text: Our information technology (IT) team leads the Company's overall cybersecurity efforts and is responsible for the day-to-day management of risks we face, while our Board of Directors/management provides guidance on the oversight of risk management. Our Information Security Incident Response Plan is designed to escalate cybersecurity incidents, depending on the circumstances, to appropriate stakeholders as defined by internal Standard Operating Procedures. As part of such process, the corporate IT Security Team receives aggregate monthly reports from a third-party managed services organization contracted to monitor the TGTX IT environment. Additionally, the Vice President of IT receives regular reports from the corporate IT Security Team concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. Significant events are reported to the Chief Financial Officer.


text: At AvePoint, cybersecurity risk management is an important part of our overall risk management efforts. We have a policy of transparency regarding our data collection, use, retention and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all AvePoint stakeholders and manage third party risk.

companyName: AvePoint, Inc.

ticker: AVPT

secItem: Item 1C


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although immaterial, there can be no guarantee that in the future such cyberattacks will not be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts.


text: We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. We have certified against, and demonstrated conformance to, the International Organization for Standardization's (" ISO ") information security management system audit using the 27701:2019 framework for the first time, and the 27001:2013, 27701:2019, and 27017:2015 frameworks. Successfully achieving these four certifications demonstrates our prioritization of security and privacy for both us and our customers and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our four ISO certifications add to the company's overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP, FedRAMP and StateRAMP. Regularly engage senior management on data privacy and security issues; Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; Train each of our employees on all privacy and security expectations;


text: Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint;


text: Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks;


text: Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; Complete several cyber-specific audits per year; and Engage consultants and other third parties in connection with our cybersecurity practices.


text: Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.


text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment (" TPA ") process. Under our TPA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.


text: Our Chief Risk, Privacy and Information Security Officer (" CISO ") leads the company's privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and in 2023, was named a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100 and named a Top Global CISO by Cyber Defense Magazine. In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the company's senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the company's privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies.


text: Disclosure of the Board ' s Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.


text: Nominating and Corporate Governance Committee Our Nominating and Corporate Governance Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CISO and Chief Compliance Officer, among other executives, provide periodic reports to our Nominating and Corporate Governance Committee and also meet with our Nominating and Corporate Governance Committee to discuss any material events when they arise. The periodic reports are designed to keep our Nominating and Corporate Governance Committee abreast of the Company's cybersecurity practices, as well as risks and trends in cybersecurity threats. Our Nominating and Corporate Governance Committee also has discussions with management focused on evaluating our exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable our Nominating and Corporate Governance Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to our Nominating and Corporate Governance Committee typically include information on any incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. Our Nominating and Corporate Governance Committee seeks these updates to facilitate proactive governance and to address emerging cybersecurity issues with management.


text: In 2023, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: CoreCard's information technology network, infrastructure, and software systems, including integration points to third parties related to the FinTech services the Company offers, are critical to the Company's business and operations. The Company holds confidential, proprietary, and personal information about its customers, its customers' customers, employed or contracted personnel, and third-party vendors. In addition, the Company's business in the FinTech industry requires it to be compliant with Payment Card Industry (PCI) Data Security Standards and U.S. and foreign data and information security mandates specific to its operations and services. To address these items, CoreCard has developed a robust cybersecurity risk management program focused on identifying, assessing and managing cybersecurity risk. The program involves a dedicated team responsible for operational cybersecurity, and includes an internal IT Security Team, PCI Compliance Force, and Emergency Management Team, which together are responsible for developing and executing the Company's cybersecurity strategy and identifying and mitigating related risks.

companyName: CoreCard Corp

ticker: CCRD


text: The IT Security Team consists of five members, led by the Company's VP of IT, and focuses on the Company's overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the Company's Chief Technology Officer, and focuses on the Company's compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company's third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company's Emergency Management Team, which consists of seven members and is led by the Company's Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.


text: The Company has also designed its information technology systems and infrastructure to protect its and its customers' data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company's operation of cardholder data environments. The Company's cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting.


text: Our full Board of Directors oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.


text: The Company faces a number of cybersecurity risks in connection with its business. Based on the information the Company has as of the date of this Form 10-K, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. However, cybersecurity threats are constantly evolving, and many of the security measures that the Company has implemented must also evolve over time. While CoreCard seeks to utilize industry standard measures and tools to monitor and address these evolving threats, the Company may not be able to anticipate, prevent or mitigate its cybersecurity risks, the occurrence of which could result in significant legal and financial exposure, theft, damage to the Company's reputation, interruption of the Company's business operations, the loss of confidence in the Company's security measures, and harm to the Company's business.


