text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Risk Management Committee of the Board (the "Risk Management Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), the Company's Chief Information Officer ("CIO"), other members of management. • Incident Response and Recovery Planning: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that establish a structured approach for the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Outside Experts. The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reviewed by the Cybersecurity team and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: EQUITY BANCSHARES INC

ticker: EQBK

secItem: Item 1C


text: Board Oversight of Risks from Cybersecurity Threats The Board, in coordination with the Risk Management Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Risk Management Committee discuss the Company's approach to cybersecurity risk management with the Company's CISO and CIO.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A - Risk Factors - We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our or our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers."


text: Management's Role in Assessing and Managing Risks from Cybersecurity Threats The CISO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CIO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Management Committee when appropriate.


text: The CISO has served in various roles in information technology and information security for over 15 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in Information Networking and Telecommunications, a graduate degree in Cybersecurity, and has attained the professional certification of Certified Information Systems Security Professional. The CIO holds an undergraduate degree in Business Finance and has served in various roles in information technology for over 30 years, including serving as either the Chief Information Security Officer or Chief Information Officer of two public companies.


text: Risk Management and Strategy We have implemented and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of our critical systems and information, as well as to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our systems and processes are assessed by independent third parties for compliance with: the International Standard Organization ("ISO") 27001; System and Organization Controls ("SOC") 2, Type 2; and Payment Card Industry Data Security Standards ("PCI DSS") Level 1.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management—We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.


text: We regularly review our information security program and associated policies, making periodic updates as we deem necessary and appropriate in accordance with recognized best practices and standards.


text: Our information security program and cyber risk management program is managed by our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years.


text: Management holds monthly Information Security Management System (ISMS) meetings which include members of the executive management team as well as the CIO and other key individuals reporting to the CIO. Cybersecurity risks, threats, and vulnerabilities, as well as existing mitigating controls, are discussed in ISMS meetings. Our CIO also provides quarterly reports of our information security program, as well as any material cybersecurity risks, to the board of directors.


text: The Company did not experience a material cybersecurity incident during the year ended December 31, 2023. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on the Company's business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.


text: We recognize the critical importance of maintaining the trust and confidence of customers, suppliers, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. Our customers' requirements for their suppliers to have certain cybersecurity policies, standards and processes in place also drives and guides some of our policies and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks. The program includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director of Information Security.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, International Organization for Standardization and the Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees, Board members and certain contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats and incident response preparedness, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for current employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: As part of the above processes, we periodically engage with consultants, auditors and other third parties, including having independent third-party consultants review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers who have access to customer, supplier and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we endeavor to require those third parties that could introduce significant cybersecurity risk to us to agree to manage their cybersecurity risks in specified ways.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business and Strategy" which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats.


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Security and Chief Information Officer. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our Audit Committee and Board of Directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Members of our Audit Committee and Board of Directors continue to receive updates around the cybersecurity threat landscape and ongoing best practices as a means of continuing education in the area. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, Director of Information Security, Chief Financial Officer and Chief Legal Officer. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, Certified Professional Hacker. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: The Audit Committee of the Board has primary responsibility for overseeing our cyber security risk management process. Our cybersecurity risk management processes are integrated within our established Enterprise Risk Management System. On a regular basis, the Audit Committee and the Board receive updates on cybersecurity matters from the Chief Information Officer ("CIO"). These updates include, but are not limited to, cybersecurity program updates, results of third-party assessments, results of tabletop 'drill' exercises, end user awareness training, and recoverability and resilience. The Audit Committee also receives quarterly reports from our internal audit department.

companyName: SUPERIOR ENERGY SERVICES INC


text: Our cybersecurity practices are led by the CIO, who has overall responsibility for assessing and managing cybersecurity risks, and uses a risk-based methodology to support the security, confidentiality, integrity and availability of information and IT systems. Our CIO has over 30 years of experience in IT delivery, operations, and management, as well as over 15 years' experience leading cyber security requirements for global and publicly traded companies.


text: The Company regularly engages third parties to perform assessments on our cybersecurity measures, including penetration testing, vulnerability scanning and proactive threat hunting, and operating effectiveness of controls. The results of such assessments, audits, and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits and reviews. The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems. In addition, our internal audit department routinely performs internal audits on various aspects of cybersecurity and reports the results in its quarterly report to the Audit Committee.


