text: Our cybersecurity risk management program includes: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents to our critical systems, information and our enterprise information technology environment. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third Party Risk Management: We use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third party systems, including any service providers, suppliers, and vendors that have access to our critical systems and information. • Education and Training: We provide annual cybersecurity awareness training and on-going phishing simulation testing for our employees, incident response personnel and senior management in order to communicate evolving information security policies, standards, processes and practices and to provide them with the tools to make them aware of processes on addressing cybersecurity threats. • Incident Response and Recovery Planning: We maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.


text: We have not identified any specific risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section "Item 1A. Risk Factor—Risks Related to Healthcare Laws and Other Legal Compliance Matters—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Mereo BioPharma Group plc

ticker: MREO

secItem: Item 1C


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit and risk committee oversight of cybersecurity and other information technology risks. The audit and risk committee oversees management's implementation of our cybersecurity risk management program.


text: Material cybersecurity risks are identified by members of our team. Our Head of IT is primarily responsible for managing our cybersecurity risk assessment processes, including those described in "Cybersecurity Risk Management and Strategy" above, our security controls and our response to cybersecurity incidents, with assistance from third party service providers.


text: The audit and risk committee receives periodic reports and briefings from management on our cybersecurity risks. In addition, management updates the audit and risk committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The audit and risk committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including third party service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Fund has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations.

companyName: John Hancock Comvest Private Income Fund


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Fund. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund.


text: The Fund relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's cybersecurity program.


text: The Fund depends on and engages various third parties, including service providers, to operate its business. The Fund relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, including those related to the Fund.


text: Management's Role in Cybersecurity Risk Management The Fund's management, including the Fund's CCO and a Technology Risk and Information Security Committee (the "Committee") established by the Investment Adviser, manage the Fund's cybersecurity program. The CCO of the Fund oversees the Fund's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's CFO, General Counsel, and Director of Information Technology. The CCO has been responsible for this oversight function since the Fund's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Fund.


text: The Fund's Senior Management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition. The CCO monitors best-practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive company data. The CCO continues to work with key third-party service providers to monitor and support the control environment and breach notification processes.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Advisor and other third-party service providers. The Advisor manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Kennedy Lewis Capital Co


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Advisor's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Advisor when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the CCO of the Advisor regarding the overall state of the Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CCO of the Advisor, manage the Company's cybersecurity program. The CCO is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The CCO has been responsible for this oversight function as CCO to the Company since inception and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Advisor.


text: Risk Management & Strategy. AVD has adopted a comprehensive set of controls and processes to encourage a high level of awareness of, and responsiveness to, cybersecurity threats. The foundational document outlining the program is embodied in Registrant's Enterprise Information Security Policy (the "REIS Policy"). The REIS Policy establishes a framework for the continuous monitoring of its computing resources, the maintenance and reporting of audit logs and the assessment of events that could form the basis of a threat. In addition, the REIS Policy sets forth requirements for employee awareness training, user authentication, software usage restrictions and boundary protection, among other things. The policy also establishes an incident response plan, including back-up hosting, alternate processing and system recovery, along with assignment of responsibility and resources for those activities. Within the exhibit of the REIS Policy, management either working alone or, in case of greater complexity, with consultants, will assess an incident or series of incidents for materiality, taking into account the nature of the incident,, duration, the nature of data compromised, and the nature of damages (including with respect to reputational, third party, share price, and business interruption) and all within the context of the Company's financial performance during the affected reporting period(s).

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: Furthermore, AVD has taken measures to prevent cybersecurity breaches, to minimize threats and, to the extent possible, to anticipate trends and identify vulnerabilities before arising to the level of an incident. In short, AVD is pro-active in its approach and has formulated a specific plan to investigate, respond and minimize loss of functionality or other damage from an incident. There are no cybersecurity threats, including as a result of prior incidents, that have materially affected the Company, including our business strategy, results of operations or financial condition as of the date hereof to our knowledge.


text: Governance. The REIS Policy has been drafted in collaboration with one of the largest IT solutions providers in the field and was modeled after NIST standards relating to governance, documentation and processes. The Company is implementing the REIS Policy through its Cyber and Privacy Risk Steering Committee (the "CPRSC"), which is chaired by the Chief Administrative Officer (who is also AVD's Risk Manager) and includes cross functional business process owners from operations, sales, marketing, finance and Human Resources, as well as our Director of Information Technology, who alone has over 30 years' experience in IT-related security and whose staff collectively has over 50 years' experience in this area. In addition, the committee is advised by a virtual Corporate Information Security Officer who works with the third-party solutions provider.