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team ("SMT"), and, as discussed below, periodically to our Board of Directors. As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy ("ICSPP") and Information & Cyber Security Response Policy ("ICSRP").

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Our ICSPP is overseen by the SMT who is responsible for designating the CISO. The CISO is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO is charged with all logical security related matters, which include but are not limited to, PC/server security, network security, internet security, and database and application security. Our ICSRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the ICSRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of our company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.


text: Our company has engaged a third-party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through our company's information systems, the CISO and Incident Response Team ("IRT") will take immediate steps to mitigate the threat and assess any damages. Upon report from the CISO, the SMT will evaluate the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the Security and Exchange Commission's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.


text: Our company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect our company, our customers and themselves from cyber-attacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.


text: Our cybersecurity program interfaces with other functional areas within our company, including but not limited to, our company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable our company to leverage specialized knowledge and insights, ensuring its cybersecurity strategies and processes remain at the forefront of industry best practices. Our company's collaboration with these third parties includes regular audits, testing, threat assessments and consultation on security enhancements.


text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Our company recognizes the importance of safeguarding sensitive customer information. Therefore, the Board of Directors recognizes that the protection of this information ranks as one of our highest priorities. The Board of Directors is responsible for reviewing and approving the ICSPP and ICSRP at least annually and monitoring material risks facing our company.


text: The Board has tasked the SMT with overseeing efforts to develop, implement and maintain an effective information and cybersecurity program. The SMT designates the CISO who also serves as the IRT leader. As part of its oversight responsibilities, the Board of Directors is responsible for discussing with the SMT our company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including our risk assessment and risk management policies. The Board of Directors also monitors our compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, the Board of Directors reviews with the SMT significant areas of risk exposure involving cybersecurity.


text: At the direction of the SMT, the CISO and IRT monitor internal and external cybersecurity threats and review and revise our company's cybersecurity defenses on an ongoing basis. The CISO, together with other members of the IRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Board of Directors on a regular basis, and the CISO presents those reports to the SMT and Board of Directors and addresses any questions and concerns raised by the SMT and Board of Directors. At least annually, the Board of Directors meets with the CISO in person to discuss cybersecurity in greater detail.


text: Financial institutions have an obligation to customers, consumers and stakeholders to safeguard the confidentiality, integrity and availability of nonpublic, sensitive information and the information systems used to store, transmit or process such information.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Consistent with industry guidelines, such as the National Institute of Standards and Technology Cybersecurity framework, and regulatory requirements, guidelines and standards, b1BANK's information security and cybersecurity programs (collectively, "Program(s)") have been adapted to fulfill this obligation by establishing and employing administrative, technical and physical safeguards to maintain a secure and dependable infrastructure and environment. These Programs focus on identifying and addressing threats to the company and its customers and contribute corporate decision-making guidance for information security, cybersecurity and risk management objectives.


text: Defending against information security and cybersecurity (collectively, "Security") threats demands a concentrated, collaborative approach and, as such, supplementary programs and processes have been instituted into governing Security and risk management strategies.


text: Global threat intelligence is monitored for potential Security risks or vulnerabilities. These threats are analyzed for potential impact to the bank and are addressed in accordance with Program requirements. b1BANK's Chief Information Security Officer ("CISO") presents Security reports to the Operating Committee and Risk Committee of b1BANK's board of directors on a quarterly basis or as needed. These reports consist of significant Security events and issues, vulnerability metrics, and material risks. Additional reporting representing the overall state of the Program is presented on at least an annual basis to the full board of directors, which is responsible for overseeing Security functions and associated initiatives.


text: Security is embedded into our culture, being promoted through security awareness materials, mandatory testing campaigns and the mandatory annual review and acknowledgement of corporate Security policies and standards.