text: The underlying controls of our cybersecurity capabilities are designed to prevent, detect, mitigate and remediate cybersecurity risks and are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organizational Standardization ("ISO") 27001 Information Security Management System Requirements.


text: Significant incidents are escalated and communicated by senior IT management to the CIO to determine severity, cause and remediation. We also maintain a disaster recovery plan in which critical business systems, networks and data may be successfully recreated to minimize the financial impact of a cyber incident on our business. To strengthen resiliency against malware attacks, such as ransomware, we create immutable copies of all critical system data that is isolated from the rest of the network in case data recovery is required.


text: Our third-party cyber partners are a key component of our cybersecurity capabilities, and we partner with leading cybersecurity companies, leveraging third party technology and expertise. Through these partnerships, we provide continuous monitoring of our global cybersecurity environment and coordinate the investigation and remediation of alerts. Additionally, annual incident response drills are in place to prepare support teams in the event of a significant incident.


text: We have continued to expand investments in IT security. For example we are in the process of implementing a Cyber & Data Protection Council that will use a risk-based methodology to support the security, confidentiality, integrity, and availability of our information and IT systems. The Cyber & Data Protection Council will be chaired by the CFO and members include IT, legal, and HR leadership. Significant incidents will be escalated and communicated by senior IT management to the CIO and the Cyber & Data Protection Council to determine severity, cause and remediation.


text: We did not experience a material cybersecurity incident in 2023, and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors – Our operations may be subject to cyber-attacks that could have an adverse effect on our business operations."


text: Cybersecurity Risk Management and Strategy We recognize the importance of maintaining the safety and security of our critical systems, information, products, services and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Cybersecurity risks are addressed as a component of our enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business. Features of our program include: • periodic risk assessments designed to help identify material cybersecurity risks to our Information Systems and Data; • a security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • a cyber and data security incident response plan that establishes policies and procedures for identifying, managing and recovering from cybersecurity incidents, including escalating tiers of notification depending on an incident's nature and severity; • periodic tabletop exercises with management and other employees to discuss and prepare potential cybersecurity incident responses; • the use of third-party service providers, where appropriate, to assess, test and assist with aspects of our security controls; • a third-party risk management process for our service providers, suppliers and partners; • cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • policies and procedures that relate to cybersecurity matters, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices; and • required privacy and cybersecurity training (including spear phishing and other awareness training) for employees.


text: The techniques used to obtain unauthorized access, to disable or degrade service or to sabotage systems change frequently. As a result, we have invested and continue to invest in the security and resiliency of our networks to help protect our Information Systems and Data. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity and Intellectual Property" section of this Report.


text: Cybersecurity Governance Our Board is responsible for overseeing our enterprise risk management activities in general, and each of its committees assists in this role of risk oversight. Our Board has delegated the monitoring and oversight of risks related to cybersecurity and information technology to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Technology Officer, internal information security team and third-party experts.


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives regular updates from our Chief Technology Officer and other members of management on the cybersecurity risks that they view as most relevant to our business, our cybersecurity strategy and current cybersecurity trends, as well as other updates, as necessary, regarding certain cybersecurity incidents.


text: A cross-functional management team, which includes members of our information security, technical infrastructure, engineering and legal departments, is responsible for identifying, assessing and managing the risks from cybersecurity threats that are relevant to our business (and, depending on a threat's potential nature and severity, reporting such information to our Audit Committee). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers and communicates our cybersecurity risk management processes to senior management, as well as to our Board and Audit Committee. This team reports to our Chief Technology Officer, who has more than 25 years of experience in the technology sector, and possesses more than 75 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, also hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager (CISM) and Certified Information Systems Auditor (CISA)) and ISC2 (Certified Information Systems Security Professional (CSSP)). This team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. (“Invesco”), the Sponsor’s parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Invesco’s information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco’s information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is Invesco’s investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Invesco’s Board of Directors oversees cybersecurity risk and receives updates at a minimum, of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco’s risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.’s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco’s Enterprise Risk Management Committee which provides updates to the Invesco Board to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Trust’s business strategy, results of operations or financial condition, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors.