text: AVD's Board of Directors maintains oversight of cybersecurity planning, response and reporting as follows. The Lead Director, Scott Baskin, who also serves as Chair of the Risk Committee and member of the Audit Committee, is Cybersecurity Liaison to AVD's management team. The Chair of the CPRSC reports on cybersecurity preparedness, issues and incidents to the Cybersecurity Liaison regularly. Through this reporting structure, the cybersecurity team has direct interaction with the highest level of the Board and with both the Risk and Audit Committees. Cyber risk has been a subject of regular review and discussion at the Risk Committee for several years. With the advent of the CPRSC, the delineation of governance and responsibility has become that much more focused.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing the risks from foreseeable cybersecurity threats and for detecting and responding to any cybersecurity incidents. These policies and processes are built into our information technology ("IT") function and are designed to align with the NIST Cybersecurity Framework, published by the U.S. National Institute of Standards and Technology.

companyName: Invivyd, Inc.

ticker: IVVD


text: We have adopted an IT Security Management Policy ("IT Policy") to establish the requirements for securing and managing our IT assets and data, as well as an Incident Response Policy designed to coordinate the activities for preparing for, identifying, responding to, and recovering from cybersecurity threats. Our Head of IT is primarily responsible for implementing and overseeing the IT Policy, which is applicable to all our employees and contractors, as well as any third parties with access to our IT assets and data. Our Head of IT is also primarily responsible for leading incident response services under the Incident Response Policy. Our Head of IT leverages over 20 years of experience in various cybersecurity functions. As part of our overall risk mitigation strategy, we maintain an Enterprise Risk Register to identify, prioritize and track system risks, including cybersecurity risks. Additionally, we maintain cybersecurity insurance; however, such insurance may not be sufficient in type or amount to cover the total losses or damages related to a cybersecurity incident.


text: We implement technical, physical, and organizational measures designed to manage and mitigate risks from cybersecurity threats. For example, we employ multifactor authentication, single sign-on, and email filtering services across our systems. Additionally, we conduct monthly video-based cybersecurity awareness trainings across our workforce, which cover relevant topics such as social engineering, phishing, password protection, confidential data protection, and mobile security. We regularly perform company-wide phishing tests. We currently leverage multiple third-party service providers to assist in monitoring, managing, and detecting cybersecurity threats and conducting periodic vulnerability assessments of our critical assets.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents.


text: While our Board of Directors has overall responsibility for risk oversight, the Audit Committee of our Board of Directors (the "Audit Committee") is responsible for overseeing our cybersecurity risk management and strategy. The Audit Committee reviews and discusses with management and the Company's auditors, as appropriate, our risks relating to data privacy, technology, and information security, including cybersecurity and back-up of information systems. The Audit Committee also confers with management and our auditors, as appropriate, regarding the adequacy and effectiveness of our policies and the internal controls regarding information security.


text: Our Head of IT meets regularly with our Chief Operating Officer to discuss our cybersecurity threat landscape, address open gaps and issues, and evaluate solutions to cover any identified gaps. Our Head of IT, in collaboration with members of senior management, reports relevant cybersecurity matters to our Audit Committee. For discussion of cybersecurity risks, please see Item 1A, "Risk Factors."


text: We design and assess our program based on guidance from the National Institute of Standards and Technology (NIST) and other industry sources. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST publications and other sources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Operating Officer (COO) or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our COO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity technologies, and controls and processes to aid in our efforts to assess, identify, and manage such risks.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: We are subject to cybersecurity threat risks associated with our use of third-party service providers, including independent clinical investigators, contracted laboratories and contract research organizations. Cybersecurity considerations affect the selection and oversight of these third-party service providers.


text: We engage certain external parties, including cybersecurity and privacy firms and consultants, to provide IT support and cybersecurity oversight, and enhance our risk reduction abilities, including the engagement of a third-party to review our cybersecurity program to help identify areas for continued focus and improvement. We also use automated tools designed to monitor, identify, and address cybersecurity risks.


text: As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. We are in the process of formalizing an incident response plan. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Head of Information Technology, who reports directly to the Chief Operating Officer, has day-to-day responsibility for preventing, mitigating and remediating cybersecurity threats and incidents. The individual currently serving in this role has two decades of experience in information technology and cybersecurity. Our Disclosure Committee evaluates the materiality of any threats and/or incidents to determine if there is any required disclosure. Our external SEC counsel is also apprised of certain threats and/or incidents that may occur and is available to advise management on any disclosure obligations.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Periodically, the Audit Committee receives an overview from our Head of Information Technology of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Cybersecurity Risk Management and Strategy Candel has implemented cybersecurity risk management processes that are informed by industry standards in accordance with the scale of our business. Our cybersecurity risk management processes are designed to assess, identify and mitigate risks from current and emerging cybersecurity threats.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: We use various tools and processes to accomplish these objectives, including policies and procedures, risk assessments, and testing. Further, we require our employees to participate in cybersecurity risk awareness trainings and phishing exercises.


text: Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. We rely on a third-party service provider to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.


text: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Vice President of Regulatory and Quality Assurance, Chief Executive Officer, and GxP Systems Director, and, where appropriate, to the board of directors. To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Governance The board of directors has delegated oversight of the Company's cybersecurity risk management program to the Audit Committee, including responsibilities for reviewing and discussing cybersecurity risks, implementing risk management programs, controls and procedures, and performing high level reviews of the threat landscape.


