text: The Written Information Security Program ("WISP"), our enterprise information security and cybersecurity program, is incorporated within the ERM program and led by our Chief Information Security Officer ("CISO"). The WISP is designed to (i) ensure the security, confidentiality, integrity, and availability of our information systems and data (ii) protect against any anticipated threats or hazards to the confidentiality, integrity, or availability of such information and information systems and (iii) protect against unauthorized access to information or information systems that could result in substantial harm or inconvenience to us, our associates, or our clients. The WISP is built upon a foundation of advanced security technology, a well-trained team of experts, and is designed to operate in alignment with applicable regulatory requirements. WISP deploys multiple layers of controls to identify, protect, detect, respond to, and recover from information security and cybersecurity incidents. These controls are measured and monitored by subject matter experts and a security operations center with integrated cyber detection, response, and recovery capabilities. The WISP includes our Incident Response program, which manages information security incidents involving compromises of sensitive information, and our Security Incident Response Plan ("SIRP"), which provides a documented framework for handling high severity cybersecurity incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills around security matters at both a technical and management level, and our associates receive annual cybersecurity awareness training.


text: The WISP incorporates reviews by our Internal Audit department and external third-party experts. Periodic independent third-party maturity assessments are conducted against the NIST Cyber Security Framework. Investments in threat intelligence, collaboration with peers, vulnerability management, incident response drills, and participation in industry and government forums are also part of our program.

companyName: STIFEL FINANCIAL CORP

ticker: SF

secItem: Item 1C


text: Cybersecurity risks related to third parties are managed as part of our System and Services Acquisition Policy, which sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring, and termination. Our program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit, or destroy our information or have access to our systems may have additional security requirements, depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls. We also conduct reassessments of our third-party risk, using a risk-based approach to determine frequency. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that address the collection, use, sharing, and retention of user data, as well as compliance with appropriate security terms.


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. See Item 1A – Risk Factors" of this Form 10-K for additional information on cybersecurity risks.


text: Cybersecurity Governance Under our information security framework, our Board and our Risk Management Committee are primarily responsible for overseeing and governing the development, implementation, and maintenance of our WISP, with the Board designating our Risk Management Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least twice a year from our CISO or their designee. Our Risk Management Committee receives reports on cybersecurity at least four times a year, with ad hoc updates as needed. In addition, our Risk Management Committee annually approves our WISP program.


text: Our Operational Risk Committee ("ORC") provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor, and report information security risks associated with our information and information systems. The ORC escalates risks to the Risk Management Committee or our Board based on the escalation criteria provided in our information security framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Management Committee and the ORC. Our CISO leads the strategy, engineering, and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board and the ORC on our WISP, as well as ad hoc updates on information security and cybersecurity matters. Our CISO reports directly to the Risk Management Committee. The CISO has been with the Company since 2023 and has over 28 years of information technology and cybersecurity experience.


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are a part of our decision-making processes at every level. Our risk management team works closely with our Information Technology (IT) team including our IT and cybersecurity vendors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third Party Risk Because we are aware of the risks associated with third party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Legal and Compliance Officer (CLCO) and our Chief Operating Officer (COO) and on an ongoing basis by our IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats We have not encountered, to date, cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CLCO, our COO, and our IT personnel. In their time with our company, our CLCO and our COO have become increasingly involved in investigating, responding to, and mitigating cybersecurity incidents and intrusion attempts. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CLCO and our COO oversee our governance programs, test our compliance with standards, remediate known risks, and oversee or lead our employee training program.


text: The CLCO and the COO regularly inform our CEO and CFO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing our company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Monitor Cybersecurity Incidents Our CLCO, our COO, and our IT personnel are periodically informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CLCO and COO implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CLCO and COO, along with our IT personnel, are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Management's Role Managing Risk The CLCO and the COO play a pivotal role in informing the Board of Directors about cybersecurity risks. They provide comprehensive briefings to the Board of Directors, with a minimum frequency of not less than once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: In addition, at regular meetings of the Board, the Board members, including the CEO, and the CLCO and COO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board members actively participate in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The Board of Directors conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Board of Directors Oversight The Board of Directors as a group is responsible for oversight of cybersecurity risks and bears the primary responsibility for oversight of this domain. The Board has delegated to the Audit Committee the primary responsibility of overseeing risk management relating to cybersecurity. The Board of Directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing of both our digital and physical assets, maintain ongoing risk assessments, and monitor various third-party risk feeds. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program. Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have obtained a SOC 2 Type 2 Certification. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.

companyName: IonQ, Inc.

ticker: IONQ


text: Our security officer has over a decade of management and executive level information technology experience and reports to our SVP of Engineering and Technology. Our security officer is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, SVP of Engineering and Technology, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies. Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters. Where in the past we leveraged an outside fractional Chief Information Security Officer ("CISO"), during the year we transitioned to an in-house security leadership team. Our team includes personnel for supply chain security, governance risk and compliance and security engineering. We continue to leverage external industry partners in key areas including penetration testing, forensics, and for our security operations center. We use industry standard security tools across our program and reevaluate these annually as we digest the evolving threat landscape.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process designed to assess, identify, and manage material risks from cybersecurity threats. This process is supported by both management and our Board of Directors.