text: Business Continuity and Incident Response plans have been cohesively established and employed to provide frameworks for responding to and recovering from events such as natural disasters or security events. Our Director of Business Continuity and CISO, respectively, are responsible for the facilitation of these plans, as needed, and testing each on at least an annual basis. The owners of these plans are responsible for identifying an appropriate group of cross-enterprise subject matter experts and convening them to ensure a comprehensive response. These groups, under the leadership of our Chief Operations Officer ("COO"), provide appropriate internal notifications of material security events and response activities to our General Counsel, Chief Risk Officer, Chief Executive Officer, and board of directors or other appropriate corporate executives.


text: A Vendor Management program has been developed and employed to manage potential risks for third-party service providers, suppliers and external partners who have access to our confidential information. The effectiveness of these processes is verified by independent internal and external audit functions or organizations.


text: Independent internal and external auditors are engaged to perform Security assessments to determine the appropriateness and effectiveness of the overall Program. Supplementary self-assessments are performed as needed or as required by regulatory guidelines. Assessment results are evaluated to determine the scope of risk on the security of the bank and are addressed in accordance with Program requirements.


text: Our current CISO maintains appropriate security certifications and has over 20 years of experience in an information security role. The CISO manages a group dedicated to the security of the bank. This group is responsible for information technology monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO. Our CISO reports directly to our COO and oversees, is assigned the responsibly of and is held accountable for the implementation and monitoring of the Program. Our COO serves on the Risk Committee of the Board, chaired by a board director.


text: The Company engages in a continuous, focused risk monitoring process to identify the likelihood and impact of internal and external threats to our information security systems and data and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CISO and COO together lead efforts to design, implement and operate necessary controls commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the bank. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect b1BANK.


text: The Company conducts no business activities other than activities relating to capital management, stockholder relations, and acting as a source of financial strength for its subsidiary, the Bank. Cyber/information security is a significant and integrated component of the Company's risk management strategy. As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: BankFinancial CORP


text: Information Security Policy and Risk Management: The Bank maintains an Information Security Policy reviewed and updated as needed, and at least annually by its Board of Directors. The Boards of Directors of the Company and the Bank review a formal Information Security Report at least annually and also receive periodic reports on cyber/information security topics and matters.


text: As required by federal banking laws and regulations, the Bank's cyber/information security risk management practices include risk assessments, controls and practices specifically for cybersecurity, information technology deployment and third-party information technology vendor risk management.


text: The Bank conducts an extensive training program, from entry-level to executive-level, focused on information security and customer data privacy. As part of its Enterprise Risk Management protocols, the Company and the Bank maintain insurance policies appropriate for the scope of its operations, including coverage for risks related to cyber/information security and customer data privacy.


text: Information Technology & Information Security Audits. The Bank conducts independent external and internal audits of internal controls relating to information technology and information security in accordance with standards established by the Federal Financial Institutions Examination Council (FFIEC). Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review and monitor the effectiveness of the Bank's internal controls, including those controls related to information security, based on independent external audit and internal audit reports. The Chief Audit Officer, who is also a Certified Information Systems Auditor, coordinates the external and internal audit plan and reporting functions for the Bank.


text: Information Security Management. To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank's Information Security Program. The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third-party vendor management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Company engages qualified third-party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.


text: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats. Information security management is conducted by the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) of the Bank. The CIO has ten years' experience with the Bank, including information security technology deployment and previous information technology audit experience. The CISO has more than 15 years of experience with the Bank, with expertise in large-scale systems information security and customer data privacy management.


text: The CIO monitors, evaluates and adjusts the Bank's Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, technology development initiatives, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems. The Management Audit/Compliance Committee reviews and coordinates the status and results of information security controls, network penetration, business continuity/disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Technology Coordinating Committee of the Bank, and presents cyber/information security updates on a periodic basis to the Chief Executive Officer and the Bank's Board of Directors.


text: Our employees are the first line of defense with respect to cyber/information security protection. Each employee is responsible for protecting Bank and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from cyber/information security threats and activities intended to compromise cyber/information security.