text: Our Senior Director, Information Technology (Senior Director, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual occupying this role has over thirty years of experience with information technology management and over five years of cybersecurity risk management.


text: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes. The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board on matters relating to cybersecurity risk management, as necessary.


text: Risk Management and Strategy We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.


text: We engage third-party vendors in connection with our cybersecurity risk monitoring and processes. These service providers assist in our design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.


text: Notwithstanding any of these measures, our systems and networks remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "If our security measures are compromised, or our information technology systems or those of our vendors, and other relevant third parties fail or suffer security breaches, loss or leakage of data, and other disruptions, this could result in a material disruption of our services, compromise sensitive information related to our business, harm our reputation, trigger our breach notification obligations, prevent us from accessing critical information, and expose us to liability or other adverse effects to our business." in Item 1A. "Risk Factors."


text: The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting.


text: Our Chief Information Officer is responsible for the oversight of our cybersecurity risks. We have implemented a security incident response plan and use this incident response framework as part of the process we employ to keep the Audit Committee and our executive management informed about cybersecurity risks and to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The plan is a set of procedures and tasks that our incident response team, under the direction of the Chief Information Officer, executes with the goal of ensuring timely identification and appropriate resolution of cybersecurity incidents. In addition, we validate compliance with our internal data security controls through the use of security monitoring tools.


text: Our Chief Information Officer has over 25 years of IT experience and has a thorough understanding of enterprise level cyber security framework. Our Chief Information Officer has also participated in cybersecurity reviews and implementations including various tools and platforms for over 10 years and drives strategic cyber security implementations based on industry best practices that helps us strengthen our security posture on a continuous basis.


text: Cybersecurity Risk Management and Strategy The Company maintains a cybersecurity program designed to detect, identify, classify and mitigate cyber security and other data security threats, as part of its efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, and non-public information about the Company. Our cyber security program is led by the Company's SVP, Head of Legal and Compliance.

companyName: Talis Biomedical Corp

ticker: TLIS


text: The Company and its third-party service providers conduct periodic risk assessments to identify significant cybersecurity threats that may affect information systems that are vulnerable to such cyber security threats and regularly review these risk assessments for changes in our business practices and the external cybersecurity landscape as well as the impact of our security processes. These risk assessments include physical, administrative and technical safeguards and involves identification of reasonably foreseeable internal and external risks and evaluation of the likelihood and potential damage that could result from the realization of such risks.


text: Following our risk assessments, we evaluate when and how to design, implement, and maintain reasonable safeguards to minimize the identified risks and address any identified gaps in existing safeguards, and proceed with such design, implementation, and maintenance as deemed appropriate. We also engage third-party service providers in connection with our risk assessment process and certain risk management processes. Our collaboration with these third-party service providers includes threat assessments and consultation on security enhancements, 24/7 monitoring and incident response support.


text: Cybersecurity Governance Our Board of Directors is focused on cyber security. Specific responsibility for cybersecurity oversight is managed by the Audit Committee. The SVP, Head of Legal and Compliance is responsible for the management and mitigation of identified risks and the presentation of any changes in risk factors, identified risks, overall cybersecurity efforts and upcoming improvements to the Audit Committee. The SVP, Head of Legal and Compliance is also responsible for the response to and the remediation and resolution of a security incident involving a potential or actual compromise of our proprietary information and/or personal information. The SVP, Head of Legal and Compliance reports to the Audit Committee quarterly with respect to the Company's cybersecurity infrastructure and risk assessment and reports any security incidents to the Audit Committee. The Audit Committee will report the Company's cybersecurity infrastructure and risk assessment and any findings and recommendations to the full Board of Directors for consideration if and when the Audit Committee deems it necessary or appropriate.


text: In the event of a cybersecurity incident, the Company's SVP, Head of Legal and Compliance is equipped with a well-defined Incident Response and Reporting Policy (IRRP) to guide response, reporting, and recovery actions. This IRRP includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident to functional areas as well as senior leadership and the Board of Directors, as appropriate.


text: Risk Identification and Management The Company has a cybersecurity Risk Management Policy in place that governs the life cycle in which cybersecurity risks, including: • Risk Identification: through various initiatives performed, including, annual assessments, penetration tests, Incident Response tabletop exercises, vulnerability scans, and cybersecurity reviews of critical third-party vendor engagements, etc. • Risk Evaluation & Treatment: Identified issues, vulnerabilities, and exposures are captured within the Company's Risk Register, which is updated periodically to reflect the most up to date treatment option selected by the Risk Owners. • Risk Reporting and Ongoing Management: Potentially material risks are shared as part of a monthly Cybersecurity Governance Forum, that's attended by leadership. Risk Mitigations are tracked to completion through various project updates.

companyName: Drilling Tools International Corp

ticker: DTI


text: The foundation of the Company's cybersecurity framework is based on written policies that govern different process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.


text: The Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, the Company cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents.


text: Leveraging the Company's Cybersecurity Risk Management & Governance process, it has identified cybersecurity risk factors that are inherent to the Company's business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which the Company is exposed. Additionally, mitigation of these risk factors is tracked by management as part of the Cybersecurity Maturity Roadmap.