text: We utilize a third-party managed security service provider to support our information technology services, which include ongoing support for the management of cyber risks and protection of our information technology infrastructure. Our critical business applications are provided and managed by third party cloud software providers.

companyName: MYOMO, INC.

ticker: MYO


text: Our cybersecurity risk management strategy is informed by a recent cyber risk assessment conducted in consultation with our third party managed security service provider. The assessment was informed by industry standards and included an evaluation of our cybersecurity controls. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our efforts to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications. Our efforts to address cybersecurity risks and also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.


text: We have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through review of applicable certifications and security reports, where available, and contractual requirements, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors. We maintain an incident response and a disaster recovery plan, which includes plans around managing cybersecurity incidents, and is intended to serve as a guide for management of such events and to set forth communication procedures regarding potential impacts to our board, investors, and other stakeholders, as appropriate.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluation, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.


text: The Chief Financial Officer periodically provides reports to the audit committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The audit committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The audit committee periodically reports on cybersecurity risk management to the full board of directors.


text: We recognize the importance to our business and reputation of the continuous availability of our internal and client-facing information technology systems, as well as our ability to protect both the confidential information of our clients and our own intellectual property and business information. We are committed to protecting our client and business data and information technology assets and have implemented a cybersecurity program with policies, standards, processes and practices governing the protection and control of information during its lifecycle of creation, usage, transmission, storage and disposal.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Cyber Risk Management and Strategy We have implemented and maintain a risk management program that includes processes for the identification, assessment, management and mitigation of cybersecurity risks. This program utilizes numerous technological and human security controls, processes, and procedures to address risks including, but not limited to, those identified by threat intelligence providers, internal stakeholders, and security management programs. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Our risk management program is documented in our written Information Security Policy. We periodically update our Information Security Policy, along with other policies and procedures, to adapt to evolving business conditions and threats.


text: Included in our Information Security Policy is a documented incident response plan to identify, assess, manage and mitigate cybersecurity incidents. As part of our risk management program, we maintain a technology management security team, led by our Information Security Officer (ISO). Among their responsibilities, our technology management security team is responsible for conducting due diligence on software, hardware or services vendors where access to systems or data of Forrester or our clients is contemplated. The security team assesses whether these vendors have appropriate privacy and security controls and whether there are adequate contractual protections in place. We also engage external security assessment vendors from time to time to conduct penetration testing and vulnerability assessments and to report findings to management.


text: All new Forrester employees and contractors receive a copy of the Information Security Policy and are required to undergo information security and privacy training both as part of their onboarding and on an annual basis. We currently also maintain cybersecurity insurance covering the company and its subsidiaries.


text: While to date we are not aware of having experienced any material cybersecurity threats or incidents, and we do not believe that risks from such threats or incidents are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a successful material threat or incident. Additional information on cybersecurity risks we face can be found in "Item 1A, Risk Factors" under the heading "We face risks from network disruptions or security breaches that could damage our reputation and harm our business and operating results."


text: Governance Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Information Officer (CIO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.


text: With respect to management, our CIO, who reports directly to our chief executive officer, has over 20 years of experience with our company, including more than 10 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CIO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CIO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors, and other business partners.

companyName: EyePoint, Inc.

ticker: EYPT


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards with regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response simulations. We also require cybersecurity training when onboarding new employees and contractors, as well as required cybersecurity awareness training for our employees and contractors/other workforce members. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.


text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of the Chief Legal Officer, Chief People Officer & SVP of IT, Associate General Counsel, Head of Information Technology, and a member of the Financial Reporting team, meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our President/Chief Executive Officer, Chief Financial Officer, Chief Legal Officer & Corporate Secretary, and Chief People Officer/SVP of IT.


text: Our team leverages over 25 years of experience in various cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.


text: The SVP of IT provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and cybersecurity threats.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's cybersecurity and privacy risk exposures and policies. On a quarterly basis, the SVP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key information technology risks. The SVP of IT also apprises the Audit Committee and full Board of Cyber Security Incidents consistent with our incident response program, promptly.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." To date, we have not experienced any material cybersecurity incidents or threats.