companyName: Zevia PBC

ticker: ZVIA


text: To prevent, detect, mitigate, and remediate information security threats, including a cybersecurity incident and/or threat, we maintain a cyber risk management process managed by our Senior Vice President, Operations ("SVP, Operations") who reports to our CEO and has seven years of experience overseeing information technology processes and procedures, including cybersecurity matters. The SVP, Operations works with the Company's Legal team on cybersecurity strategy, policy, training, standards, architecture, and processes. We have invested, and expect to continue to invest, in resources for the protection and safeguarding of our information technology systems, including, but not limited to, networks, applications, and outsourced technology services in connection with the operation of our business. We have implemented cybersecurity systems and controls based on industry best practices and the U.S. National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use such standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. These resources are designed to detect and respond to cyber incidents that may result in unauthorized access to, ransomware, damages, or destruction of, our information systems.


text: Risk Management and Strategy Cybersecurity risk is a direct responsibility of management and the Company's information technology ("IT") team, including our Director, IT who has over 15 years of experience building, implementing, and managing information systems, developing cybersecurity programs, and deploying risk mitigation strategies for such systems. Working cross-functionally with our Legal team, our SVP, Operations oversees the IT team that regularly monitors and assesses cybersecurity risks, implements measures designed to mitigate such risks and their associated effects on the Company and personal data collected, stored, and processed in our systems, and manages our information security training and cybersecurity awareness program. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: Our approach to cybersecurity risk management includes the following: • Multi-Layered Defense and Monitoring – We work to protect our computing environments from cybersecurity threats through multi-layered defenses and monitoring efforts to identify cybersecurity threats, and to help prevent future attacks. We utilize data analytics systems to detect anomalies and identify cyber threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use third-parties to conduct additional reviews and assessments. • Insider Threats – We maintain organizational controls such as limited access, and access removal for terminated employees, designed to minimize insider threats, and address potential risks from within our Company. Our measures and controls are informed by industry practices, and designed to be consistent with applicable law, including privacy and other considerations. • Third Party Risk Assessments – We conduct privacy and information security risk assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access are required to participate annually in training, including phishing simulations and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – Our standard terms and conditions contain contractual provisions requiring that our third-party suppliers disclose to us the technical and organizational measures they maintain, the standards and certifications by which they are evaluated for information and cyber security, and their cybersecurity insurance protection level. We seek to mitigate risk by evaluating the foregoing against any potential cyber-related risks depending on the nature of the services being provided.


text: Since the beginning of the last fiscal year, we have not identified any cybersecurity threat or incident that has materially affected the Company or our financial position, results of operations and/or cash flows, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. We continue to invest in the cybersecurity and resiliency of our networks and enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors" included in this Annual Report.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related data (collectively "Information Systems and Data").

companyName: MANNKIND CORP

ticker: MNKD


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of Information Technology, who has more than 30 years of experience of building and managing critical systems that house sensitive data, and a dedicated information security analyst with more than 15 years of experience in providing protection and resilience against evolving threats. Our Executive Director of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. This member of the management team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training that is provided to our employees and contractors, including those who are involved in incident response; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • assessment of cybersecurity risks posed by third parties, including current and potential collaborators, service providers, suppliers, vendors and other contractual counterparties, in each case, to the extent they have access to our critical systems or information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process— Our business and operations, or those of our CROs or other third parties, may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity, which could materially affect our business, results of operations and financial condition.".


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management where it deems appropriate regarding cybersecurity.


text: Our management team—including our Chief Information Officer and our Vice President, Information Security, Risk and Compliance—is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer and our Vice President, Information Security, Risk and Compliance have more than 40 years of combined experience in the field of IT.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our systems regularly face attacks that aim to interrupt and delay our operations or obtain information from our systems. Any major disruption or nefarious access, to our systems or a third-party's systems, could lead to disclosure or destruction of data, including employee, customer and corporate information, which may expose us to business, regulatory, litigation and reputation risk and could negatively affect our business and results of operations. As of the date of this Annual Report on Form 10-K, we have not encountered incidents from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. Refer to "Item 1A. Risk factors" in this Annual Report on Form 10-K, including "Significant disruptions of information technology systems, breaches of data security, or compromised data could materially adversely affect our business" for additional discussion about cybersecurity-related risks.

companyName: ARKO Corp.

ticker: ARKO


text: Until November 2023, our Board had oversight responsibility for cybersecurity threats, and the SVP of IT provided cybersecurity-related information to the Board on a periodic basis. In November 2023, the Board formed a Cybersecurity Special Committee which had oversight over our management of cybersecurity threats and until November 2024, was charged with periodically reporting on cybersecurity matters to the Board. The Cybersecurity Special Committee consisted of four independent directors. In January 2025, the Board changed the Cybersecurity Special Committee to be a subcommittee of the Audit Committee (the "Cybersecurity Subcommittee"). The Board's oversight, including through the Cybersecurity Subcommittee, includes receiving periodic reports from the SVP of IT and other information technology team members on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. In addition, the Cybersecurity Subcommittee is tasked with oversight of our annual cybersecurity assessment of key cybersecurity risks.


text: In November 2023, the Board adopted cybersecurity processes, which strengthened and formalized company-wide procedures related to identifying, managing and assessing cybersecurity threats. In the event of a cybersecurity incident which is potentially material, the SVP of IT must report such incident to the Company's CEO, CFO, General Counsel and the chair of the Cybersecurity Subcommittee, and these executives and board member determine whether, based on materiality or potential materiality, to report the cybersecurity incident to the Cybersecurity Subcommittee, which committee makes a determination if such cybersecurity incident requires a public filing.


