text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) the oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Zeta Global Holdings Corp.

ticker: ZETA

secItem: Item 1C


text: Our management team, including our CIO, Chief Information Security Office (CISO) and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO (to whom the CISO reports) regularly attends meetings of the Committee. Our management team's experience includes decades of experience working in information security, advanced education, and information security certifications.


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST"). We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: NOVANTA INC

ticker: NOVT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, sharing common methodologies and governance processes across the enterprise risk management program. Specifically, our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and enterprise information technology ("IT") environment; • a security team and an external service provider principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity threats and incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management on a quarterly basis as part of the risk mitigation strategy; • quarterly testing of the effectiveness of the cybersecurity awareness training; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • cybersecurity internal and external penetration testing.


text: We have not identified any material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors recognizes the need for continually monitoring our information security risks and cybersecurity initiatives. The Audit Committee of our Board of Directors (the "Board") undertakes the primary oversight responsibility over our cybersecurity risks and information security controls. Management briefs the Audit Committee on information security matters at each quarterly meeting of the Audit Committee. In addition, management updates the Audit Committee regarding any potentially material cybersecurity incidents, if any, as well as any incidents with lesser potential impact. In addition to the role the Audit Committee plays in overseeing enterprise and cybersecurity risks, the Environmental, Social and Governance ("ESG") Committee reviews and oversees our overall cybersecurity program, including its strategy and processes, and is updated by company management at each of the ESG Committee's meetings on the status and developments of the cybersecurity program.


text: Both the Audit Committee and the ESG Committee report to the full Board regarding its activities, including those related to our cybersecurity risks and program. The full Board also receives briefings from management at least once a year on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics presented by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO").


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The CISO/CIO oversees the overall cybersecurity risk management program, and the Deputy Chief Information Security Officer ("DCISO") has the primary operational responsibilities over our cybersecurity program, including supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO, who is also our CIO, has over 22 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. The CISO/CIO holds a Master of Science degree in computer science and engineering (with a specialization in Information Assurance) and a Doctorate of Engineering Management/Systems Engineering degree. Our DCISO has served in various roles in information security for over 12 years and holds a Certified Information System Security Professional ("CISSP") certification.


text: Information Security and Risk Management Overview The Company places a high priority and focus on securing the confidential information it receives and stores about its borrowers, depositors and other customers and employees as well as sensitive information regarding financial transactions and the Company's information systems. This priority and focus starts at the Company's board of directors, which is ultimately responsible for risk oversight, establishing the Company's risk appetite, understanding the Bank's key risks and assuring the risk management strategy, processes and internal controls are appropriate to manage risk, in each case inclusive of cybersecurity risk. The Company's board of directors approves an information security policy and program (the "Information Security Policy and Program"), which contains a statement of the Company's risk appetite with respect to cybersecurity matters, on an annual basis. The Company's risk appetite includes specific information security risk tolerance thresholds and limits established with the approval of the Company's board of directors and executive management. Key risk indicators are monitored by the Risk Oversight Committee of the Company's board of directors (the "Risk Oversight Committee"), which receives quarterly reports from the Company's Chief Risk Officer, Information Security Officer and Enterprise Risk Management Committee regarding management's efforts to protect the Company from cybersecurity threats and the general threat landscape facing companies with operational characteristics similar to the Company's. The Risk Oversight Committee reports quarterly to the Company's board of directors regarding the Company's cybersecurity risk oversight processes as the board of directors seeks to ensure the Company is operating within its stated risk appetite.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse the Company's systems or information. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, security assessments, tabletop exercises, and other exercises focused on evaluating effectiveness of the Company's processes and programs. The Company also deploys technical safeguards that are designed to protect its information systems from cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the Company's business. The Company has also developed and periodically updates incident response plans that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation to the appropriate management committees and to the Risk Oversight Committee of the board and full board of directors as appropriate. These incident response plans are coordinated through the Information Security Officer ("ISO") and other key members of management, including the Chief Risk Officer.


text: The Company's board of directors delegates authority to the Risk Oversight Committee to assist the board in carrying out its duties of risk oversight, including with respect to cybersecurity risk. The Risk Oversight Committee provides primary oversight of the Company's enterprise-wide risk posture and the processes established to identify, measure, and monitor the Company's risk level, including in regards to cybersecurity risk. This oversight includes reviewing and approving the Company's risk appetite, including with respect to cybersecurity risk, risk related policies, and reviewing quarterly reporting from management on monitoring of performance of the Company against its risk appetite, including in regards to cybersecurity risk. The Risk Oversight Committee is responsible for the oversight, implementation, and maintenance of the Information Security Policy and Program and has delegated to it specific responsibility for the implementation of the program and reviewing management reports in this area. Quarterly reports are provided to the Company's board of directors that describe the overall status of the Information Security Policy and Program, including, but not limited to: • Decisions about risk management and control; • Results of testing, including regular external and internal penetration testing; • Security breaches or violations and management's responses; and • Recommendations for changes to the Information Security Policy and Program.


text: The Company's Enterprise Risk Management Committee, which is a management committee consisting of key employees of the Company, including the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Credit Officer, Chief Administrative Officer, Chief Information Officer, and Chief Risk Officer, oversees implementation and monitoring of the Information Security Policy and Program. Testing of the Information Security Policy and Program is accomplished through the use of a comprehensive Information Systems Audit that is performed, at a minimum, on an annual basis by third-party expert consulting firms, the results of which are reviewed with the Risk Oversight Committee and Audit Committee. The company also conducts an internal and external penetration test, at a minimum, on an annual basis by outside expert consulting firms. In addition, in accordance with the Information Security Policy and Program, the Company's Enterprise Risk Management Committee assesses information security risks on at least an annual basis, or more often in response to changes in products or services that are offered, technological changes, changes in the threat landscape facing the Company, including as a result of cybersecurity incidents affecting financial institutions or their vendors generally or any change that may materially affect the Company's risk environment.