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the manufacturing or distribution sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the Company's reputation, disrupt operations, increase costs, and impact revenues. • Nation state attacks due to current geopolitical and economic climate could impact oil and gas industry.


text: Engagement of Third Parties The Company uses an IT Managed Service Provider in conjunction with a Cybersecurity Advisory firm to perform various functions, guiding the Company's cybersecurity posture, and providing ongoing support to the Company's cybersecurity program. The Company has Incident Response retainer services that can be leveraged, when needed.


text: The Company uses a third-party external auditor to perform annual audits, which include cybersecurity components, and a cybersecurity advisory firm to conduct annual risk assessments and penetration tests.


text: To manage third-party risks, the Company has a Third-Party Risk Management Policy and procedures in place. The process involves performing reviews of the cybersecurity controls of third-party vendors that have access to the Company's confidential or sensitive information, or those who may have access to the Company's systems. Since the process was established, key critical vendors who may have material impact on the Company's confidentiality, integrity or availability of data were prioritized and reviews were completed. The review of other relevant third-party vendors upon onboarding began in January 2024.


text: Board Oversight of Cybersecurity Matters The cybersecurity dashboard with roadmap progress is shared with the board of directors regularly, which includes actions completed and any topics that need board awareness / sponsorship such as approval of budgets which include cyber security project initiatives.


text: An in-depth update regarding cyber security is discussed during quarterly meetings with the Audit Committee. The Audit Committee is ultimately responsible for overseeing management's execution of the Company's cybersecurity risk management program.


text: The Chief Financial Officer (CFO) and designees are responsible for reviewing and approving the Cybersecurity Risk Management processes, or exceptions to such processes. External Counsel is consulted on legal matters related to Cybersecurity Risk or Incident Management as deemed necessary by leadership.


text: Additionally, the Cybersecurity Risk Committee holds periodic Cybersecurity Governance Forums, in which detailed cybersecurity program updates and metrics are reported.


text: The Company's Chief Financial Officer and VP of Finance are responsible for the oversight and communication of cybersecurity threats and risks to the Company's Board of Directors. They meet regularly with the Board of Directors where a Cybersecurity roadmap progress is shared with the board.


text: Cybersecurity Risk Management and Strategy As a corporation committed to maintaining the integrity, confidentiality, and availability of our digital assets and sensitive information, the Company recognizes the critical importance of cybersecurity in today's interconnected business landscape. The Company's cybersecurity measures are designed to safeguard our systems, networks, data, and information from unauthorized access, disruption, or misuse.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: The Company recognizes that cybersecurity is fundamental to maintaining trust with shareholders, customers, and other stakeholders. By prioritizing cybersecurity as a strategic imperative, the Company strives to safeguard business operations, sensitive information, and integrity which preserves the value delivered to all our constituents.


text: Key components of the Company's cybersecurity program: • Risk Management: The Company continuously assesses and mitigates cybersecurity risks across the organization by leveraging industry best practices and frameworks such as NIST Cybersecurity Framework. • Governance and Oversight: The Company's Board of Directors (the Board) regularly reviews cybersecurity matters, ensuring alignment with business objectives and regulatory requirements. A designated Information Technology Strategic Committee, which includes many subject matter experts from the Board and Executive Management, meets quarterly to provide additional focus and expertise in this area. • Security Controls: The Company has implemented robust technical and procedural controls to protect information assets, including firewalls, intrusion detection systems, encryption, access controls, and multifactor authentication. These controls are tested periodically by external technology audit firms with penetration tests and security audits. • Policy Controls: Annually all employees sign off on the Company's data and device controls. The Company ensures that all information access points are the Company's assets and all data passing through these access points are accessible by the Company and can be deleted whenever the Company deems necessary. • Employee Training and Awareness: Ongoing cybersecurity training and awareness programs are implemented to educate employees about potential threats, phishing attacks, social engineering tactics, and best practices for safeguarding company information. • Incident Response: The Company maintains a comprehensive incident response plan to promptly detect, contain, and recover from cybersecurity incidents. Regular testing and simulation exercises ensure readiness and effectiveness of response capabilities. • Third-Party Risk Management: The Company regularly evaluates and monitors the cybersecurity posture of third-party vendors and partners with whom data is shared or relied upon for critical services, to ensure they meet the Company's security standards. • Continuous Improvement: The Company regularly reviews and makes enhancements to the cybersecurity program to adapt to emerging threats, technological advancements, and changes in regulatory requirements. Implementation of new technologies, practices, and infrastructures to target security vulnerabilities is ongoing. • Compliance and Reporting: The Company adheres to relevant cybersecurity regulations and standards applicable to our industry and maintains transparency by disclosing material cybersecurity incidents or risks in accordance with regulatory obligations. The Company had no material cybersecurity incidents in 2023.