text: Management's Role The Information Security function is led by the Company's Director of Cybersecurity & Architecture, under the direction of the Chief Information Officer ("CIO"). The Director of Cybersecurity & Architecture, assisted by a third-party fractional Chief Information Security Officer retained by the Company in August 2024, manages the Company's Cybersecurity program. The Company's cybersecurity management team includes members with relevant cybersecurity experience who hold cybersecurity certifications. Key responsibilities of this Information Security function include developing cybersecurity strategies; managing cybersecurity governance; performing cybersecurity risk assessments and tabletop exercises; ensuring compliance with security standards and regulatory requirements; managing identity and access; monitoring cybersecurity threats; validating cybersecurity alerts; preparing for and responding to cybersecurity incidents, business continuity and disaster recovery plans; and creating security awareness through periodic trainings of both Company leadership and Associates. The Company's CIO, Director of Cybersecurity & Architecture, and Chief Legal Officer ("CLO") have shared oversight responsibilities of the Company's Cybersecurity program.

companyName: SpartanNash Co


text: The Company's Board of Directors ("Board") has appointed the Audit Committee to assist the Board in fulfilling its responsibilities with respect to the oversight of cybersecurity, data security, privacy programs, and the Company's response to security breaches. Two Company Directors serving on the Audit Committee completed the National Association of Corporate Directors/Carnegie Mellon CERT cyber-risk oversight program along with required examinations and earned the CERT designation. The CIO provides at least quarterly updates to the Audit Committee on the Cybersecurity program, which include a current evaluation of the Company's maturity within the National Institute of Standards and Technology ("NIST") framework, including assessments against key performance indicators, updates on internal phishing campaigns, tabletop exercises conducted at various levels of the organization including with representation from the Audit Committee, and management training. The Audit Committee also reviews reports and recommendations from third parties periodically engaged by the Company to assess the cybersecurity control environment. In addition, the Company's Internal Audit function periodically audits elements of the security program and reports its observations to the CIO, CLO and the Audit Committee.


text: Risk Management and Strategy As a component of the Company's overall risk management process, which is aligned with a broader Enterprise Risk Management framework, the Company has implemented a multi-layered approach to minimize cybersecurity risk and safeguard its data. The Company conducts cybersecurity risk assessments on a regular basis and responds to identified risk exposures by employing a combination of risk mitigation strategies, including the adoption of cybersecurity controls and maintaining a cybersecurity insurance policy that provides coverage for security breaches. The Company engages third party consultants periodically to evaluate elements of the cybersecurity policy, processes, procedures and controls. The CIO and other members of the Executive Leadership Team respond to applicable recommendations arising from the third-party consultants. In addition, the Company engages a Qualified Security Assessor as part of the compliance requirements for Payment Card Industry ("PCI"). The Company also engages with a third-party risk management provider to ensure its vendors comply with internal security and privacy requirements and that key vendors are continually monitored for security risks. The Company's cybersecurity governance practices are based on the Company's common control framework which incorporates elements from the NIST Cybersecurity Framework, the Center for Internet Security's benchmark standards, and specific regulatory and industry requirements including Health Insurance Portability and Accountability Act and PCI.


text: The CIO provides at least quarterly updates on the cybersecurity program, including the results of the cybersecurity risk assessments and the related responses, to the Company's Security Governance Council composed of members of the Executive Leadership Team. The Company has a Cybersecurity Policy, Privacy Policy, Cybersecurity Incident Response Plan, and a materiality assessment framework inclusive of disclosure controls and procedures to assist the Company in satisfying disclosure obligations. The Company continually monitors cybersecurity threats and has a dedicated cybersecurity team in place to identify if any of the threats may lead to a cybersecurity incident. In the event of such an incident, the Company will take decisive measures to thoroughly analyze, contain, and eliminate the threat. The Company reviews cybersecurity incidents through a materiality assessment framework, which provides quantitative and qualitative considerations for evaluating the magnitude of an individual event. Based on the preliminary evaluation of an event, the Company's Cybersecurity Incident Disclosure Committee will convene to assess materiality and determine corrective actions and internal and external disclosure requirements. The Cybersecurity Incident Disclosure Committee is composed of the following individuals: the Chief Financial Officer, Corporate Controller, CLO, and CIO.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: As one of the critical elements of the Company's overall risk management, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology and other members of management of our Adviser that implement and oversee our Adviser's cybersecurity program.


text: Incident Response and Recovery Planning: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if a cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."


text: Cyber Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. This process is overseen by the Director of IT Operations and Information Security, or the IT Director, and includes periodic security assessments, audits, and testing, which are informed by industry standards and supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. We periodically engage with third parties to support these efforts. We maintain internal information security policies, including an incident response plan, which are reviewed by or at the direction of the IT Director and are updated periodically to reflect material changes and improvement in our information security practices. We have a process to assess and review the cybersecurity practices of third-party vendors and service providers prior to onboarding and periodically throughout the engagement, including through vendor questionnaires and contractual requirements, as appropriate.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Governance Related to Cybersecurity Risks The IT Director oversees and manages the day-to-day functions of our cybersecurity risk management program. The IT Director reports to the VP of Information Technology and Facilities, or VP of IT. The IT Director and VP of IT roles are both held by individuals who each have over twenty years of professional information technology, or IT, management experience. The VP of IT meets regularly with the Audit Committee to report on and discuss information security and technology risks to our business, including our cyber risk management programs, controls, and procedures. The VP of IT and the Audit Committee also conduct a high-level review of the threat landscape facing our business, discuss risk mitigation strategies, and the prioritization of our remediation efforts.