text: The Company's board of directors has appointed an Information Security Officer (the "ISO"), who has cybersecurity expertise primarily related to cybersecurity assurance, compliance, digital forensics, investigations, process design and collegiate instruction who holds various certifications in areas relevant to cybersecurity risk monitoring. The ISO, working together with the Company's Chief Information Officer and Chief Risk Officer, handles the development and implementation of the Information Security Policy and Program and, together with the Company's information technology staff and third-party vendors and other outside resources, the ISO monitors the Company's information technology systems for threats and implements changes to those systems in an effort to protect the systems from attack. The ISO also coordinates the risk assessment process, facilitates annual employee training, and prepares an annual report to the Company's board of directors that contains a summary of any cybersecurity incidents occurring during the report year, and an analysis of the results of the Information Systems Audit and the Company's performance against the Information Security Policy and Program. The ISO reports directly to the Bank's Chief Risk Officer, independent of the Company's technology department, and the responsibilities of this role are in conjunction with security, fraud and other special projects concerning risk and operational issues identified. The Bank's Chief Risk Officer reports directly to the Chief Executive Officer.


text: To date, no attempted cyber-attack or other attempted intrusion on the Company's information technology networks has resulted in a material adverse impact on the operations or financial results of the Company or the Bank.


text: Information Security Training and Awareness Information security awareness training is provided to all employees and bank business units no less often than annually and focuses on: new hire orientation, the Company's overall information security program, roles and responsibilities of employees during an incident, how to report suspicious activity, and captures the Bank's cybersecurity blog for consistent and relevant information.


text: Service Provider Arrangements Management identifies, assesses, controls, monitors and reports on risks related to the Bank's use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Interagency Guidance on Third-Party Relationships: Risk Management.


text: It is the policy of the Company to ensure the internal controls and financial condition of a third-party vendor are carefully evaluated prior to the allowance of such support services to begin, and as an on-going condition of continuing support of such products or services. Vendors with access to customer information or direct access to the network are carefully reviewed to ensure that appropriate controls and mechanisms are in place to safeguard confidential information, and the Company's contracts with such vendors include obligations on the part of the vendors to maintain the confidentiality of such information in compliance with applicable legal requirements.


text: Flywire recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Flywire Corp

ticker: FLYW


text: Risk Management and Strategy Managing Material Risks and Integrated Overall Risk Management Flywire has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our security and risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Flywire engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments and consultation on security enhancements.


text: Oversee Third-party Risk Flywire implements stringent processes to oversee and manage the risks associated with third-party service providers. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments by our Chief Information Security Officer (CISO) and on an ongoing basis by our security and risk management team and our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight Our Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology and finance, which we believe equips them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The CISO, General Counsel & Chief Compliance Officer (GC & CCO), Chief Operating Officer (COO) and the Chief Executive Officer (CEO) play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Risk mitigation efforts and insurance; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CISO, GC & CCO, COO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Flywire. Our Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity, the CISO brings a wealth of expertise to her role. Her background includes extensive experience as an enterprise CISO and is well-recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and is subject to periodic testing for effectiveness of response and remediation.


text: Reporting to Board of Directors Our CISO, in her capacity, regularly informs our Chief Financial Officer (CFO), GC & CCO, COO and CEO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Flywire. Furthermore, our CISO reports to the Board of Directors at a minimum twice a year, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity matters, and strategic risk management decisions.


text: We are committed to ensuring the confidentiality, integrity and availability of data that is owned and managed by us. We are also committed to protecting confidential information that is shared with us by our business partners. The cybersecurity program at Koppers has been designed based on an industry standard cybersecurity framework and is aligned with local and regional compliance requirements. The cybersecurity program is reviewed periodically by an independent third-party, and the results are shared with the board of directors. Components of the cybersecurity program are guided by the results of the independent third-party assessment. The cybersecurity program is part of the larger Enterprise Risk Management (ERM) program which is reviewed by management and the board of directors on a periodic basis. Compliance with the cybersecurity program is ensured via policies, procedures, training, and systems.

companyName: Koppers Holdings Inc.

ticker: KOP


text: Koppers Holdings Inc. 2023 Annual Report Information security policies at Koppers lay out the guardrails that ensure compliance with the program. Examples of guardrails set within the information security policies at Koppers include application of the principle of least privilege when granting access (the principle that a user or entity should only have access to the specific data, resources and applications needed to complete a required task), logging and monitoring activity of privileged accounts, authorized physical and logical access to information technology (IT) systems, and requiring maintenance of confidentiality of non-public information. Standard operating procedures (SOPs) ensure accuracy and completeness of various IT tasks being performed throughout the organization. SOPs include incorporating data processing agreements in contracts, commissioning and decommissioning of IT systems, granting role-based user access, patch management, and change management. Training is conducted regularly for all employees who interact with Koppers IT systems. Specialized training is also conducted for employees who deal with sensitive data. Security systems have been deployed to manage vulnerabilities within the IT environment, and periodic penetration tests validate the Koppers security posture.