text: Risk Management and Strategy Our information security program is still in its early developmental stages and an ongoing process. As a smaller organization, we are actively refining our information security program to more effectively address cybersecurity risks and threats. Our primary objective is to improve our ability to effectively identify, protect against, detect, and respond to potential cyber threats across all aspects of our operations.

companyName: META MATERIALS INC.


text: To strengthen the defenses of our information systems, we have already implemented foundational controls that secure our customers' and employees' data and data relating to our intellectual property, We are also currently developing and deploying other various security tools and measures. These include internal reporting mechanisms and frameworks, monitoring systems, and certain third-party programs and solutions, including penetration testing with third-party security firms.


text: Furthermore, we are in the initial stages of developing our policies and processes for managing third-party risks. While we expect our partners to maintain appropriate security measures, we are actively working with our partners to improve alignment of their security protocols with our expectations and policies. We plan to introduce a risk assessment process to continuously monitor and remain vigilant against potential vulnerabilities. In preparation, we have completed the first draft of our IT risk management framework. This sets the stage for adopting a widely accepted risk quantification model, which will be done in alignment with our business readiness. The model will help us to prioritize cybersecurity risks and guide the development of our security controls.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Overseeing our cybersecurity efforts and guiding our security initiatives is our Chief Information Officer, who brings over 25 years of experience in leadership roles managing cybersecurity and large-scale IT environments across both private and public sectors. Additionally, our team members involved in the security program are acquiring the necessary skills and knowledge to address emerging cybersecurity challenges.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to participants in preclinical studies and clinical trials involving certain of our product candidates. (Information Systems and Data).

companyName: Climb Bio, Inc.

ticker: CLYM


text: Members of our management team, with the assistance of third-party technical advisors, help identify, assess and manage our cybersecurity threats and risks. Our third-party technical advisors include consultants with over 20 years of experience in IT leadership as well as subject matter experts in cybersecurity that have extensive experience managing cybersecurity programs.


text: We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, remote wiping, threat detection, intrusion detection and prevention; conducting (through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, implementation of security standards and certifications, encryption of data in transit and at rest, network security controls, data segregation, access controls, systems monitoring, vendor risk management program, employee training and penetration testing.


text: As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging key third-party vendors and suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts.


text: We, like other companies in our industry, face cybersecurity risks in connection with our business. However, our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see "Risk Factors" under Part I, Item 1A of this Annual Report.


text: Our board of directors considers cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our management team provides periodic updates to the audit committee regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.


text: We maintain a data security plan designed to provide a documented and formalized information security policy to detect, identify, classify and mitigate internal and external cybersecurity and other data security threats. This cybersecurity program is based in-part on, and its effectiveness is measured using applicable industry standards, and is included into our overall enterprise risk management program.

companyName: Shimmick Corp

ticker: SHIM


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also: • assess and analyze baseline configuration standards to ensure that they meet the intent and effectiveness required for the overall safety and security (both logically and physically) of critical system components; • ensure the asset inventory for relevant system components is kept current and accurate; • ensure that network connection arrangement documents are kept current and accurate; • limit access rights to system components to authorized personnel only, with all end-users being properly granted access in accordance with stated access rights policies and procedures; • deploy anti-virus solutions on all applicable system components, with the respective anti-virus solutions being the most current versions available from applicable vendors, enabled for automatic updates and configured for conducting periodic scans as necessary; • provision, hardens, secures and locks down critical system resources; • use internal and external vulnerability scanning procedures, along with network layer and anti-hacking tests; • facilitate requests for validation of baseline configurations for purposes of regulatory compliance assessments and audits; and • provide mandatory training and optional certification accreditation for purposes of maintaining an acceptable level of information security expertise necessary for configuration management.


text: Conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology have been, and may in the future be, vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. For more information about these and other cybersecurity risks faced by us, see "Risk Factors – Risks Related to Our Business and Industry – We rely on IT systems to conduct our business, and disruption, failure or security breaches of these systems could adversely affect our business and results of operations" and "– Cybersecurity attacks on or breaches of our information technology environment could result in business interruptions, remediation costs and/or legal claims".


text: Our board of directors has ultimate oversight for risks relating to our data security plan. In addition, the board of directors has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing data security and cybersecurity policies and processes with respect to data privacy and cybersecurity risk assessment and management, reviewing steps management has taken to monitor and control such risks, and regularly inquires with our management team, internal auditors and independent auditors in connection therewith. The Audit Committee is also responsible for overseeing our investigation of, and response to, any cybersecurity attacks or threats.


text: We also have a dedicated team of employees overseeing its data security plan and initiatives, led by our Director of IT, and works directly in consultation with internal and external advisors in connection with these efforts. With over fifteen years of experience in the field of cybersecurity, our Director of IT brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: We have developed a procedure by which the board of directors and management are informed about relevant cybersecurity risks, allowing for effective cybersecurity oversight and the ability of the Company to monitor, prevent, detect, mitigate and remediate cybersecurity incidents. The results of the our evaluations and the feedback from its engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: In the event of a potential or actual cybersecurity event, the Director of IT immediately notifies general counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, hardware, software, and our high value data, including intellectual property, trade secrets, confidential and sensitive information (collectively, "Information Systems and Data").