text: The IT Director meets periodically with members of the Relay Information Security Council, or RISC, which is comprised of the VP of IT and senior leaders from various functions, including finance, legal, human resources, corporate development, and research and development. The RISC provides input to the IT Director in connection with proposed cyber strategies as it relates to potential business impacts from new or proposed technologies and security solutions across the organization, including implementation strategies designed to address potential risks and disruptions to the business. In the event we or one of our business partners experiences a cybersecurity incident, the RISC is responsible for assisting in evaluating the incident, including whether any disclosure of the incident is required. The VP of IT reports to the Audit Committee on cyber initiatives and implementation resulting from RISC discussions.


text: Through the Audit Committee, the Board of Directors is informed of: (i) security initiatives, (ii) existing and emerging cybersecurity risks, including cybersecurity incidents; and (iii) any disclosure obligations arising from any cybersecurity incidents. The Board of Directors oversees our general risk management strategy and the most significant risks facing our business, and is responsible for ensuring that appropriate risk mitigation strategies are implemented.


text: Risks from Cybersecurity Threats To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to risks from cybersecurity threats that could have that effect, as further described in Part I, Item 1A "Risk Factors" of this Annual Report.

companyName: ZimVie Inc.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with various applicable security and/or technical requirements and best practices, including those established by the National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as a framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership from both TKO and Endeavor that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC systems and personnel. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members from both TKO and Endeavor. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to TKO's Cybersecurity Executive Steering Committee, which includes TKO's Chief Administrative Officer, Chief Legal Officer, Chief Financial Officer, Deputy Chief Financial Officer, Chief Accounting Officer, Chief Product & Technology Officer, Corporate Secretary and Head of Investor Relations, as well as Endeavor's Chief Financial Officer, Chief Accounting Officer, Chief Legal Officer, Chief Compliance Officer, Chief Information Officer, SVP, Internal Audit, SVP, Global Privacy & Cybersecurity, SVP, Cybersecurity, SVP, Head of Corporate Security and Chief Communications Officer. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.


text: Our cybersecurity risk management program, thus, includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a written cybersecurity incident response plan; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our personnel, incident response personnel, and senior management not less often than once per calendar year; • phishing simulations at regular intervals (not less than quarterly) to all users of the Company's email system; and • a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the Company or the Company's confidential or proprietary information or otherwise is connected to any Company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the Company's cybersecurity team may propose remediation measures (which are set forth in the contractual obligations to be agreed upon by the vendor).


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from TKO's Chief Information Officer and SVP, Global Privacy & Cybersecurity, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board receives regular updates regarding the Audit Committee's activities.


text: Our management team, including TKO's Chief Information Officer and SVP, Global Privacy & Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Global Privacy & Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. In 2024, TKO's SVP, Global Privacy & Cybersecurity, leads a team of three dedicated privacy professionals in the Legal department.


text: To address cybersecurity risks facing our organization, we have adopted a "continuous risk assessment" process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the effectiveness of our program and related controls. The results of that assessment are shared with management, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: We also have a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain and eradicate the issue and then restore systems in the event of a major disruption. Regularly, we conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: We have a commercial cybersecurity insurance policy that provides for coverage for losses sustained from cybersecurity incidents, subject to certain deductibles and limitations. However, costs and damages associated with cybersecurity incidents could exceed our commercial insurance coverage which could have a material adverse effect on our business, financial position and results of operations.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2024 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Information Technology - A cyber security incident could cause a violation of HIPAA, breach of patient or other persons privacy, or other negative impacts." under "Item 1A. Risk Factors."


text: Governance of Cybersecurity Cybersecurity is an integral part of our risk management program and is an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, including quarterly updates from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity, such as key risks facing the healthcare industry and our company, core topics, review of incidents, as well as progress against key information security initiatives. Senior executive leadership also engage in ad-hoc discussions with management on cybersecurity topics. In addition, our Board of Directors are provided with an annual report regarding cybersecurity information and related topics.


text: Our work on developing and implementing a process to oversee and identify risks from using third-party service providers, suppliers and vendors who have access to our critical systems and information is ongoing.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as, where it deems appropriate, any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, Chief Information Officer (the "CIO"), and Vice President and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO has over 20 years' experience managing the cybersecurity function across multiple companies. The information security team's experience includes security certifications in International Information System Security Certification Consortium ("ISC2"), Information Systems Audit and Control Association ("ISACA") and The International Council of E-Commerce Consultants ("EC-Council").


text: We have a security incident response framework in place. This is part of the process we employ to inform our management and Board of Directors about and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments of our policies and standards in relation to applicable state and federal statutes and regulations.


text: UHS also has a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain and eradicate the issue, and then restore systems in the event of a major disruption. Regularly, UHS conducts tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve recovery practices. As part of these processes, UHS regularly engages with assessors, consultants, auditors, and other third parties to review UHS' cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: UHS maintains a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2024 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Business Operations - A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts." under "Item 1A. Risk Factors."