text: IT systems are protected using various tools like multi-factor authentication (MFA), virtual private network (VPN), firewalls, end-point protection, spam and web filters, mobile device management, and privileged access management. A third-party monitoring service aids in detecting any threats or anomalies with the network. A multi-department incident response plan has been developed to facilitate a swift response in the event of a cybersecurity incident, which includes notifying the appropriate regulatory agencies. IT systems critical to the business operations have been identified and plans have been developed for a swift recovery of IT services in the event of a service failure. We utilize various IT cloud service providers. Annual security reviews of all service providers that provide critical service to the business are conducted. A cybersecurity risk assessment is conducted prior to contracting with a new IT cloud service provider providing high-impact services.


text: The Strategy and Risk Committee of the board of directors is composed of board members with diverse experience that allows them to oversee cybersecurity risks effectively. We have a Vice President, Information Technology with over 20 years of experience at Koppers in various positions of increasing responsibility within the IT function, working on initiatives related to enterprise resource planning systems, mobile computing, data analytics, SOX compliance, and cybersecurity. Prior to working at Koppers, the Vice President, Information Technology worked at a global technology consulting company implementing software solutions. This position plays a pivotal role in informing management, the Strategy and Risk Committee and the board of directors on cybersecurity risks. An update on the cybersecurity program is provided to the board of directors quarterly. As of the date of this report, we have not experienced a material information security incident.


text: Cybersecurity Governance, Risk Management and Strategy In the current digital environment, companies like ours may be the target of cyber-attacks or other malicious efforts to cause a cyber incident. These cyber incidents can include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. The possible consequences of such an attack include but are not limited to loss of data, damage to the Company's reputation, interruptions to our operations, and/or the need to pay ransom. Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: We recognize the importance of maintaining the confidence and trust of our customers, suppliers, employees, audience, and communities by maintaining our data and information security. In managing our cyber risk, we utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. In addition, we have established security control requirements for our third party vendors based on global standards.


text: Our day-to-day cybersecurity efforts are led operationally by our Chief Technology and Digital Officer and Senior Vice President, Technology who have over 10 and 25 years, respectively, of networking and information technology management or executive experience, and oversee a team of in-house cybersecurity specialists. Our Cybersecurity Committee, comprised of representatives from key management groups including accounting, finance, legal, internal audit, and information technology, also supports our cybersecurity efforts. The Cybersecurity Committee consults with representatives from senior management and retains third-party contractors as needed. The role of the Cybersecurity Committee is to oversee cyber risk assessments, monitor applicable key risk indicators, review cybersecurity training procedures, establish cybersecurity policies and procedures, and implement enhancements to our cybersecurity infrastructure. The Cybersecurity Committee meets monthly, or more regularly as necessary, and ensures that senior management, and ultimately, the Board, is given the information required to manage and exercise proper oversight over cybersecurity risks and ensure that escalation procedures are followed in the event of a cybersecurity incident.


text: As part of its role as independent oversight of the key risks facing Nexstar, the Board itself and through its Audit Committee devotes regular and thorough attention to our cybersecurity risk. The Audit Committee receives quarterly (or more frequent as necessary) reports from senior financial executives and Nexstar's Chief Technology and Digital Officer to evaluate cybersecurity and data risks. Such reporting includes updates on the Company's cybersecurity program, the external threat environment, and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat landscape. In accordance with our Cyber Incident Response Plan, the Audit Committee is promptly informed of any cybersecurity incidents that could potentially materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Audit Committee and management regularly brief the full Board on these matters as well.


text: For additional discussion of certain risks associated with cybersecurity, see "Risk Factors" under the heading "Cybersecurity risks could affect the Company's operating effectiveness."


text: Our Company has a dedicated team of technology professionals who consistently monitor risks related to cybersecurity. Our Corporate Vice President and Chief Information Officer, as well as our Chief Information Security Officer ("CISO") are responsible for managing our information technology ("IT") security program. Our CISO is a Certified Information Systems Security Professional (CISSP), holds a Masters Degree in Computer Information Systems, and has over 20 years of relevant expertise in assessing and managing cybersecurity risks. Their teams are responsible for leading an enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. To identify and address potential information security risks, we use a defense-in-depth methodology that employs multiple, redundant defensive measures and outlines actions to take in the event of a security control failure or vulnerability exploitation. To protect the Company from cybersecurity threats, we utilize a combination of internal resources and external consultants and providers. These consultants and providers provide services such as penetration testing, incident response, and third-party assessments. In addition, we use a combination of both proprietary and commercial solutions to proactively manage and mitigate threats to our IT environment and these processes have been integrated into the Company's overall risk management system.

companyName: VICOR CORP

ticker: VICR


text: Our CISO oversees security, including the corporate IT environment, our public cloud presence, and security standards that are used as a framework for managing security across our Company. Our CISO is also responsible for security awareness, administering our corporate security training, and sponsoring our cybersecurity policy and standards. Our cybersecurity plan is reviewed annually, and our Audit Committee has delegated to the Executive Security Incident Response Team which is made up of our Chief Financial Officer, a Board member and senior management representatives in the legal, IT and finance functions, oversight of our cybersecurity program. The Executive Security Incident Response Team receives regular updates directly from our CISO and Vicor product security experts from various business and operational areas. We maintain various security certifications across the Company, and part of our compliance program includes processes to oversee and identify material risks from cybersecurity threats and include the use of third-party service providers to perform regular audits to ensure our security management program remains current.


text: Our objective for managing information security and cybersecurity risk is to avoid or minimize the impacts of both internal and external threat events and other efforts to penetrate or otherwise compromise the confidentiality, integrity, or availability of our systems. We work to achieve this objective by hardening networks and systems against attack, and by diligently managing visibility and monitoring controls within our data and communications environment to recognize events and respond appropriately.