text: Cybersecurity Risk Management and Strategy The Company has implemented information security programs to, among other actions, assess, identify and manage material risks from cybersecurity threats. These programs include periodic risk assessments, firmwide testing initiatives, periodic phishing tests and annual audits. As the Company assesses its risks and determines how to implement risk management programs, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. The Company also utilizes an independent cybersecurity advisor to provide periodic objective assessments of the Company's capabilities and to conduct advanced attack simulations.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Further, as of part of the Company's overall information security program, the Company conducts a security awareness program, which includes training that reinforces the Company's security management policies, standards, and practices, as well as the expectation that employees comply with these policies, standards and practices. The Company's security awareness program engages personnel through mandatory periodic training on identifying potential cybersecurity risks and protecting the Company's resources and information. The Company also annually engages third parties (as well as its internal audit department) to audit the Company's information security programs. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and ongoing monitoring.


text: To date, there has not been any previous cybersecurity incident that has materially affected the Company's business strategy, results of operations or financial condition.


text: See Item 1A. Risk Factors under the heading of "The Company employs information technology systems to support its business, and any material breach, interruption or failure may adversely impact the Company's business." for additional information on cybersecurity threats that could have a material impact on the Company. The Risk Factors section should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board of Directors maintains an active role in the Company's overall enterprise risk oversight to identify and mitigate broader systemic risks. The Audit Committee is responsible for overseeing and reviewing the Company's information security programs, including cybersecurity. The Director of Global Information Systems, who manages information security training and awareness program, updates the Audit Committee periodically regarding information security matters. The findings from the Company's annual third-party and internal information security audits also are reported to the Audit Committee. The Company also actively engages with key vendors and industry participants as part of its efforts, which are reported to the Audit Committee. In addition to the Audit Committee's oversight, the full Board of Directors receives periodic updates relating to information security and cyber security risks. The Board of Directors receives an annual report from its independent cybersecurity advisor.


text: The Director of Global Information Systems has had oversight responsibilities for PLP's information systems and cyber security for 15 years. He attends regular education programs regarding enterprise cybersecurity and supporting technologies. The Director of Global Information Systems reports to the CFO and coordinates with the IT resources across all subsidiary operations to discuss risk management initiatives, testing and training, recent trends and technological developments, and periodic reviews of third-party providers.


text: Governance Related to Cybersecurity Risks Our board of directors is involved in risk oversight through its attention to our overall business strategy, and it has delegated oversight of risk assessment and management to the audit committee. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management. Our audit committee discusses cybersecurity threats and our risk management processes at least annually, receives updates on relevant developments, and considers steps that our management has taken to monitor and seek to address risk exposures. The full board of directors also discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Our Information Technology Administrator, working with and through external vendors, including our outsourced Data Protection Officer, implements and administers our information security processes. Our Information Technology Administrator, in conjunction with the Data Protection Officer, provides regular reports to our Chief Financial Officer and General Counsel on cybersecurity risks and the implementation of risk management processes.


text: Cybersecurity Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by industry cybersecurity standards, including components of the National Institute of Standards and Technology Cybersecurity Framework, ISO 27001 standard, and Health Insurance Portability and Accountability Act ("HIPAA") security regulations. Our cybersecurity management processes have included an assessment to identify key risk areas and to inform our overall strategy, as well as cybersecurity assessments in connection with our review of key financial systems. Our processes also include technical controls, such as network monitoring tools and multi-factor authentication, where appropriate, and we engage reputable vendors to host sensitive company information. Before contracting with such vendors or purchasing third party technology or other solutions that involve exposure to sensitive company information, we conduct due diligence on the vendor, which includes a security review, and we receive and review security updates and alerts from these vendors. We have also implemented annual training for employees as well as phishing and other attack simulations as part of our cybersecurity readiness processes.


text: We have established an incident response process to identify, assess, and respond to cybersecurity events, if any. This process includes established roles, responsibilities and procedures to guide incident response operations, and reporting procedures for notifying members of management and the audit committee, where appropriate. We also maintain back-ups and disaster recovery plans to restore information in the event of an incident. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."


text: We rely on digital technology to conduct our businesses and interact with customers, policyholders, agents, and vendors. With this reliance on technology comes the associated security risks from using today's communication technology and networks.