text: During the year ended December 31, 2024, we did not identify any risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us. However, in the future, we may face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our operations could be disrupted by failure of our information systems or cyber-attacks."

companyName: Innoviva, Inc.

ticker: INVA


text: Our executive team, primarily consisting of our Chief Accounting Officer, Chief Financial Officer, and Chief Executive Officer, in conjunction with our information security team and third-party consultants, is primarily responsible in assessing and managing our material risks from cybersecurity threats. The qualifications of our executive and information security teams include a combination of formal education, current trainings and certifications in systems, network, and cybersecurity and over 50 years of combined experience in information technology and cybersecurity matters.


text: The security of our information technology systems and Company data is important to our operations and reputation. Accordingly, we are committed to identifying and managing cybersecurity risks. Our cybersecurity team performs periodic risk assessments and, on a quarterly basis, provides our Enterprise Risk Management Committee ("ERM") information related to the Company's cybersecurity, including statistics on attempted cyber-attacks, status of employee information security training awareness, and information on any security investigations. The cybersecurity team advises the ERM of significant global cyber events that occurred during the quarter and whether they impacted DIRTT. The cybersecurity team regularly discusses with the ERM the Company's cybersecurity posture and whether the Company should implement additional protections and controls to assist the Company in protecting, responding to, or mitigating potential future cyber-attacks.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: DIRTT's Senior Vice President of Technology ("SVP of Technology"), who reports to the President and Chief Operating Officer, is responsible for DIRTT's cybersecurity and has over 15 years of technology experience. The SVP of Technology is supported by dedicated cybersecurity staff and Governance, Risk and Compliance ("GRC") staff. DIRTT's cybersecurity team leader has over 20 years of experience in cybersecurity, multiple industry standard cybersecurity certifications, and extensive offensive and defensive cybersecurity tactical skills. DIRTT's GRC lead has over 20 years of GRC experience and industry standard certifications. Cybersecurity incidents, response and remediation activities and statuses are reported directly to the SVP of Technology.


text: Risk Management & Strategy Our management is principally responsible for defining the various risks facing us, formulating risk management policies and procedures, and managing our risk exposures on a day-to-day basis. Our information is processed, transmitted, and stored in a secure environment using hardened, proven enterprise-grade technologies to protect both our data and the physical computing assets. We guard against business interruption by maintaining a disaster recovery plan, which includes storing critical business information in multiple off-site data centers, testing the disaster recovery plan at a host-site facility, and providing fault tolerant devices, communication services, and utilities. We have independent third-party cybersecurity audits conducted no less than annually, following a framework modeled after the National Institute of Standards and Technology standard. We also have third-party security reviews and testing of our network, processes and systems conducted on a regular basis. We use internally developed proprietary software, cloud-based software as a service ("SaaS") as well as purchased software, with proven, non-proprietary hardware. While we believe that our internal policies, systems and procedures for cybersecurity are thorough, the risk of a cybersecurity event cannot be eliminated. We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply or our systems are compromised, we could be subject to government enforcement actions, private litigation and adverse publicity.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: The audit committee of the board of directors receives periodic reports from our Senior Director, IT & Facilities and third-party experts concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: CERUS CORP

ticker: CERS


text: We design and assess our program based on various cybersecurity frameworks, most prominently the Health Information Trust Alliance ("HITRUST") Common Security Framework, and Service Organization Controls ("SOC") 2, developed by the American Institute of CPAs. In 2024, our cybersecurity systems, supporting infrastructure and EOS products received HITRUST e1 certification as they met the HITRUST CSF v11.20 certification criteria. We use this cybersecurity framework and information security controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: The Company has implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to the Company's internal information systems and its services. The Board of Directors has direct oversight of the Company's risk management process and the management of cybersecurity risks. Under the direction and supervision of the Company's Chief Financial Officer, the Company conducts periodic risk assessments, which include cybersecurity risks. Management provides a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: The Company's Director of Technology, reporting to the Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats, and preparing updates for the Board of Directors. The Director of Technology has a combined twenty-one years of experience leading and working on cybersecurity teams at the Company and other companies in the oil and natural gas industry, has significant experience with networking, on-premises and cloud-based infrastructure, and cybersecurity controls, and has a Bachelor of Science degree.


text: When the Company experiences a cybersecurity incident, the Director of Technology will inform the Cybersecurity Committee, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and, in particular, whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors provides oversight of the Company's response to such incident, including considerations around disclosure of the event. The Cybersecurity Committee continuously monitors incidents as they are remedied to ensure proper remediation and, if necessary, the ability to report to the Board of Directors if previously unknown material information arises during such remediation.


text: The Company's information technology systems are in some cases integrated, such that damage, disruption or shutdown to one system could result in a more widespread impact on the Company's systems as a whole. If the Company's information technology systems suffer severe damage, disruption or shutdown, and its business continuity plans do not effectively resolve the issues in a timely manner, the Company's business could be negatively affected. In addition, cyber-attacks could lead to potential unauthorized access and disclosure of confidential information, data loss and corruption, see "Item 1A. Risk Factors" under the heading "The Company relies on information technology, and if it is unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, its operations could be disrupted and its business could be negatively affected" of this Annual Report on Form 10-K. A cybersecurity incident could materially harm the Company's reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events.