text: To keep the Executive Security Incident Response Team apprised of the continually shifting landscape, the CISO typically provides quarterly updates to the Executive Security Incident Response Team on information security and cybersecurity matters. The Executive Security Incident Response Team maintains oversight of the efforts made to maximize information security and cybersecurity efforts. Potential concerns related to information security and cybersecurity will be escalated to the Board of Directors and Audit Committee, as appropriate.


text: Our cybersecurity infrastructure undergoes external audits. These efforts demonstrate our commitment to maintaining the highest level of cybersecurity protection. Our external third-party providers also evaluate and rank our cybersecurity maturity and coverage as part of their services. To stay informed about emerging threats, we regularly consult with external providers and other sources such as government publications and notices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Vicor Corporation maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans. which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations.

companyName: TechTarget Holdings Inc.


text: We seek to enhance our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. For example, we conduct regular risk assessments at planned intervals for high priority systems and/or applications to identify and analyze threats and vulnerabilities, identify controls, identify risk ratings and likelihood and level of potential impact, and provide recommendations for risk reduction, mitigation, acceptance, and avoidance. As part of our overall risk mitigation strategy, we also maintain cyber liability insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We regularly engage external parties, including consultants, auditors, and cybersecurity service providers to enhance our cybersecurity oversight. For example, we maintain an ISO 27001 certification for our BrightTALK platform and obtained a SOC 2, Type II report for our Priority Engine platform. These third-party assessments are evaluated and updated regularly. Additionally, we utilize various external parties and tools to assist us with annual penetration testing, cybersecurity and related training, vulnerability and patch management, threat detection and response, and information technology general controls.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management and assessment program designed to help protect against the misuse of information technology, data, and systems by third parties and business partners generally requiring third-party service providers to complete a security risk assessment, with certain high priority third-party providers undergoing annual risk assessments to determine if they have experienced any changes that could impact their security risk. If any critical risks are identified, we may perform a compliance audit of the third-party to further document findings and to recommend corrective actions.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled "The loss of personal, confidential, and/or proprietary information due to our cybersecurity systems or the systems of our customers, vendors, or partners being breached could cause us to incur significant legal and financial exposure and liability, and materially adversely affect our business, operating results and reputation," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance and Oversight Our Board of Directors provides oversight over cybersecurity risk. Our Board of Directors receives and provides feedback on periodic updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity incidents, if any. Our Board of Directors also receives periodic briefings on cyber-related issues and accomplishments including, among other things, reviewing key elements of our cybersecurity program, ongoing training initiatives and awareness programs, occurrence of any incidents, and updates regarding third-party certifications and assessments.


text: We have a Privacy and Security Executive Taskforce ("Taskforce") consisting of executive-level leaders that meets periodically to, among other things, review global trends in privacy, security, and compliance, identify key projects and resource needs, and review operational privacy and security statistics and metrics. Additionally, our Chief Technology Officer ("CTO") is a member of the Taskforce and manages and oversees a team (the "IT Security Team") that is responsible for leading company-wide cybersecurity efforts. The IT Security Team works with various business units and departments, including legal, product development, and operations, to help set standards, policies, and processes. Our CTO along with key members of his IT Security Team have worked in the information security field for many years and are actively involved in our cybersecurity efforts. Our internal audit function also provides independent testing on aspects of the operations of our cybersecurity program and the supporting control framework and reports the results of these audits in reports to our Audit Committee.


text: In an effort to deter and detect cyber threats, we periodically provide all full- and part-time employees with a data privacy, cybersecurity, and incident response training and compliance program, which covers timely and relevant topics, including phishing, malware, password security, confidential data protection, asset use and mobile security, and educates all employees on the importance of reporting all incidents immediately to the company's dedicated Incident Management Team. We also use technology-based tools to mitigate cybersecurity risks to bolster our employee based cybersecurity programs.


text: Risk management and strategy We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.

companyName: Gogo Inc.

ticker: GOGO


text: As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, manage and report cybersecurity risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST"), which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. To protect our network and information systems from cybersecurity threats, we use various security tools and policies that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.


text: We have a number of policies and procedures supporting the cybersecurity program, including a comprehensive enterprise cybersecurity incident response plan which is activated in the event of a cybersecurity incident. The incident response plan is a detailed playbook that specifies how Gogo classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, the Board, the Audit Committee, the Chief Executive Officer and other senior executives are part of the notification chain.


text: We conduct regular reviews and tests of our cybersecurity program, which includes tabletop exercises, penetration and vulnerability testing, simulations, and other exercises, as well as leverage audits by our internal audit team to evaluate the effectiveness of our cybersecurity program and controls and improve our security measures and planning. We also engage external auditors to review our cybersecurity program and controls, as well as engage third parties to perform penetration testing and vulnerability scanning of our public and private assets.


text: With respect to third-party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures through various contractual provisions to the extent possible, and we perform risk assessments of vendors as appropriate from time to time, which includes a vendor's ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, including the loss of customer confidence, reputational harm, our operating results and our financial condition. While we have experienced cybersecurity incidents, to date, we do not believe that we have experienced a material cybersecurity incident during the fiscal year ended December 31, 2023.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as our contemplated use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, which involves Board and Audit Committee oversight, senior and department executive leadership focus and commitment, and employee training. Our Audit Committee, comprised entirely of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through annual assessments, quarterly reporting and regular updates from members of the Company's executive leadership team, cybersecurity and data privacy leadership team, as well as the Internal Audit team.