text: Customer Data Privacy. The Bank maintains and publishes its Customer Data Privacy Principles on its official website. The Principles include disclosures of the use and sharing of certain customer information, as well as the significant restrictions the Bank places on such activities. In addition, the Bank maintains policies restricting the knowing use or collection of information about children under age 13 by the Bank, other than to provide parental notice or consent. The Bank also maintains policies and controls over the use of electronic mail solicitations, including a customer's ability to "opt-out" of electronic solicitations at any time.


text: The Bank maintains policies, controls and training programs concerning customer information security, including transaction processing. The Bank deploys universal conditional access policies, requires multi-factor authentication for external network access and on-line banking access by Bank customers, and maintains additional access controls for network security and transaction processing. The Bank also has policies and controls to identify, classify and limit access to non-public customer information, including a comprehensive third-party vendor management cyber/information security risk management program.


text: Customer Data Privacy Reviews. The Bank conducts independent external and internal reviews of internal controls relating to customer data privacy and data security in accordance with the requirements of the Gramm-Leach-Bliley Act, the Right to Financial Privacy Act, and standards established by the FFIEC. Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review the effectiveness of the Bank's internal controls, including those controls related to customer data privacy based on independent external audit and internal audit reports.


text: Information Security Incident Responses. The Bank maintains information security incident response plans for various information security/data breach scenarios. The Bank tests its incident response plans at least annually. Pursuant to applicable federal and state laws, regulations and FFIEC standards, the Bank maintains incident response notification procedures for affected customers, including notification of federal regulatory authorities and law enforcement. For the preservation of all possible avenues for law enforcement, the Bank does not disclose information security incidents to the general public unless required by law or as directed by applicable lawful authority.


text: OPKO Health, Inc. ("OPKO" or the "Company") is committed to the highest standards of cybersecurity, adhering to the SEC's definitions for 'Cybersecurity Incident,' 'Cybersecurity Threat,' and 'Information Systems.' Our focus is on safeguarding our digital infrastructure and sensitive data against unauthorized access and threats.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Risk Management and Strategy Risk Assessment and Management: OPKO employs rigorous assessment and management of cybersecurity risks, aligning with NIST and other industry standards. Our strategy is integrated into our overall risk management program, reflecting our commitment to safeguarding data.


text: Collaborative Approach: We utilize a cross-functional strategy, involving key security, risk, and compliance stakeholders, to preserve data confidentiality and manage cybersecurity threats. Technical Safeguards: Regular assessments and updates of technical safeguards are based on ongoing vulnerability analyses and threat intelligence.


text: Incident Response and Recovery: We have established comprehensive incident response and recovery plans, ensuring readiness and effective response to cybersecurity incidents.


text: Third-Party Risk Management: Rigorous controls are in place to mitigate risks associated with third-party service providers, including security risk assessments and contractual security requirements.


text: Education and Awareness: Regular privacy and security training for employees is conducted to enhance awareness and response to cybersecurity threats.


text: External Assessments and Attestations, and Certifications: Annual vulnerability and penetration tests and data privacy and protection reviews are performed by third-party experts. No significant findings were identified. OPKO maintains industry certifications such as SOC 2 Type 2 and PCI DSS attestations.


text: No Material Breaches or Incidents: There have been no material breaches or cybersecurity issues affecting the company. Consequently, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected, nor are they reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. As of the date of this filing, the company maintains that its cybersecurity measures have been effective in mitigating potential risks associated with cybersecurity threats.


text: Board Oversight: The Audit Committee of the Board has direct oversight, regularly reviews reports on cybersecurity risks and vulnerabilities. The Audit Committee is informed about risk assessments, progress of risk reduction initiatives, and feedback from external auditors. Our chief compliance & audit officer ("CCO/CAO") and his direct report, chief information security officer ("CISO"), have primary responsibility for assessing and managing material cybersecurity risks. The CCO/CAO reports to the Audit Committee, which is the primary governing body that drives alignment on security decisions across the Company. The Audit Committee meets at least four times a year on cybersecurity and such meetings are attended by the CCO/CAO, CISO, chief legal officer ("CLO"), chief financial officer ("CFO"), corporate controller, associate general counsel, and other senior company executives as needed to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Audit Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation.