text: Our Company places a high priority on cybersecurity, information security, and securing confidential business information and personal information that we receive and store related to our customers and employees. Our Company's Audit Committee oversees the cybersecurity risks faced by the Company. In connection therewith, a Cybersecurity Steering Committee, which consists of our Chief Financial Officer, Chief Operating Officer, General Counsel, Vice President of Software Development, and Vice President of Regulatory Affairs, was formed to identify material risks and cybersecurity threats arising in our business.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: Our Audit Committee receives updates from the Cybersecurity Steering Committee at least annually, which cover topics related to information security, privacy, and cyber risks and risk management processes, including the status of significant cybersecurity incidences and projects designed to strengthen our information security posture. Our Audit Committee is also responsible for ensuring that the Board of Directors also receives periodic reports with respect to the status and management of our cybersecurity risks.


text: The Cybersecurity Steering Committee, in collaboration with delegates from our business and functions, is responsible for implementing the Company's enterprise-wide cyber security and information security strategy, employee training and compliance, and managing policies and processes for the Company's information technology standards, product security, and privacy. As a member of the Cybersecurity Steering Committee, our Vice President of Software Development provides experience devising effective cybersecurity management practices in the areas of both software and product development, including risk evaluation, impact assessment, security threat modelling, cybersecurity mitigation strategies, residual risk acceptability and methodologies for security risk verification. He has led the integration of our medical device software into some of the largest hospital and research institutions in the world in compliance with the extensive cybersecurity requirements of these institutions. In addition to utilizing internal Company resources, the Cybersecurity Steering Committee also regularly consults with external advisors and specialists regarding opportunities and enhancements to strengthen its practices and policies. We also engage with third-party consultants to manage the infrastructure and security of our information technology landscape.


text: Our cybersecurity program includes: • Penetration testing of internal information technology systems and review of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • Phishing, social engineering, and cyber hygiene training; • Continuous security event monitoring, management, and incident response plans; • Continuous enhancements to security capabilities based on evolving threats; • Information security policies and procedures; • Privacy controls and compliance with applicable legislative and regulatory requirements; • Assessment of applicable third-party vendors' cybersecurity and information security practices; and • A cross-functional approach to addressing cybersecurity risk with participation from representatives across the business and functions.


text: As part of our cybersecurity program, we have adopted an incident response plan, under which the Chairs of our Board of Directors and Audit Committee are informed by the Cybersecurity Steering Committee of any cybersecurity incidents that have the potential to materially adversely impact the Company or its information systems. To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, or in any penalties or settlements.


text: Risk Management and Strategy The Company's cybersecurity risk management strategy is comprised of several key elements. We assess our information technology and data management/storage systems and related policies and practices to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. We leverage a variety of technologies to attempt to mitigate the risk of cybersecurity threats and incidents. The Company has a multi-layer approach to its technology solutions, including employing applications used for perimeter, network, end point and application security as well as for data recovery, in each case tailored to the Company's systems, data, risk profile and mitigation strategy. From time to time, we use third-party service providers and software to augment and test our technology solutions and further support our risk mitigation strategy. Further, the Company maintains processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers.

companyName: CTS CORP

ticker: CTS


text: CTS uses a managed security services provider (MSSP) and other technologies to collect alerts and security audit logs, monitor and assess cybersecurity threat intelligence, and take actions to help us prevent, detect, mitigate and remediate cybersecurity incidents.


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate our systems) and test that awareness using knowledge assessments and simulations. The training is administered to employees on a rolling basis, and we use a third-party provider for the content and periodically update the training to incorporate new cybersecurity-related developments.


text: Like many other companies, from time to time, we detect attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. We have in the past been subject to cybersecurity incidents which have not had a material impact on our business or financial condition and expect that we will be subject to additional cybersecurity incidents in the future. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there can be no assurance that our efforts to prevent or mitigate cybersecurity incidents will be successful. Please see "Risks Related to Technology and Data Privacy" in "Risk Factors" in Section 1A of this Annual Report on Form 10-K.


text: Our cybersecurity program is overseen by our Vice President of IT & Digitization, who has over 14 years of experience working in various information technology roles and has managed and evolved the cybersecurity function at CTS for the past three years. Our Vice President of IT & Digitization is supported by a team of enterprise information system and security risk professionals (collectively, the "IT Team"), who are responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The IT Team includes a cybersecurity leader with over 30 years of experience in IT infrastructure, IT operations and cybersecurity, and members who hold Certified Information Systems Security Professional (CISSP) and Certified Information System Auditor (CISA) certifications and have experience developing and implementing enterprise-wide cybersecurity strategies and initiatives, managing risks relating thereto, and evaluating industry standards and regulations.


text: While our Board has the ultimate oversight responsibility for the risk management process, the Audit Committee is responsible for oversight of our cybersecurity strategy and risks. The Vice President of IT & Digitization and other members of management provide t he Audit Committee with quarterly and as needed updates on the Company's cybersecurity strategy and risks. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.