text: Our Vice President, Network Engineering, Product Development and Operations serves as the leader of our cybersecurity team and has over 25 years of experience working in information technology, specializing in network security. The leader of our cybersecurity team has spent the last 17 years working for us in a variety of roles and as a result has in-depth knowledge of the Company's IT and Cyber ecosystem. We believe that his technical expertise combined with his business acumen and education, positions him well to lead Gogo's cybersecurity program. In addition to oversight of cybersecurity, our Vice President, Network Engineering, Product Development and Operations oversees (i) infrastructure management, (ii) the implementation and compliance of our information security standards, and (iii) mitigation of information security related risks. We also have management level committees and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The Cybersecurity Cross Functional Team (the "Cybersecurity CFT"), led by our Vice President, Network Engineering, Product Development and Operations, brings together IT, legal, compliance and other function heads. The Cybersecurity CFT provides a forum for these cross-functional members of management to: consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Gogo Executive Cybersecurity Committee (the "GECC") is comprised of executive leadership and members of the cybersecurity, operations, risk, legal, and internal audit teams. The GECC liaises with the Cybersecurity CFT and provides oversight of all aspects of Gogo's cybersecurity program and, at regular intervals through the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks. • The Incident Response Management Team (the "IRMT"), which includes senior executives and members of our cybersecurity leadership team, was established to support our incident response plan and reports into the GECC. Members of the IRMT are alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The IRMT annually assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. The IRMT also engages with the Company's Board and the Audit Committee depending on the severity of the cybersecurity incident.


text: The output of each of the foregoing committees are collected and analyzed on a regular basis and our Vice President, Network Engineering, Product Development and Operations briefs the Audit Committee, through quarterly updates as well as on an ad hoc basis between regular updates to the extent needed.


text: At the employee level, we maintain an experienced IT team tasked with implementing our privacy and cybersecurity program and supporting our cybersecurity leader in carrying out reporting, security and mitigation functions. We continuously seek to promote awareness of cybersecurity risk through communication and education of our employee population, and have a mandatory training program which covers privacy and cybersecurity (including phishing tests) and records and information management.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: By implementing these risk management strategies, the company aims to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding its assets and maintaining the trust of its stakeholders.


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: We engage assessors, consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function primarily through the audit committee.


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (NIST), proficiency in security tools such as Security Information and Event Management) systems, Intrusion Detection Systems (IDS) and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices as well as analyzing logs, investigating security incidents, and performing forensic analysis.


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, Vulnerability Management.


text: Our Director of Information Technology, Controller and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We design and are assessing our cybersecurity risk management program based on the ISO 27001:2022 standard. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27001:2022 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Merus N.V.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information technology systems that are vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT department who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process. The cybersecurity risk management program also includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards, and investigations on an as needed basis. We contractually require third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please see section "Risk Factors --Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business," in this Annual Report on Form 10-K.


text: Cybersecurity governance One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer and management team are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from the Head of IT Security and Compliance, the supporting internal team and support of third-party service providers.


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Cybersecurity Risk Management and Strategy" above.


text: Our Chief Operating Officer and Head of IT Security provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter. Our audit committee is charged with, and is able to pass resolutions relating to the application of information and communication technology by the Company, including risks relating to cybersecurity. Moreover, periodic briefings are also provided to the board of directors relating to our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter.


text: Our team that is responsible for assessing and our material risks from cybersecurity threats, including our Chief Operating Officer, Chief Financial Officer, and Senior Director, Head of IT Security and Compliance, has more than a combined 30 years of risk management experience. Our team's experience includes the Senior Director, Head of IT Security and Compliance, who has an extensive (+25 years) track record on cyber- and IT risks management, developing security and compliance programs and frameworks and leading IT security organizations, our Chief Finance Officer who, serving that role at Merus and prior companies and serving as a previously Audit Committee chairperson for Merus and current chairperson at Kala Pharmaceuticals, has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, while evaluating strategies to gain a high level of cyber security, and our Chief Operating Officer, who manages the IT organization at Merus and has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, and review U.S. jurisprudence concerning protection of confidential information and trade secrets and has participated in trainings on cybersecurity threat defense and response, and cybersecurity strategies from a legal perspective.


text: Risk management and strategy We operate in the biopharmaceutical sector, which is a highly regulated sector subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; disruption of our clinical trials, manufacturing or supply chain; violation of privacy laws and other litigation and legal risk; and reputational risk. We rely primarily on industry-leading third parties and a cloud-based infrastructure for our information technology systems, and accordingly are dependent on these third parties' own cybersecurity risk management practices and strategy. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data ("Information Systems and Data").

companyName: GERON CORP

ticker: GERN


text: We take a risk-based approach to identify and assess the cybersecurity threats and risks that could affect our business and Information Systems and Data. Our Information Technology personnel help identify, assess and manage our cybersecurity threats and risks, and support our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods and tools to identify, assess and manage cybersecurity threats and risks, including, for example, automated tools, industry reports, third party threat assessments and penetration testing. In addition, we encrypt data at rest and maintain network security controls, such as firewalls and virtual private networks. We also conduct computerized system monitoring and access control, including asset management, tracking and disposal associated with onboarding and offboarding of personnel. We maintain cybersecurity insurance.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. For example, we have implemented and maintain an incident response plan, and we utilize automated tools designed to maintain email security. We have also implemented a computerized system security and password policy that defines security for access to computer systems managed and controlled by us, and a procedure for computerized system incident management to address any unplanned issues in regulated computerized systems that could impact subject safety, product quality, and data integrity. We periodically conduct cybersecurity incident tabletop training exercises involving our personnel and plan to conduct similar training in 2024.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our head of Information Technology evaluates material risks from cybersecurity threats and reports periodically to our Audit Committee, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers such as Crowdstrike, cybersecurity service providers such as Mimecast, penetration testing firms, auditors, and professional services firms, including legal counsel. These relationships enable us to leverage specialized knowledge and insights, enabling our cybersecurity strategies and processes to remain consistent with industry best practices.