text: Expertise and Leadership: Our Chief Compliance & Audit Officer (CCO/CAO) possesses over 27 years of experience in Cyber Security and IT Controls across various complex organizations, including initial tenure at Boston University Medical Center, followed by roles at PricewaterhouseCoopers, Biogen, Vertex Pharmaceuticals, and currently OPKO Health for the past 6 years. The CCO/CAO has a master's degree in Computer Science with a specialization in Cyber Security from Boston University, a qualifying UK law degree from the University of Edinburgh, an MBA in Accounting, and a Master's of Finance from Northeastern University, in addition to a BA in Economics from Dartmouth College.


text: The Chief Information Security Officer (CISO) brings over 27 years of experience in Cyber Security and IT Controls, with the last 15 years serving as CISO at OPKO Health and previously at Everest Insurance Corp. Prior experience includes several years at PricewaterhouseCoopers as an IT auditor and Cyber Security consultant. The CISO holds comprehensive Cyber Security accreditations and certifications, including CISSP, CISA, CRISC, CHP, CDRE, and MBCI, and has completed undergraduate degrees in Accounting and Computer Information Systems from Baruch College. The CISO oversees a department comprising five cyber security engineers with extensive experience.


text: Structured Data Requirement Consistent with SEC regulations, OPKO Health, Inc. commits to providing the information required by this Item in an Interactive Data File format, in accordance with Rule 405 of Regulation S–T and the EDGAR Filer Manual.


text: OPKO Health, Inc.'s strategic approach to cybersecurity governance, characterized by our rigorous third-party assessments, industry certifications, and a clear organizational reporting structure, underscores our unwavering dedication to safeguarding sensitive information and maintaining trust.


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, an indirect subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Bitcoin Trust ETF

ticker: IBIT


text: Risk Management and Strategy We perform a formal risk assessment each year. As part of its risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: The Audit Committee of our Board of Directors (the "Audit Committee") provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, management provides updates to the Audit Committee regarding its internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Management also reports any material risks from cybersecurity threats to the Audit Committee. Management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.


text: Our management team, specifically the chief executive officer and the chief financial officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including its third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risks titled " We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors. " No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: CYBERSECURITY RISK MANAGEMENT STRAGEY We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.


text: Our cybersecurity risk management program includes: physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; a security team responsible for managing our cybersecurity risk assessment processes and security controls;


text: the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls;


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, refer to Part I, Item 1A "Risk Factors."


text: The Audit Committee receives updates from our Chief Information Officer on our cybersecurity risks on a periodic basis or more frequently if needed, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, third party service providers and the current and emerging threat landscape. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our Board of Directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies and ongoing developments, on a periodic basis or more frequently as needed. The Board of Directors also receives updates from our Chief Information Officer on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our Board of Directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks from our Chief Information Officer as part of the continuing education of our Board of Directors on topics that impact public companies.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our Chief Information Officer's experience includes years of working in the cybersecurity field in various industries, including the financial services industry.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In the past year and with the guidance of a qualified third-party, we have made improvements in our cybersecurity program across the Company, and we have developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, we focus on our employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: CRAWFORD UNITED Corp


text: Our third-party advisor has performed cybersecurity risk assessments of our information technology security processes and implemented technologies to lessen risk. Using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across our networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we require employees to participate in training and testing programs through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Any potential cybersecurity incident is immediately reported the Chief Executive Officer and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns (including data privacy risk management) and the steps management has taken to monitor and control such exposures with management.


text: There have been no cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A. Risk Factors — "A significant disruption in, or breach in security of, our information technology systems or data could adversely affect our business, reputation and results of operations."


text: Risk Management and Strategy We rely on information systems to obtain, rapidly process, analyze, and manage data in order to effectively operate our business. We are committed to protecting our business information, intellectual property, customer, supplier and employee data and information systems from cybersecurity risks and maintain an active cybersecurity risk management program.

companyName: BROADWIND, INC.

ticker: BWEN


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We work to align to the National Institute of Standards and Technology (NIST) 800-171 Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information system professionals and third-party providers monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.


text: We also engage consultants and other third-party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with our third-party providers, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response.