text: In the event of a reported potential cybersecurity incident, our IT Team decides whether such an incident triggers our Cybersecurity Threat Evaluation and Response Plan (the "Response Plan"). If triggered, the Company's cybersecurity response team, as needed under the circumstances (the "Cyber Response Team"), is convened. Members of the Cyber Response Team, as appropriate and as set forth in the Response Plan, are responsible for developing, recommending and implementing measures to address the cybersecurity incident, including when appropriate, assessing, containing and mitigating its impact, notifying members of the Company's management, the Audit Committee and the full Board of the cybersecurity incident, and coordinating external communications, in each case as appropriate under the circumstances. The IT Team is responsible for implementing and monitoring the effectiveness of any remediation plan adopted as a result of a cybersecurity incident.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. For example, we have implemented and maintain an incident response plan, and we utilize automated tools designed to maintain email security. We have also implemented a computerized system security and password policy that defines security for access to computer systems managed and controlled by us, and a procedure for computerized system incident management to address any unplanned issues in regulated computerized systems that could impact subject safety, product quality, and data integrity. We periodically conduct cybersecurity incident tabletop training exercises involving our personnel and plan to conduct similar training in 2025.

companyName: GERON CORP

ticker: GERN


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our head of Information Technology evaluates material risks from cybersecurity threats and reports periodically to the Audit Committee of our Board, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers such as Crowdstrike, cybersecurity service providers such as Mimecast, penetration testing firms, auditors, and professional services firms, including legal counsel. These relationships enable us to leverage specialized knowledge and insights, enabling our cybersecurity strategies and processes to remain consistent with industry best practices.


text: We rely on third-party service providers to perform a variety of functions throughout our business, such as contract manufacturing organizations, contract research organizations, suppliers and consultants, and third party logistics organizations and distributors to distribute RYTELO. We conduct quality audits of regulated vendors, which typically include an assessment of such vendor's information technology systems, and we impose appropriate contractual obligations on vendors pertaining to information security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our efforts may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Report, including "Risks Related to Information Technology Systems, Data Security and Data Privacy."


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including executive management. When appropriate given the nature of any potential cybersecurity incident, our executive management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, and to make any legally required notifications to individuals or regulatory agencies, including making any required disclosures under the Exchange Act.


text: Before engaging third-party service providers who may have access to the Company's, customer, employee or other sensitive data, or to the Company's systems, we perform due diligence in order to identify and evaluate their cyber risks, which includes self-attestation questionnaires (developed using Service Organization Controls (SOC) reports). This process is led by the Vendor Management team and includes participation of dedicated information security resources. Third-party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. After contract executions, third-party service providers deemed critical by our vendor management office undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan (Incident Response Plan), which is administered by our Chief Information Security Officer (CISO) in close collaboration with our Director of Enterprise IT Risk. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents. The Incident Response Plan is intended to proceed on parallel paths in the event of a cybersecurity incident, including implementation of (i) forensic and containment, eradication, and remediation actions by information technology and security personnel and (ii) operational response actions by business, communications, and risk personnel. Our incident response team annually performs exercises to simulate responses to cybersecurity events.


text: The Incident Response Plan includes procedures for timely escalation and reporting of potentially significant cybersecurity incidents to the Company's Chief Operating Officer, Chief Financial Officer, Chief Risk Officer, our Board Risk Committee, law enforcement, government agencies and impacted parties, as needed.


text: Impacts of Cybersecurity Incidents To date, the Company has no knowledge that we have experienced a cybersecurity incident that has or is reasonably likely to have a material impact on our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is a member of the Company's Corporate Operations group and reports to our Chief Information Officer, who reports to our Head of Operations, Technology and Products, who in turn reports to our Chief Operating Officer. Our CISO has cybersecurity experience spanning more than two decades. Prior experience includes senior security roles in large government agencies and Fortune 200 companies. He has spoken at area colleges and various industry events about information security. He holds a degree in electrical engineering, is a graduate of banking school, and maintains several industry certifications.


text: We recognize the importance of assessing, identifying, managing and mitigating material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to Topper Group employees or customers and violation of data privacy or security laws.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Substantially all our locations are branded fuel locations for which sensitive data related to debit and credit card transactions for fuel or merchandise products or services does not pass through our networks; rather, such information passes through the branded fuel supplier's (or its service providers') networks. However, in the ordinary course of our business, we collect and store sensitive data of certain of our dealer and tenant customers, suppliers and other business partners.


text: We have an enterprise-wide information security platform, which is part of our enterprise risk assessment process and designed to protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework. To protect our information systems from cybersecurity threats, we seek to use best-in-class security tools that help prevent, identify, escalate, investigate, resolve and recover from identified security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. We also maintain a third party security operations service to identify, prioritize, assess, mitigate and remediate risks. We rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and third party consultants, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We conduct "tabletop" exercises during which we simulate cybersecurity incidents to help us prepare to respond to a cybersecurity incident and to identify areas for potential improvement. We also provide employee training to support identification of and how to respond to cyber attacks. The results of these assessments are reported to the Board.


text: We also have implemented an incident response plan that is designed to facilitate our response to cybersecurity incidents and escalation of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us, to our executive officers, other members of our senior management team and other internal stakeholders. This plan is designed to provide our executive officers and other members of our senior management team with the information needed to assess the materiality of a cybersecurity incident and the need for public disclosure.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties and Topper Group employees) and other data, confidential information or intellectual property. To date, these incidents have no t had a material impact on our service, systems or business and we do not believe cybersecurity risks from these prior incidents are reasonably likely to materially affect our operations. For further information on cybersecurity risks and potential related impacts on us, see "Risk Factors – Our business and our reputation could be adversely affected by the failure to protect sensitive customer, Topper Group employee or the Partnership's vendor data, whether as a result of cyber security attacks or otherwise, or to comply with applicable regulations relating to data security and privacy."


text: The Director of Technology Services is responsible for overseeing the information security program as well as members of the Information Technology department that execute our program with oversight by members of our senior leadership team. These members of our Information Technology department have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance and systems. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board on any appropriate items.


