. We also utilize information protection/detection systems, or IPS/IDS, including maintenance of firewalls and anti-malware tools, network and data traffic monitoring with automated alerting, ongoing cybersecurity user awareness training, industry-standard encryption protocols, formalized change management processes and critical data backups to reduce cybersecurity risk.


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to systems inventory monitoring, configuration management, vulnerability scanning, user management, mobile device monitoring, capacity monitoring, network protection and monitoring, IPS/IDS management, remote access monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.