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Director of Information Technology leads an internal team and works directly with our third-party information security professionals to manage our cybersecurity risk management program and activities. This includes monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies.


text: Our Director of Information Technology reports directly to our executive leadership team on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology team, led by the Director of Information Technology, meets regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics.


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit Committee. The Audit Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of information technology operations, including cybersecurity risks and information security. The Director of Information Technology reports to the Audit Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging through regular and requested updates on our strategy and evolving threat landscape.


text: We believe that cybersecurity is a critical part of our overall risk management, which is supported by both our management and our Board of Directors. We believe that we face the same external threats common to other participants in the infrastructure sectors, which include ransomware and malware attacks in addition to the risks brought on by the vendor supply chain. Through the leadership of our Vice President of Information Technology, who reports to our Chief Financial Officer, we routinely assess these threats and evaluate our landscape for new vulnerabilities, considering both for their probability of occurrence as well as their perceived potential impact. We supplement our risk assessment processes with robust identification tools which we review routinely through the use of intrusion prevention and detection systems. We supplement our internal procedures with third parties, who routinely assess our network infrastructure for vulnerabilities both internal and external to our firewall. We also conduct periodic training and awareness programs for all of our employees with systems access in order to drive adoption and awareness of their critical roles in cybersecurity processes and controls.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: The pace of change in approaches undertaken by cyber criminals requires an approach to security that strives for continuous improvement and constant monitoring of the landscape. While we are working to adopt the cybersecurity framework of the National Institute of Standards and Technology (NIST), we believe continued investment through parties external to our information technology team is the best means for extensively testing both the design and operational effectiveness of our cybersecurity controls, and ensuring their level of priority as compared to our other information technology objectives, namely system continuity and functionality.


text: Furthermore, through our incident response plan, we believe we have a well-designed plan to manage through any unforeseen breach including the eradication of the infiltrator from our networks. We carry cyber insurance to transfer the residual risk of an incident. We also work with our cyber insurance carrier to regularly refine our response procedures, which include the definition of internal and external communications channels to key stakeholders, as well as the identification of material breaches and the associated incident reporting up to senior management and our Board of Directors.


text: Our Board of Directors has charged the Audit Committee with the governance and oversight of this risk. Our governance philosophy is to discuss cybersecurity at least quarterly with our Audit Committee, as provided for within that committee's charter, including regular reporting by our Vice President of Information Technology with respect to key accomplishments, planned activities, and monitoring results. Board experience in risk assessment has been enhanced with certification achievements specific to cybersecurity risk, providing us with the appropriate oversight to this evolving threat.


text: As of the date of this report, we are not aware of any material breaches to our networks or computer systems that have materially affected or are reasonably likely to materially affect us, including the execution of our business strategy, results of operations, or financial condition. We describe potential risks from cybersecurity threats under the heading "Our information technology systems can be negatively affected by cybersecurity threats," in Part I — Item 1. "Risk Factors" of this 2023 Form 10 K, which disclosures are incorporated herein by reference.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted software as a service vendors, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our production server environments ("Information Systems and Data").

companyName: PlayAGS, Inc.


text: Our information technology team with oversight from our Chief Financial Officer as well as specific resources that manage our production server environment help identify, assess and manage the Company's cybersecurity threats and risks. The team includes credentialed professionals whose experience and current duties include the identification and management of cyber risks. Our information technology team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, internal and external audits, third party threat assessments, conducting vulnerability assessments, use of external intelligence feeds, subscribing to reports and services that identify a cybersecurity threats, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery plans, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information technology team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and penetration testing firm consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as third party content providers, application providers and contract manufacturing organizations.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the following:


text: We rely on information technology and other systems and any failures in our systems could disrupt our business and adversely impact our results.


text: Due to the ever-changing threat landscape, our operations and services may be subject to certain risks, including hacking or other unauthorized access to control or view systems. Our business is dependent on the security and integrity of the systems and products we offer.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Financial Officer.


text: Our executive team including our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer. Our information technology team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems.