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Our Chief Information Officer ("CIO") helps identify, assess and manage the Company's cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage, mitigate and remediate material risk from cybersecurity threats to our Information Systems and Data. Our Information Security and Privacy Policy includes standards for incident response, vulnerability management, data protection and logical access controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our Company's overall risk management process, which, in part, establishes intended uses of our computerized systems and identifies critical and/or material risks. After a system reaches operation, the risk management approach continues following standard processes for change control, system maintenance, logical access control, discrepancy management and periodic review.


text: We use independent service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats.


text: We have a vendor management process to manage cybersecurity risks associated with our use of independent service providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve varying methods of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our security measures, or those maintained on our behalf by CROs, service providers or other third parties, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our or others' information technology, software, services, networks, communications or data is compromised, limited or fails, this could result in significant fines or other liability, interrupt our development programs, harm our reputation, or otherwise adversely affect our business."


text: The Nominating and Corporate Governance Committee of our Board of Directors is responsible for overseeing cybersecurity risk management processes, including oversight and mitigation of risk from cybersecurity threats. The Nominating and Corporate Governance Committee receives reports from the CIO, Chief Financial Officer ("CFO") or their designee concerning the Company's material cybersecurity risks and the processes the Company has implemented in an effort to mitigate them.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CIO. The CIO and the CFO are responsible for overall cybersecurity risk management strategy and communicating material cybersecurity priorities to the responsible board committee. The CIO has relevant cybersecurity expertise such as: leading the enterprise IT Security program for 7 years and Supply Chain Cybersecurity efforts for 6 years at a large commercial stage biopharmaceutical company. The CIO and CFO undertake efforts to learn about the Company's cybersecurity threats by reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management follow our Information Security and Privacy Policy framework. This framework is designed to escalate certain cybersecurity incidents to certain management members (including the CIO and CFO) depending upon the circumstances. In addition, depending upon an incident's particular facts, the CIO, CFO or their designee report to the Nominating and Corporate Governance Committee of the Board of Directors for certain cybersecurity incidents.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our internal information technology policies which are inclusive of cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Cyber Security Committee, which is comprised of representatives from our business operations and support functions, assesses risks based on current risks we are aware of, probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Cyber Security Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: We collaborate with third party vendors as deemed necessary to assess the effectiveness of our information technology environment, which is inclusive of our cybersecurity prevention and response systems and processes. These third party vendors include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have implemented a third-party cybersecurity risk management process to conduct due diligence on external entities that are determined to be of higher risk due to the Sensitive Information that they have access to, including those that perform cybersecurity services.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "If our security measures are compromised, or the security, confidentiality, integrity, or availability of our information technology, software, services, communications, or data is compromised, limited, or fails, this could result in a material adverse impact" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, when applicable, and reports from the Chief Financial Officer on our enterprise risk profile on an annual basis. The Audit Committee reviews our information technology environment risk, which is inclusive of our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the prevention, detection, and mitigation efforts of our cybersecurity program, as well as our remediation of cybersecurity incidents, as applicable.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Head of Information Technology, and the Cyber Security Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of Information Technology has over 20 years of experience in information security and possesses the education, skills, experience, and industry certifications expected by our company of an individual assigned to these duties. The Head of Information Technology provides periodic updates on our information technology environment risk, which is inclusive of our cybersecurity risk profile, to the Board of Directors, which includes the Audit Committee members.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for the Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Agriculture & Natural Solutions Acquisition Corp

ticker: ANSC


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature such as data about our research and clinical trials ("Information Systems and Data").

companyName: SCYNEXIS INC

ticker: SCYX


text: Our information security function, which includes our information technology Managed Service Provider (MSP), helps identify, assess and manage the Company's cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; evaluating threats reported to us; and conducting vulnerability assessments.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response process; disaster recovery/business continuity plans; encrypting certain data; using network security controls; maintaining access controls; managing assets; and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) we prioritize our risk management processes to include mitigation of risks from cybersecurity threats that are more likely to lead to a material impact to our business; (3) management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example our information technology MSP.


text: We use third-party service providers to perform a variety of functions throughout our business, such as distributors and supply chain resources and contract research organizations (CRO) and contract manufacturing organizations (CMO). We have certain vendor management processes to manage cybersecurity risks associated with our use of certain providers, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. These processes may include information security questionnaires, assessments, and imposition of contractual obligations relating to cybersecurity.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors, through its Audit Committee, is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Human Resources & IT, who has over 22 years of human resources experience in various industries including in executive roles and has led our IT function since joining the Company. Management is responsible for budgeting, hiring appropriate cybersecurity personnel, and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Vice President, Human Resources & IT, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from company management, including our Chief Legal Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy Our process for managing cybersecurity risk is comprised of technologies, controls, and procedures designed to detect, assess, and manage threats and control access. We utilize a variety of systems, software, and services including firewalls, network and endpoint monitoring, anti-malware, detection and response, patch management, and backups to mitigate, identify, analyze, and respond to identified vulnerabilities and incidents in a timely manner.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: We evaluate our security posture on an ongoing basis via vulnerability scans, penetration testing, and threat intelligence monitoring. We periodically conduct third-party security assessments and regularly evaluate our processes against industry standard security frameworks. We conduct regular security training to elevate awareness and foster a security conscious culture among all employees.