companyName: HCI Group, Inc.

ticker: HCI


text: Risk Management and Strategy The goal of our cybersecurity risk management strategy is to protect the privacy, integrity, and availability of our critical systems and information. Our processes identify, assess, and manage material risk from cybersecurity threats as part of our entity-wide risk management efforts. To safeguard our data and the data of our customers, management utilizes a multi-layered approach consisting first of an external security operations center company that specializes in the detection and containment of cyber-attacks. For protection of endpoint devices connected to our network, we use the tailored security software of a third-party consultant company for managed detection and response. Perimeter defense technology is used to filter e-mail for threats from malware viruses and e-mail phishing attempts. We also detect threats through the use of our firewalls that monitor incoming and outgoing network traffic.


text: Tools utilized to prevent threats include multifactor authentication, e-mail security services, mobile e-mail security policies, virtual private networks, third-party security experts, and timely applied software patches, among others. We engage in annual penetration testing, disaster recovery testing, internal and external audits of our cybersecurity controls and simulated cyberattack scenarios to gauge our preparedness for these situations. In addition, employees are required to pass a mandatory cybersecurity training course annually and receive periodic phishing simulations to facilitate recognizing phishing attempts. We carry Cyber Insurance which includes access to a Cyber Incident Response team in the case of a cybersecurity event.


text: Management of cybersecurity also extends to third-party service providers we use for specialized purposes such as payroll processing, investment tracking, regulatory financial reporting, and equity compensation plan administration. Our communication with these providers is protected by the safeguards within our security operation center. In addition, we annually obtain a Service Organization Controls (SOC) report on the suitability and operating effectiveness of the providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective controls over unauthorized access at third party service providers.


text: We respond to cybersecurity events in accordance with our Cyber Security Incident Response Plan (CSIRP), which follows the guidance of the National Institute of Standards and Technology Cybersecurity Framework and provides for assessment, mitigation, and if necessary, remediation of any effects of a system breach. We also conduct annual breach simulations with internal information technology teams to test each step of our CSIRP.


text: There have been no cybersecurity events in the past that have materially affected the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to respond to sophisticated and rapidly evolving attempts to overcome our security measures. Such continuing threats could have a variety of adverse business impacts. See Item 1A – "Risk Factors" under the heading "Security and fraud risks" above for additional information on risks to our business from cybersecurity incidents and related matters.


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the Chief Operating Officer of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the Chief Operating Officer have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.


text: Our Board receives periodic reports on cybersecurity risks and any material cybersecurity incidents. One member of our Board of Directors, Paresh Patel, has information technology expertise.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our development programs and clinical trials (Information Systems and Data).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Our Information Technology (IT) department and IT Director, with the assistance of our legal department and CFO, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, our incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plans; risk assessments; encrypting certain data; network security controls; segregating certain of our data; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and IT Director discuss cybersecurity risk with management, including our CFO and legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations (CROs), and contract manufacturing organizations (CMOs). We have processes to manage cybersecurity risks associated with our use of certain of these providers. These processes include reviewing certain vendors' written security program and security assessments, and imposing certain contractual obligations related to cybersecurity on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section of this Annual Report on Form 10-K titled "Risk Factors", including, but not limited to, the risk factor titled "If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of our product candidates' development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our IT Director, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).


text: Our IT Director is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets and, along with our IT Director and our legal department, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our IT Director concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We periodically assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we evaluate how to reasonably address any identified gaps in existing safeguards and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Business and Legal Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, including our cybersecurity safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage specialized third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.


text: We also require key third-party service provider with access to our IT environment to certify on a contract-by-contract basis that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.


text: We have not previously experienced any cybersecurity risk or cybersecurity incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our or our CMOs', CROs', manufacturers', contractors', consultants' or collaborators' cybersecurity".