text: The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board of Directors, through the Information Technology Steering Committee (ITSC) and Compliance Risk Management Committee (CRMC), provides direction and oversight of the risk management framework of the Company including cybersecurity risks. The ITSC and CRMC establish policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: The Committees have the authority to conduct or authorize reviews into areas within its scope of responsibility, which is all items impacting information security. The Committees focus on the following: Promote effective information technology and information security governance.


text: Critically evaluate and assess the direction and progress of major IT-related projects, IT security decisions, IT priorities, and overall IT and IT security performance. Review and approve significant IT and information security related policies, including annual changes. Review and approve IT and information security risk assessments on an annual basis. Discuss activities and requirements pertaining to the Information Security Program.


text: Oversee requirements of the Bank's Vendor Management Policy, including processes for approving third-party providers including the financial condition, business resilience, and IT security position of third-parties. Ensure risk assessments and New Vendor Relationship Information is completed for all vendor relationships. Review and approve risk assessments for significant, critical vendor relationships on an annual basis. Examine the Bank's Business Continuity and Disaster Recovery Plan, including updates and testing. Provide for comprehensive, effective, and, if required, independent audit coverage of IT risks and controls.


text: Analyze all regulatory examination reports and internal and external audit reports impacting information technology as well as any required responses and/or updates. Assess the performance of the Committee and the Committee's role and responsibilities on an annual basis.


text: Identify, analyze, and determine strategic risk tolerance and/or mitigation direction for compliance risks identified as high and/or those with an increasing risk profile.


text: Review all regulatory examination reports impacting compliance and/or risk as well as any required responses The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.


text: The Board of Directors, through the ITSC and CRMC, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board of Directors review and approve the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President.


text: The CIO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.


text: Management, including the CIO, regularly reviews with the Board of Directors the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Board of Directors outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. We recognize the critical importance of maintaining the safety and security of our systems and data and employ a multi-layered strategy for overseeing and managing cybersecurity and related risks. Our board of directors (the Board) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe we have not experienced any cybersecurity incidents that have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Risk Management and Strategy Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology (NIST), the Federal Financial Institutions Examination Council (FFIEC), and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment using the FFIEC Cybersecurity Assessment Tool that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.


text: Multi-Layered Defense and Continuous Monitoring - We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. We use a third-party Managed Security Service Provider (MSSP) to provide comprehensive cyber threat detection and response capabilities and maintain a 24x7 monitoring system which complements the technology, processes, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. At least annually, we engage third party consultants or auditors to assist in assessing, identifying and/or managing cybersecurity threats.


text: Information Sharing and Collaboration - We work with government, customer, industry and/or supplier partners, such as the Financial Services Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain.


text: Training and Awareness - We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate quarterly in required training, including privacy, phishing, and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.


text: Third-Party Service Provider Management – We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management, and the Board on our response to a cybersecurity incident.


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by external auditors and regulatory examiners. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. The Board receives regular reports from our Vice President Director of Information Security on various cybersecurity efforts, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. In addition, we have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: Management ' s Role Our cybersecurity program is coordinated by our Vice President Director of Information Security, who reports to our Senior Vice President Chief Risk Officer and Chief Administrative Officer, in partnership with our Director of Information Systems and Technology ("IS&T"). Our Director of Information Security started with us in 2012 and holds numerous credentials including: Certified Information Systems Security Professional, Certified Public Accountant, and Certified Fraud Examiner. The Director of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the IS&T team and our Managed Services Provider, who is overseen by the Director of IS&T. The Director of IS&T started with us in 2020, holds a Bachelor of Science in Business Administration, Information Technology and has over 14 years of direct experience managing information systems and technology. The Director of IS&T is responsible for implementing and maintaining the systems and tools to protect the technology stack we use. The Director of IS&T reports to the Senior Vice President, Chief Operating Officer.


text: HighPeak Energy maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Risk Management and Strategy The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an important component of our overall risk management strategy. HighPeak Energy's cybersecurity team consists of certain of our executive officers as well as internal and third-party cybersecurity personnel. The cybersecurity team, led by professionals with cybersecurity expertise across multiple industries, takes a cross-functional approach to addressing these risks and engages in discussions with the Board and our executive management team on an as-needed basis.