text: We leverage third party service providers and solutions in many aspects of our operations. Our vendor management and oversight procedures include assessment of cyber security risk.


text: We do not believe there are any currently known cybersecurity risks that are reasonably likely to materially impact our business strategy, operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Our internal computer systems, or those of our third-party collaborators or other service providers, may fail or suffer security breaches and cyber-attacks, which could result in a material disruption of our development programs."


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors, or Board, and management.


text: The Audit Committee of our Board, or Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Potential material cybersecurity threat risks are also considered during Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of Information Technology who has served in various roles managing information technology and information security for over twenty-five years and reports directly to the Chief Executive Officer.


text: Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures. Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, and engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes that are designed to assess, identify and manage material risks from cybersecurity threats and includes: maintenance and monitoring of information security policies aligned with global regulatory controls; user and employee awareness of cyber policies and practices; simulated phishing exercises; information systems configuration management; identity and information asset protection; infrastructure security systems; and cyber threat operations with regular monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also maintain a cyber incident response plan designed to assist us in identifying, responding to and recovering from cybersecurity incidents. We use the findings from these and other processes to help us improve our information security practices, procedures and technologies. We also collaborate with third parties to assess the effectiveness of our cybersecurity program. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of material risks from cybersecurity threats, as well as to support associated mitigation plans when necessary.

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: Cybersecurity is integrated into our overall risk management systems, including our annual enterprise risk management, internal controls, business continuity and crisis management, third-party risk management, insurance risk management, and employee compliance processes. Our Cyber Incident Response Team, comprised of our Vice President, General Counsel and Corporate Secretary, our Executive Director, Accounting and Treasury, and our Executive Director, Information Technology, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.


text: As of the date of this report, there have been no cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business, strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on the Company, refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security, including cybersecurity incidents, could materially and adversely affect our business, results of operations and financial condition" in "Item 1A. Risk Factors."


text: While our board of directors has oversight responsibility for risk management generally, the Audit Committee is specifically responsible for overseeing our cybersecurity risk management program to ensure cybersecurity risks are identified, assessed, managed, and monitored. Our Executive Director, Information Technology, who has over 15 years of experience in the cybersecurity field, provides periodic updates to the Audit Committee in this regard, and details our cybersecurity program supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents, including those associated with our third-party service providers. The Audit Committee is responsible for updating our full board of directors on material risks from cybersecurity incidents or threats.


text: To meet our business objectives, we rely on both internal information technology (IT) systems and networks, and those of third parties and their vendors, to process and store sensitive data, including confidential research, business plans, financial information, intellectual property, and personal data of ours and our customers that may be subject to legal protection, and promote the continuity of our Company's supply chain. In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information.

companyName: KLDiscovery Inc.


text: Maintaining the integrity and availability of our IT systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented an Information Security Management System (ISMS) within which cybersecurity and risk management strategies are an integral part. The ISMS Committee, which is comprised of companywide and IT department senior management, creates and manages the processes, policies, and procedures for managing the overall security of the organization. The ISMS includes a risk management program designed to assess, identify, track, treat, manage and prevent strategic and operational risks that may impact our company's business model or operations with a focus on information security, including but not limited to cybersecurity risk, physical security risk, liability risk, innovative risk, competitive risk, and other potential unauthorized occurrences on or through our IT systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The Risk Subcommittee, a subcommittee of the ISMS Committee, comprised of IT and Information Security senior leadership, maintains a risk register of cybersecurity risks that are regularly monitored and meets once a month to discuss remediation plans and treatment progress for existing risks. New potential risks are submitted to the Risk Subcommittee as they are identified by personnel from across the Company, including executive leadership, managers, directors, analysts, and others. In compliance with our Risk Management Standard and Process policy, new potential risks are evaluated by the Risk Subcommittee to determine whether each risk is to be added to the risk register and analyzed for treatment. The Risk Subcommittee invites subject matter experts from across the Company to participate in remediation planning and treatment progress reporting sessions as part of the monthly Risk Subcommittee meetings. Members of the ISMS committee and the Risk Subcommittee report directly to the Chief Executive Officer who, in turn, reports to our Board. Our ISMS is informed by internationally recognized standards and is vetted and validated annually by external advisors or consultants.


text: We engage and consult with external assessors and consultants, on a regular basis, to evaluate our cybersecurity processes, including to anticipate future threats and trends, and their impact on the Company's risk environment. We have implemented a robust information security internal and external audit program that operates throughout the year. Our environment is tested annually against internationally recognized standards as well as locally (domestic) applicable standards. Findings and opportunities for improvement that result from such external audits are remediated to help our security posture remain current. Prior to and/or periodically throughout and engagement, we work closely with our clients and vendors on various security assessments that test our processes compliance with contractual requirements. We have also engaged a third-party vendor to conduct regular employee trainings on cyber and information security, among other topics.


