text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks. The program includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Director of Information Security, our Chief Financial Officer and our Chief Legal Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, International Organization for Standardization and the Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees, Board members and certain contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats and incident response preparedness, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for current employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: ASPEN AEROGELS INC

ticker: ASPN

secItem: Item 1C


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee receives prompt and timely information regarding any known or suspected cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. In addition, our Audit Committee has established a Cybersecurity Subcommittee, comprised of four Audit Committee members and members of management, including the Director of Information Security, Chief Financial Officer, and Chief Legal Officer, which meets quarterly to review materials concerning the ongoing maturation of the Company's cybersecurity program, the effectiveness of its information security controls, and current and emerging material cybersecurity threat risks. Our Audit Committee, and its Cybersecurity Subcommittee receive materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties.


text: Members of our Audit Committee and Board of Directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Members of our Audit Committee and Board of Directors continue to receive updates around the cybersecurity threat landscape and ongoing best practices as a means of continuing education in the area. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning and disaster recovery, product management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Director of Information Security, Chief Financial Officer and Chief Legal Officer. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, Certified Professional Hacker. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members and other relevant subject matter experts report to the Audit Committee of our Board of Directors, as well as the Cybersecurity Subcommittee of the Audit Committee, about material cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: Our information security function, our Chief Information Officer (CIO), and our Chief Compliance Officer (CCO) help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response policies, disaster recovery/business continuity policies, a vulnerability management policy, a vendor risk management program, risk assessments, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, managed cybersecurity service providers, darkweb monitoring services, and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. For certain vendors, these processes include vendor risk assessments, security questionnaires, review of vendors' written security program, and imposition of contractual obligations related to information security on certain vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, including: "We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences."; and "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, interruptions to operations or clinical trials, reputational harm, litigation, fines and penalties, disruptions of our business operations, and a loss of customers or sales."


text: T he Director of Information Security, along with management, including the CIO and CCO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO, Senior Vice President of Finance, CCO, Senior Vice President of People and Performance, and Director of Information Security. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from senior management concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.

companyName: Grayscale Bitcoin Mini Trust ETF

ticker: BTC


text: During the period ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Bitcoin Trust ETF

ticker: GBTC


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Trust. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping the Trust's and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Invesco's information security program is led by its Chief Information Security Officer who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and the Trust's information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Invesco's Board of Directors oversees cybersecurity risk and receives updates at a minimum, of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.'s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks the Trust faces from cybersecurity threats, please see Item 1A. Risk Factors.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Trust. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Ethereum ETF

ticker: QETH


text: Invesco's information security program is led by its Chief Information Security Officer who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: The Company engages in the regular evaluations of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including tabletop exercises and vulnerability testing, focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on certain of our cybersecurity measures, including audits and penetration testing. For example, we annually engage qualified third-party auditors to independently assess and attest to and/or provide certifications of compliance with the HIPAA Security and Privacy Rule, SOC2 Type 2, the Payment Card Industry Data Security Standard (PCI-DSS), UK CyberEssentials, and HITRUST. The results of such assessments, audits and reviews are presented to the Audit Committee and members of the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on such assessments, audits and reviews.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process. The Audit Committee oversees our cybersecurity program, as well as the steps management has taken to monitor and control cybersecurity threats and related risks. This oversight includes receiving reports on the regular assessments of the Company's disclosure controls and procedures to ensure that current practices account for material cybersecurity risks facing the Company. The Audit Committee receives presentations on the cybersecurity program and related risks on at least a quarterly basis. These presentations address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee, and the full Board as necessary, also receive prompt and timely information regarding any cybersecurity incident that meets recognized established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee routinely meets with our Chief Legal and Regulatory Officer ("CLRO") and CISO as well as outside experts as appropriate to assess cybersecurity risks and to evaluate the status of the Company's cybersecurity efforts, which include a broad range of tools and training initiatives that work together to protect the data and systems used in our businesses.


text: Our cybersecurity management team includes our CISO, Data Privacy Officer, CLRO, Chief Financial Officer, and Head of Internal Audit. The CISO, in coordination with the team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The cybersecurity management team meets regularly to review cybersecurity and data privacy strategy, receive updates, and consider the Company's current risk posture. The team meetings also build leadership consensus on cybersecurity risk management and tolerance. In the event they become aware of a cybersecurity threat or incident, employees are expected to follow established lines of communication to notify the relevant members of the cybersecurity management team and allow the relevant team members to coordinate the evaluation and response to such threats and incidents as necessary. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the rest of the cybersecurity management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to other members of senior management and the Audit Committee when appropriate. Such plans also dictate notification responses to Company management based on the severity of the incident.