text: We rely on third-party service providers to perform a variety of functions throughout our business, such as contract manufacturing organizations, contract research organizations, suppliers and consultants. If we successfully obtain regulatory approval to commercialize imetelstat, we will rely on third party logistics organizations and distributors to distribute imetelstat. We conduct quality audits of regulated vendors, which typically include an assessment of such vendor's information technology systems, and we impose appropriate contractual obligations on vendors pertaining to information security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our efforts may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. We have not encountered cybersecurity challenges that have materially impaired our business, operations or financial standing.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Information Technology Systems, Data Security and Data Privacy."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our Board is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our Audit Committee, as well as our Chief Financial Officer, Chief Legal Officer, and other members of our executive management as appropriate, receives periodic reports from our head of Information Technology concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various periodic presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management Personnel Our Information Technology personnel responsible for cybersecurity risk assessment and management processes are managed by certain members of our executive management, including our Chief Financial Officer. Together with our executive management, our Information Technology personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. We seek to hire information technology personnel with skills appropriate to help us prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including executive management. When appropriate given the nature of any potential cybersecurity incident, our executive management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, and to make any legally required notifications to individuals or regulatory agencies, including making any required disclosures under the Securities Exchange Act of 1934, as amended.


text: As part of our Enterprise Risk Management ("ERM") process, we identify risks and assign responsibility for managing each risk to the appropriate level of management. Cybersecurity is a risk identified in our ERM process. Management has implemented a comprehensive cybersecurity risk management strategy in line with industry standards and regulatory requirements. This strategy includes: • conducting an independent cybersecurity maturity assessment to evaluate the health of our overall cyber programs and developing a solid roadmap to continuously improve our defensive posture; • performing regular risk assessments, where we identify potential vulnerabilities and evaluate the likelihood of various cyber threats; • implementing security controls including email and browser protection, audit log monitoring, malware defenses, controlled use of administrative privileges, encryption protocols, and multi-factor authentication; and • implementing progressively challenging employee training and awareness programs, including simulated phishing campaigns, to reduce the risk of human error in the recognition and reporting of potential threats.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: We continuously monitor our networks and systems and integrate threat intelligence feeds to evaluate evolving cyber threats. We conduct regular testing and simulation exercises, including engaging third-party service providers to perform penetration testing, to identify and address weaknesses in our defenses and engage third-party service providers to perform cybersecurity risk assessments, which are based on the National Institute of Standards and Technology framework. Cyber risks are considered and addressed for those third-party relationships deemed critical to our operations, as well as those with access to or custody of confidential data or customer non-public information, including PHI, and those services or products accessed in a cloud environment or involving generative artificial intelligence or other machine learning technologies.


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for the Company's enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.


text: Management's Role The Information Security function is led by the Chief Information Security Officer (CISO), under the direction of the Chief Information Officer (CIO). The Company's CISO, who was appointed in August 2021, has over 20 years of experience within information security and is both a Certified Information Security Manager and a Certified Information Systems Auditor. Key responsibilities of the Information Security function include developing cybersecurity strategies; managing cybersecurity governance; performing cybersecurity risk assessments; ensuring compliance with security standards and regulatory requirements; managing identity and access; monitoring cybersecurity threats; validating cybersecurity alerts; preparing for and responding to cybersecurity incidents; business continuity and disaster recovery plans; and creating security awareness through periodic trainings of both Company leadership and Associates. The CIO, CISO and the Company's Chief Legal Officer, who also serves as the Chief Compliance Officer, have oversight responsibilities of the Company's cybersecurity program.

companyName: SpartanNash Co


text: The Company's Board of Directors (Board) has appointed the Audit Committee to assist the Board in fulfilling its responsibilities with respect to the oversight of cybersecurity, data security, privacy programs, and the Company's response to security breaches. Two Company Directors serving on the Audit Committee completed the National Association of Corporate Directors/Carnegie Mellon CERT cyber-risk oversight program along with required examinations and earned the CERT designation. The CISO provides quarterly updates to the Audit Committee, which include a current evaluation of the Company's maturity within the National Institute of Standards and Technology (NIST) framework, including assessments against key performance indicators, updates on internal phishing campaigns, tabletop exercises conducted at various levels of the organization, and management training. The Audit Committee also reviews reports and recommendations from third parties periodically engaged by the Company to assess the cybersecurity control environment. In addition, the Company's internal audit function periodically audits elements of the security program and reports its observations to the CISO and the Audit Committee.