text: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. We also require our employees and contractors to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises to test the effectiveness of our incidence response plan ("IRP") and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. We use encryption methods to protect sensitive data. This includes the encryption of our customer data, financial information, and other confidential data. We have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: Third parties also play a role in the Company's approach to cybersecurity and its associated risk management framework. HighPeak Energy leverages technological tools and partners with the goal of augmenting and enabling the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is included in our internal auditing processes. In connection with and pursuant to the IRP, our incident response team, made up of management, employees and third-party cybersecurity personnel, works collaboratively across HighPeak Energy to carry out a program that has been designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to respond to potential cybersecurity incidents.


text: We have an IRP that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for investigations designed to help us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident.


text: The Board, in coordination with the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the Audit Committee include overseeing policies and management systems for cybersecurity matters and reviewing HighPeak Energy's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the Audit Committee receive regular presentations and reports on cybersecurity risks that address a range of topics, including developments, technological trends or tools, third party updates, and regulatory standards. The HighPeak Energy IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity with our executive officers and cybersecurity personnel.


text: Management plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in the HighPeak Energy IRP.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" for additional information.


text: Risk Management and Strategy The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Cohen & Co Inc.

ticker: COHN


text: The Company's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.


text: The Company contracts with external firms to assess the Company's cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: The Company engages in cyber crisis response simulations to assess the Company's ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures is subject to disciplinary action. The Company's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication and principles of Zero Trust to ensure that access to information and communication is vetted and secure.


text: The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate the Company's security posture. The Company also engages external firms to measure the Company's NIST CSF maturity level.


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.


text: Role of the Board and Management The Company's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. The Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Company's Management Cybersecurity Committee (the "Cybersecurity Committee"). Pursuant to its charter, T he Cybersecurity Committee must consist at least four (4) members of Company's executive management team, which shall include the Company's Director of Technology, Chief Operating Officer, Chief Compliance Officer and Chief Financial Officer, each of whom is required to have working familiarity, knowledge and competencies in relevant areas, including data privacy, public policy, information technology ("IT") strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company's Director of Technology has formal education in information technology and extensive experience working in and leading the Company's information systems and technology function.


text: Review and provide oversight on the effectiveness of the Company's information security and privacy policies and procedures with respect to its products and services and internal-use information technology systems;


text: Review and provide oversight on the policies and procedures of the Company in preparation for responding to any material information security or privacy incidents;


text: Review and provide oversight on the Company's disaster recovery, business continuity, and business resiliency capabilities, including escalation protocols, relating its customer-facing products and services and internal-use information technology systems; Review annually the appropriateness and adequacy of the Company's cyber-insurance coverage;


text: Review and provide oversight on the policies and procedures of the Company with respect to data privacy, and oversee the Company's compliance with applicable data privacy and cybersecurity laws and regulations; Evaluate the Cybersecurity Committee's composition and performance on an annual basis;


text: Review and reassess the adequacy of the Cybersecurity Committee's written charter annually and recommend to the Board any changes the Cybersecurity Committee determines are appropriate;


text: Perform any other activities required by applicable law, rules or regulations (including the Securities Exchange Act of 1934 and The NYSE American Stock Exchange regarding reporting and disclosure obligations related to cybersecurity risks, costs, and incidents), and take such other actions and perform and carry out any other responsibilities and duties delegated to it by the Board or as the Cybersecurity Committee deems necessary or appropriate consistent with its purpose.


text: The Cybersecurity Committee, including the Company's Director of Technology, receive regular updates from the Company's management on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: Risk management and strategy Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through occasional data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.


text: In our business operation, we utilize various third-party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10-K for discussion of risk factors.


text: Cybersecurity is an important part of our risk management processes. Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board of Directors oversees the management of systemic risks, including cybersecurity threats, in accordance with its charter.


text: Our management, represented by senior management, leads the cybersecurity risk assessment and mitigation processes, along with information technology management staff and our third-party business technology partner. Our third-party business technology partner has over 20 years of experience in cybersecurity and information technology. Continuous monitoring and routine meetings are conducted in order for the Company's information technology team and third-party business technology firm to update senior management regarding prevention, detection, mitigation and remediation of any cybersecurity threats or incidents.