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our Executive Officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.


text: Our Chief Business and Legal Officer and our security governance steering committee, which includes our Controller, Vice President of HR, Vice President of Program Management and Manager of IT/IS, are primarily responsible for assessing and managing our risks from cybersecurity threats. Our Chief Business and Legal Officer has more than a decade of operational experience overseeing and advising on risk management in the highly regulated biopharmaceutical industry, and leads a wide range of business functions, including IT/IS. Our Manager of IT/IS has over 20 years of experience with IT, with an emphasis on cybersecurity over the past two years. They and other members of our security governance steering committee engage in training and education relating to cybersecurity risk.


text: Our Chief Business and Legal Officer and our security governance steering committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Business and Legal Officer and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their work overseeing, working with, and delegating daily operations to the IT/IS team, as well as their work developing and implementing information security policies, consistent with the IT/IS processes. These policies are reviewed at least annually with updates authorized and approved by the security governance steering committee.


text: Our Chief Business and Legal Officer and representatives from our security governance steering committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Business and Legal Officer and representatives from our security governance steering committee provide annual briefings to the board of directors on cybersecurity risks and activities.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management and, where applicable, external experts, as part of our efforts to keep the Board updated on topics that impact similarly-sized biopharmaceutical public companies.


text: Our management team, including our Vice President, Information Technology, and senior information technology staff, collectively have more than 40 years of experience assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes information systems architecture, operations, cybersecurity, data privacy protection, quality, and regulatory compliance experience.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response and reporting plan.

companyName: BOX INC

ticker: BOX


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including but not limited to Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We do not believe our business strategy, results of operations or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our full Board regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our chief information security officer or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our chief information security officer and chief compliance officer are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure We manage cybersecurity threats as part of our general risk mitigation, evaluation, and oversight processes. We implement our cybersecurity program internally through established policies, standards, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. We manage these risks to our employees, customers, stockholders, and business partners through a coordinated and consistent IT risk management process overseen by the Senior Manager, IT who assumes the role of our Chief Information Security Officer ("CISO").

companyName: Sonendo, Inc.

ticker: SONX


text: Our information risk management framework is designed to manage and protect against risks in three broad categories: (i) operational risk; (ii) financial risk; and (iii) safety, environmental, and regulatory risk. We consider and evaluate reputational risk as an element of each of these risk categories.


text: We conduct regular security and awareness training for all new hires and for current employees. Employees are required to apply risk assessment processes and to professionally assess risks in the course of performing their job duties.


text: We conduct vulnerability scans of business critical systems on an annual, quarterly, and daily basis. We utilize external third parties to assist in assessing our systems, conduct scans and provide reports based on these scans and we address vulnerabilities as they are identified. We generally review current and prospective third party service providers for cybersecurity risks.


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Policy and Incident Response Procedure. The CISO reports directly to our Chief Executive Officer. Our CISO has over ten years of IT experience and nine years of significant experience managing cybersecurity threats across our industry. The CISO may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Management promptly updates our board of directors regarding significant threats and incidents as they arise.


text: Risk management and strategy We have established and maintain various information security processes designed to identify, assess, and manage cybersecurity risks to our critical computer networks, third-party hosted services, communication systems, hardware, software, and vital data, such as intellectual property, confidential proprietary information, strategic assets, and nonclinical/clinical trial data ("Information Systems and Data"). Our Chief Operating and Financial Officer, Vice President of Information Technology, cybersecurity business partner and IT & Legal teams collaborate to address cybersecurity threats and risks, leveraging our risk register when needed. Our VP of Information Technology, members of our in-house IT team, and our third-party cybersecurity business partner all play an active role in monitoring and assessing risks from cyber threats through a variety of methods including automated tools, third-party testing, tabletop incident response exercises, threat actor analysis, industry risk profiling, and collaboration with law enforcement.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: We employ a range of measures, processes, standards, and policies tailored to specific environments designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include data encryption, network security controls, secure physical facilities, employee training, access management, change management and comprehensive asset management, tracking, and disposal procedures.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security team, which includes our VP of Information Technology and third-party service providers, works with management to prioritize our risk management processes and take steps to mitigate cybersecurity threats that are determined to be more likely to lead to a material impact to our business. Key findings and status of the cybersecurity landscape are reviewed with the Audit Committee of our Board of Directors, or Audit Committee, which evaluates our overall enterprise risk.