text: Risk Management and Strategy As a component of the Company's overall risk management process, which is aligned with a broader Enterprise Risk Management framework, the Company has implemented a multi-layered approach to minimize cybersecurity risk and safeguard its data. The Company conducts cybersecurity risk assessments on a regular basis and responds to identified risk exposures by employing a combination of risk mitigation strategies, including the adoption of cybersecurity controls and maintaining a cybersecurity insurance policy that provides coverage for security breaches. The Company engages third party consultants periodically to evaluate elements of the cybersecurity policy, processes, procedures and controls. The CISO and other members of the Executive Leadership Team respond to applicable recommendations arising from the third-party consultants. In addition, the Company engages a Qualified Security Assessor as part of the compliance requirements for Payment Card Industry (PCI). The Company also engages with a third-party risk management provider to ensure its vendors comply with internal security and privacy requirements and that key vendors are continually monitored for security risks. The Company's cybersecurity governance practices are based on the Company's common control framework which incorporates elements from the NIST Cybersecurity Framework, the Center for Internet Security's benchmark standards, and specific regulatory and industry requirements including Health Insurance Portability and Accountability Act and PCI. The CISO provides at least quarterly updates on the cybersecurity program, including the results of the cybersecurity risk assessments and the related responses, to the Company's Security Governance Council composed of members of the Executive Leadership Team. The Company continually monitors cybersecurity threats and has a dedicated cybersecurity team in place to identify if any of the threats may lead to a cybersecurity incident. In the event of such an incident, the Company will take decisive measures to thoroughly analyze, contain, and eliminate the threat. Following an incident, a comprehensive review is performed to determine whether the incident meets qualitative or quantitative materiality thresholds, and whether the incident warrants public disclosure.


text: Effect of Cybersecurity Threats As of the effective date of this filing, the Company is currently not aware of any known or potential cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations, or financial conditions. Although the Company believes it has implemented sufficient security measures to protect against cyber-attacks, unknown cyber incidents could materially disrupt the Company's operations or compromise sensitive information.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying and managing cybersecurity risks and have integrated cybersecurity risk management into our overall risk management processes. We have implemented processes to identify, assess, detect, evaluate, and mitigate ongoing security threats to our information technology systems and data as well as those of third parties upon which we rely.

companyName: IonQ, Inc.

ticker: IONQ


text: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing, maintain ongoing risk assessments, and monitor various third-party risk feeds. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program. Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have passed a SOC 2 type 1 audit. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.


text: We maintain an incident response plan which includes, among other areas, prioritization guidelines, data collection and evidence handling, communication channels and partners, and if required, law enforcement engagement. We maintain relationships with both local and national law enforcement agencies. We evaluate security incidents on a scale of severity to determine the appropriate incident handling protocols.


text: We require all employees to undertake data protection and security training at least annually. We provide specialized training to targeted groups of employees depending on their role and the larger threat landscape. We are briefed regularly by national law enforcement, and work with external consulting firms on custom training and evaluations.


text: While we have experienced cybersecurity incidents in the past, to date, none have materially affected the Company or our financial position, results of operations, or cash flows. We continue to invest in the cybersecurity and resiliency of our systems and networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "If our information technology systems, data, or physical facilities, or those of third parties upon which we rely, are or were compromised, we could experience adverse business consequences resulting from such compromise," which should be read in conjunction with the information contained within Item 1C, Cybersecurity.


text: Cybersecurity Governance The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees. Our Audit Committee is responsible for the oversight of cybersecurity risks, including our assessment of potential vulnerabilities and threats, evaluation of incidents, and monitoring of the implementation of key actions and/or projects to further enhance our ability to detect and manage ongoing security threats. Key members of management, including our security officer, provide updates to our Audit Committee on at least a semi annual basis. In addition to committee updates, our security officer also meets with the full Board of Directors at least annually to discuss the Company's overall risk profile and associated ongoing mitigation efforts. The briefings provided to our Audit Committee and Board of Directors include updates on the Company's key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.


text: Our security officer, who reports to our VP of Engineering, and is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, VP of Engineering, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies. Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters. Our security officer collaborates closely and regularly with our external consulting firm who provides a fractional Chief Information Security Officer ("CISO"), which includes a cybersecurity expert with recognized expertise and many years of experience.


text: The Company's overall risks and assessments are monitored via a cross functional team composed of members of senior management, security, legal, and financial reporting. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee pursuant to its charter. Our Audit Committee is primarily responsible for monitoring and assessing strategic risk exposure and receives periodic updates from management at Audit Committee meetings regarding cybersecurity threat risks and management's strategies to manage the same, and our management is responsible for the day-to-day management of the material risks we face. Our Audit Committee reports to the board of directors regarding its activities, including with respect to cybersecurity risk oversight as appropriate, on a quarterly basis.

companyName: RxSight, Inc.

ticker: RXST


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats and have processes for monitoring and assessing strategic risk exposures and reporting to the Audit Committee and board of directors. We regularly assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within our IT infrastructure.


text: We conduct periodic risk assessments to identify cybersecurity threats that may affect information systems that may be vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, if necessary, we implement and maintain reasonable safeguards to minimize identified risks and regularly monitor the effectiveness of our safeguards. We devote significant resources, including engaging experienced consultants and designate senior-level information technology management ("IT management") to manage the risk assessment and mitigation process. Personnel tasked with managing cybersecurity risks periodically report to senior management and the Audit Committee. We use automated tools and trained personnel to maintain real-time threat monitoring and 24x7 alerting of all of our IT infrastructure and endpoints. We leverage various software tools, internal personnel and consultants to identify, triage, escalate and remediate threats. In the event of a security incident, we follow communication protocols to alert senior-level management as to the nature and severity of the threat while leveraging consultants and forensic tools to contain, document and mitigate the threat.


text: As part of our overall risk management system, IT management monitors and tests our safeguards and trains our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies and risks through communication and trainings.