text: We have established a Third Party Vendor Management program to oversee and identify material risks arising from cybersecurity threats associated with our use of third-party service providers. Our Third Party Vendor Management program includes a vendor risk assessment that is designed to ensure third parties engaged by us are monitored for suitability, sustainability, risk, performance of regulatory/contractual requirements and, upon reassessment, the continual ability to perform or outperform such evaluations. Risks associated with cybersecurity threats identified during the vendor risk assessment may be submitted to the Risk Subcommittee for evaluation and analysis. Informed by an internationally recognized information technology (IT) risk management standard and framework, we identify, analyze, evaluate, and remediate/treat information and cybersecurity related risks, and risks posed by third-party providers throughout the year in addition to the annual external audits and various client assessments we undergo.


text: We maintain a threat intelligence program that drives informed decision making and strategy development within our organization's Information Security Program. The threat intelligence program includes the review of cybersecurity incidents including root-causes-analysis and the deployment of tools and technologies to help prevent future incidents from occurring. Risks associated with cybersecurity threats are evaluated as part of our Risk Management process to determine, among other things, if the risks will materially affect our ability to adequately secure client data throughout the engagement. When deemed appropriate, business strategies are re-evaluated with risk from cybersecurity threats taken into consideration.


text: Our Board of Directors exercises oversight of the most significant cybersecurity risks, and for our processes to identify, prioritize, assess, manage, and mitigate those risks, through the review of Information Security reports presented by the Executive Vice President of Global IT and eDiscovery Operations, who has over 20 years of industry experience, and the Vice President and Chief Information Security Officer, who has over 20 years of industry experience and holds a wide array of industry certifications. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. When and where applicable, the Board of Directors provides input regarding the ISMS in response to the information security reports and as part of their corporate oversight responsibilities. The Board of Directors' input is leveraged by Senior Information Security leadership as they evaluate and develop plans for continuous improvements of our ISMS to address an evolving landscape of cybersecurity threats. The execution of the Information Security Management System is the responsibility of our Senior Information leadership and the Information Security team.


text: Our risk management program is led by senior management who meet regularly to assess, analyze, evaluate, propose, and approve treatment and or remediation projects for identified information technology risks (including cybersecurity risks and vulnerabilities). Our Executive Vice President of Global IT and eDiscovery Operations, who is a member of the Risk Subcommittee, reports to our Board of Directors via our Chief Executive Officer. Our Vice President and Chief Information Security Officer (VP, CISO) is responsible for the identification of cybersecurity risks and the performance of vulnerabilities assessments. Risks and vulnerabilities are assigned to key stakeholders and senior management staff who possess the technical know-how to own these identified risks and vulnerabilities. In accordance with this process, the VP, CISO collaborates and works closely with risk owners to ensure the timely remediation and treatment of risks and vulnerabilities.


text: As of December 31, 2023, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Privacy and Cybersecurity Risks."


text: Cybersecurity Risk Management and Strategy We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, any cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate such incidents as well as to comply with applicable legal obligations.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture of such providers according to the perceived level of risk and in accordance with industry standard best practices.


text: Our Senior Director of Information Technology and Cyber Security, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities of the Senior Director of Information Technology and Cyber Security include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Senior Director of Information Technology and Cyber Security has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.


text: In an effort to deter and detect cyber threats, we provide all employees, including any part-time employees, with a data protection, cybersecurity, and incident response and prevention training program designed to educate employees on the importance of identifying and reporting all potential data security incidents immediately. The training covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial data ("Information Systems and Data").

companyName: CalciMedica, Inc.

ticker: CALC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and disaster recovery plan, disaster recovery testing, data encryption for certain data, asset management, system monitoring and multi-factor authentication for certain systems, employee training and cybersecurity insurance.


text: We use a third-party information technology consultant to help identify, assess and manage the Company's cybersecurity threats and risks. This consultant reports to and works with our management team, including our Chief Scientific Officer and President and Chief Operating Officer to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools including for example by subscribing to reports and services that identify cybersecurity threats, leveraging certain system monitoring tools, and leveraging tools provided through Microsoft Office 365.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our senior management works with our information technology consultant to evaluate material risks from cybersecurity threats against our overall business objectives.


text: We use third-party service providers, including cybersecurity consultants, to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations, contract manufacturing organizations, and other third-party service providers. We review the cybersecurity risks associated with the use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment and due diligence designed to help identify cybersecurity risks associated with a vendor, as well as the imposition of security related contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems, or those of our CROs or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.


text: Our Chief Scientific Officer and our President and Chief Operating Officer are responsible for engaging appropriate personnel and companies, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant employees and personnel. Our President and Chief Operating Officer is also responsible for managing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.