text: We engage various categories of third-party service providers to augment our efforts in monitoring, identifying, assessing, and mitigating significant cybersecurity risks. These third-party service providers encompass a range of expertise, including professional services firms such as legal counsel, cybersecurity consultants with specialized knowledge, providers of cybersecurity software solutions, managed cybersecurity service providers offering ongoing monitoring, protection and support, external testing firms specializing items like penetration testing to evaluate vulnerabilities, and forensic investigators who are enlisted as necessary to conduct comprehensive investigations and assessments when specific incidents or breaches occur.


text: We enlist third-party service providers across our business functions, including application providers, hosting companies, contract manufacturers, and supply chain resources. Depending on the service type, data sensitivity, and provider identity, our vendor management process assesses cybersecurity risks and establishes corresponding contractual cybersecurity obligations, tailored to each provider's role and the nature of Information Systems and Data involved.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including under the section titled "—Risks related to employee matters, managing our growth and other risks related to our business."


text: Our Board of Directors retains responsibility for evaluating key business risks faced by the Company, including but not limited to information security. In part, our Board of Directors addresses its general oversight function by delegating the Company's cybersecurity risk management to the Audit Committee. The Audit Committee's responsibilities include supervising risk mitigation efforts related to cybersecurity threats, evaluating the sufficiency and effectiveness of information security policies and practices, and ensuring robust internal controls for information security.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our Vice President of Information Technology who has over 15 years of extensive experience managing cybersecurity programs, who reports into our Chief Operating and Financial Officer. The Vice President of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Operating and Financial Officer is responsible for approving budgets, aiding in the preparation for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response procedures involve escalating specific incidents to certain members of management as needed, including the Vice President of Information Technology, Chief Operating and Financial Officer and the Chief Executive Officer. The Chief Operating and Financial Officer collaborates with our incident response team, which includes members of our in-house IT, facilities, human resources, regulatory, legal, and communications teams, to address and resolve reported cybersecurity incidents. Olema's incident response procedures mandate reporting certain types of cybersecurity incidents to the Audit Committee and other agencies as required by law.


text: The Audit Committee periodically receives reports from the Vice President of Information Technology on the Company's significant cybersecurity threats, risks, and mitigation processes. The Audit Committee also receives various summaries, presentations, and reports pertaining to cybersecurity threats, risks, and mitigation.


text: We conduct annual risk assessments and penetration tests to identify cybersecurity threats, including assessments and tests with the assistance of independent third-party cybersecurity consultants. We also conduct assessments in the event of a material change in our business practices that may affect key information systems that are vulnerable to such cybersecurity threats. These assessments and tests are designed to assist in the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following risk assessments and penetration tests, we work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: As part of our risk management system, we also periodically provide company-wide cybersecurity training to our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage with external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, as well as to monitor and test the effectiveness of our safeguards. The head of information technology (IT), supported by external cybersecurity consultants and the IT Department, implements our cybersecurity risk management system. The head of IT regularly reports on cybersecurity matters to the Chief Financial Officer.


text: We evaluate the security practices of certain third-party service providers to identify potential cybersecurity risks, including by reviewing documentation concerning their security measures. Where appropriate, including for third-party contracts under which our data will be stored, we contractually obligate providers to implement and maintain reasonable administrative, technical, and physical safeguards and other security measures designed to maintain the confidentiality, security and integrity of our data, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has ultimate responsibility for oversight of cybersecurity risks, but primary responsibility for cybersecurity risk oversight has been delegated to the audit committee.


text: Our Chief Financial Officer and head of IT, advised by external cybersecurity consultants, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our head of IT has over 25 years of experience in information technology roles and over 8 years of experience in security roles in the biotechnology industry. Our Chief Financial Officer has approximately 7 years of experience overseeing IT-related processes (including cybersecurity processes).


text: The processes by which our Chief Financial Officer and our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes regular updates from the head of IT to the Chief Financial Officer, as well as periodic reports, as needed, from the Chief Financial Officer and the head of IT to senior management.


text: Our Chief Financial Officer and head of IT provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, the Company's risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Company and other affiliated entities managed by Apollo, and the Company relies on Apollo for assessing, identifying and managing material risks to the Company's business from cybersecurity threats.

companyName: Apollo Realty Income Solutions, Inc.


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance: As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with the Company's executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with the Company's management and its board of directors, as applicable, in a timely manner. • Technical Safeguards: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as the Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.