text: We have engaged, and expect to continue to engage, consultants, or other third parties in connection with our risk assessment processes. These providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing the design of our processes. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers we expect them to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "We may experience a significant disruption in our information technology systems or breaches of data security" and "Unauthorized third parties may seek to access our devices or other products and services, or related devices, products, and services, and modify or use them in a way inconsistent with our FDA clearances and approvals, which may create risks to users." As of the date of this report, we do not believe that we have experienced a material cybersecurity incident.


text: Our cybersecurity program is led by a team of skilled cybersecurity professionals, including dedicated internal cybersecurity resources and external advisors. In the normal course of business, we may collect and store sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We maintain a robust cybersecurity incident response plan, which details the incident response procedures, tactical and strategic team membership, and points of contact related to the response processes. The Company also maintains a detailed decision-tree-based playbook which is a supplement to the plan and focuses on specific types of incidents and the appropriate response steps. Cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach. The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are fully integrated into the Company's ERM program. The plan and playbook are structured to align with the National Institute of Standards and Technology ("NIST") Cybersecurity framework practices. The plan and playbook are reviewed at least annually. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Metallus Inc.

ticker: MTUS


text: The Company adheres to a periodic, third-party facilitated testing exercise of the cybersecurity incident response plan and playbook with the Company's tactical and strategic team members. The teams are comprised of key members of the organization and external advisors who hold critical importance in the handling of cybersecurity events. The exercise covers response procedures for prevalent cybersecurity incidents including but not limited to phishing, third-party breaches, and a standard incident response process. The documentation helps leaders make appropriate, pre-planned decisions. To assist, appendices detailing generalized incident response checklists and workflows from the Cybersecurity & Infrastructure Security Agency ("CISA") and the NIST are referenced and used as a framework. Lastly, the response plans contain instructions on collecting and incorporating lessons learned after a successful identification and remediation of a security event. The information security team also works in partnership with the Company's internal audit team to review information technology-related internal controls with our external auditor as part of our overall internal controls process.


text: In light of the pervasive and increasing threat from cyberattacks, the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cyberattacks. The Company's Information Technology ("IT") leadership team consults with and provides regular updates to the Board of Directors, as well as our chief executive officer and other members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of the information security program, timely reports regarding any cybersecurity incident that meets established reporting thresholds, and emerging threat landscape. In addition, the Company has an IT governance committee, which is comprised of the chief executive officer, IT and other officers of the Company. The IT governance committee meets quarterly, and as necessary, to discuss the cybersecurity program and other relevant topics. The IT team also consults regularly with the Board of Director's cybersecurity expert in between meetings. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors, at least semi-annually. The Board of Directors has oversight responsibility for our data security practices and we believe the Board of Directors has the requisite skills and awareness into the design and operation of our data security practices to fulfill this responsibility effectively.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: Our information security processes are designed to assess, identify and manage material risks from cybersecurity threats. In conducting our business activities, we are entrusted with confidential information from our clients, business partners and employees. Confidential information may include sensitive business and technical information, as well as personal information. Our Information Security Management System ("ISMS"), based on ISO/IEC 27001, is an integral part of our overall enterprise risk management system, and serves as a framework for handling cybersecurity threats and incidents, including such threats and incidents associated with our use of services by information technology suppliers. The ISMS is operated by our Global Information Security team headed by our Global Chief Information Security Officer ("CISO"). We maintain physical, electronic and procedural safeguards designed to guard confidential information contained within our information systems from loss, misuse, unauthorized access, disclosure, alteration or destruction. We have layered defenses designed to protect against intrusions that could affect the confidentiality, integrity and availability of information.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: We prepare for security incidents by analyzing threat intelligence, holding periodic cybersecurity incident tabletop exercises, and reviewing lessons learned on a regular basis. Our incident management process is communicated to employees during periodic security awareness training. Our employees are trained to report incidents, including security weaknesses, malfunctions, threats and breaches immediately to the concerned internal departments and to our information security group. Our computer security incident response team is trained to manage incident response.


text: We conduct systematic and manual assessments designed to identify information security vulnerabilities, such as external party penetration tests, internal manual penetration tests, source code scanning and other techniques. We perform information technology risk assessments on a periodic basis designed to detect risks for which controls and mitigation strategies are developed.


text: We engage with external experts, including cybersecurity assessors and consultants, in evaluating and testing our information systems and information security controls, enabling us to obtain specialized knowledge and insights.


text: We perform information technology supplier risk assessments on a periodic basis. Information technology suppliers to SS&C that access, process or store personal information or other customer data are assessed and are also subject to periodic due diligence procedures.


text: Cybersecurity risk is overseen by the board of directors, with additional oversight of the relevant risk framework and controls provided by the Audit Committee. The Audit Committee oversees our policies with respect to risk assessment and risk management generally, including guidelines and policies to govern the process by which our exposure to risk is handled. As set forth in its charter, Audit Committee oversight includes periodic review of our information security controls and procedures and the processes and procedures for managing cybersecurity risks.


text: Our CISO, who reports to SS&C's Chief Technology Officer, provides periodic updates to the Audit Committee or to the board of directors on cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends and other areas of importance.


text: Our CISO is responsible for our overall information security strategy, policy, security engineering, operations, cybersecurity threat detection and response. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. Cybersecurity team members provide regular reports to our CISO with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents, and otherwise aid our CISO in operating the ISMS. Cybersecurity team members have relevant education, certifications, and industry experience.


text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - Our software-enabled services may be subject to disruptions, attacks or failures that could adversely affect our reputation and our business." for more information about these risks.