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Board receives regular reports from our Director of Technology Services on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: We engage third-party service providers to conduct evaluations of our cybersecurity controls through penetration testing, independent audits and consulting on best practices to address existing and new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls. Going forward, we are committed to conducting these evaluations at least annually. To further enhance the capabilities of our internal systems, we utilize third-party vendors to provide extended coverage of our information technology and operational technology environments. We also share and receive threat intelligence with companies in the energy sector, government agencies, information sharing and analysis centers and cybersecurity associations in order to monitor and address developments in the cybersecurity environment.

companyName: TALOS ENERGY INC.

ticker: TALO


text: To serve as an additional protection from outside threats, we also seek to prepare our employees and contractors about cybersecurity risks through cybersecurity training, simulated phishing exercises and awareness campaigns. We conduct employee training bi-annually, and point-in-time training for any phishing failures. We have implemented software and processes and currently use a managed service to help identify and evaluate risks from cybersecurity threats associated with third-party service vendors. In the event of a cybersecurity incident deemed to have a moderate or higher business impact, we have an incident response plan to notify senior leadership and to address how to contain the incident, mitigate the impact, and restore normal operations efficiently.


text: Management's Role in Assessing and Managing Cybersecurity Threats — Our information technology team is responsible for assessing, identifying and managing cybersecurity risks. Top cybersecurity risks are also integrated into our overall ERM framework and overseen at the management level by the ERM Steering Committee. Our Director of Information Technology, who reports directly to the CFO and Executive Vice President ("EVP") and is a member of the ERM Steering Committee, is responsible for our efforts to comply with applicable cybersecurity standards, establish cybersecurity protocols and protect the integrity, confidentiality and availability of our information technology infrastructure. Technology and cybersecurity policy decisions are made by our Director of Information Technology in consultation with our CFO and EVP. In addition, our Director of Information Technology has a direct line of communication with the Office of the Interim Chief Executive Officer and General Counsel as needed. Our Director of Information Technology has over 20 years of experience in cybersecurity, holds a Master of Science in Cybersecurity from the University of Houston and is a Certified Information Systems Security Professional and a Boardroom Certified Qualified Technology Expert.


text: Impact of Risks from Cybersecurity Threats — The energy sector's growing reliance on information and operational technology to manage critical business functions has significantly increased the exposure to cybersecurity threats. The rising frequency and sophistication of cyber incidents, whether resulting from deliberate attacks or accidental breaches, pose substantial risks to the energy industry. As these threats continue to evolve, effectively preventing, detecting, mitigating, and responding to cyber incidents has become an ongoing and increasingly complex challenge. Regulatory compliance adds another layer of complexity, particularly as cybersecurity reporting and disclosure requirements continue to evolve. These regulations require prompt and detailed disclosures of material cyber incidents, demanding significant resources and well-structured internal processes to maintain compliance. Failure to meet these obligations could lead to legal penalties, heightened regulatory oversight, and reputational harm. Additionally, the constantly shifting regulatory landscape may introduce overlapping or conflicting requirements, further complicating compliance efforts. To minimize potential risks, it is essential to closely monitor these developments and incorporate them into our cybersecurity and regulatory compliance strategies.


text: As of the date of this Annual Report, we are not aware of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, although the Company regularly experiences cybersecurity incidents that are not deemed material to our operations. Examples of cybersecurity threats we face include incidents common to most companies in the energy industry, such as phishing, business email compromise, ransomware and denial-of-service, as well as attacks from more advanced sources, including nation state actors, that target companies in the energy industry. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely disrupt our operations, including our drilling operations, and affect our performance and results of operations. Although we believe we have implemented comprehensive cybersecurity measures, no security program is infallible. For additional information about cybersecurity risks, please see Part I, Item 1A. Risk Factors — Risks Related to our Business and the Oil and Natural Gas Industry — Our business could be negatively affected by security threats, including cybersecurity threats, terrorist attacks and other disruptions.


text: Cybersecurity Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: As part of our enterprise risk management program, our Board and the Audit Committee of our Board (the "Audit Committee") oversee cybersecurity risk management and meet with our senior management team, which includes our Chief Executive Officer, President, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Vice President - Technology assigned as the executive risk owner. Our Senior Vice President - Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President - Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board and Audit Committee, when appropriate.


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. Our cybersecurity risk management program is a key component of our overall risk management process, and includes similar characteristics, reporting channels and governance processes to those that apply across other legal, compliance, strategic, operational and financial risk areas within the Company.

companyName: Nuvalent, Inc.

ticker: NUVL


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: The audit committee receives reports from management on our cybersecurity risks at least annually. In addition, management updates the audit committee regarding all material cybersecurity incidents, as well as any incidents with lesser impact potential that management, in its discretion, determines may be relevant for audit committee review. The audit committee reports to the board of directors regarding its activities, including those related to cybersecurity.