text: The CISO has worked in the information security field for over 15 years and holds an undergraduate degree in computer systems management and master's degrees in both cybersecurity and technology management. He has also attained multiple cybersecurity-related professional certifications and licenses, including Certified Information Systems Security Professional, and is an adjunct professor of cybersecurity at New York University and Fordham University.


text: We have not experienced any material cybersecurity incidents. As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, we are aware that changes in our IT systems, including those provided by third parties, could expose us to risk in the future. These threats pose a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Cybersecurity attacks could also include attacks targeting patient, employee, or customer data or the security, integrity, and/or reliability of the hardware and software we utilize in our business operations. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing will be sufficient to protect and mitigate associated risks to our systems, information, or other property. For more information, see the risk factors included in Item 1A of this Annual Report.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Our cybersecurity program is managed by a dedicated team, which is led by our Chief Information Security Officer, (CISO who reports to the Chief Operating Officer and has to the ability to communicate directly to our CEO if necessary). Our CISO has over 20 years of IT experience, including over 18 years of cybersecurity experience, holds an M.S. degree in Information Security, and is a Certified Information Systems Security Professional (CISSP). Our General Counsel and Chief Privacy Officer is an attorney with 18 years of experience, including experience in privacy matters. They are also a Certified Information Privacy Professional (CIPP/US/E), a Certified Privacy Manager (CIPM), and a Privacy Law Specialist (PLS) with the International Association of Privacy Professionals (IAPP). As discussed above, our CISO and/or General Counsel and Chief Privacy Officer report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: In addition, our cybersecurity risk management and data strategy processes are further overseen by certain management team members. Together with CISO and our General Counsel and Chief Privacy Officer, these management team members are regularly informed about and routinely monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their ongoing management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Such individuals have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.


text: Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program, which is supported by third parties, is designed to allow us to identify, assess, and manage cybersecurity risks. Our external partners include professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and security testing firms. We completed an external lead assessment to assess cybersecurity risks across our business that is informed by the Center for Internet Security Controls. Our Senior Director of IT has years of experience leading cybersecurity teams. We provide cybersecurity training to our employees to address matters such as phishing, email security, and training on data privacy.

companyName: Akero Therapeutics, Inc.


text: The Company reports on its information security program, including the results of periodic testing, to the Audit Committee of the Board of Directors. Our Board's Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reviews management presentations concerning cybersecurity-related issues, including information security, technology risks, policies, and risk mitigation programs. The Audit Committee reports matters to the Board of Directors as needed. Our Chief Operating Officer, with the support of our Senior Director of Information Technology and third-party consultants, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Operating Officer also works closely with other management positions and external legal counsel to ensure that the Company understands its cybersecurity risk management responsibilities.


text: Management's Role in Assessing and Managing Cybersecurity Risk BBSI's Chief Information Security Officer ("CISO") leads our enterprise information security program and is primarily responsible for the assessment and management of the Company's cybersecurity risks. The CISO has extensive experience in information technology and cybersecurity, including at another publicly traded company. The CISO oversees our cybersecurity risk management framework and manages a team of IT security professionals to identify and prioritize cybersecurity risks. The CISO also utilizes the expertise of third-party security partners to provide threat detection support, vulnerability management, incident response, penetration testing, and consulting services.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: Ongoing Monitoring and Reporting of Cybersecurity Incidents The Company has an internal security team, supplemented with third-party security partners, to regularly monitor, detect and respond to potential cybersecurity incidents. The Company has a cybersecurity incident reporting protocol that provides a mechanism for the appropriate members of management and the Board to be made aware of cybersecurity incidents. The Company also requires security awareness training for all internal employees to enable employees to understand their role in preventing and reporting cybersecurity incidents.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS) and other applicable industry standards and are integrated into our overall risk management system and processes. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems may fail or experience security breaches and incidents that could adversely impact our business and operations and subject us to liability."

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Periodic Assessments: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Information Security and Risk Management Overview The Company places a high priority and focus on securing the confidential information it receives and stores about its borrowers, depositors and other customers and employees as well as sensitive information regarding financial transactions and the Company's information systems. This priority and focus starts at the Company's board of directors, which is ultimately responsible for risk oversight, establishing the Company's risk appetite, understanding the Bank's key risks and assuring the risk management strategy, processes and internal controls are appropriate to manage risk, in each case inclusive of cybersecurity risk. The Company's board of directors approves an information security policy and program (the "Information Security Policy and Program"), which contains a statement of the Company's risk appetite with respect to cybersecurity matters, on an annual basis. The Company's risk appetite includes specific information security risk tolerance thresholds and limits established with the approval of the Company's board of directors and executive management. Key risk indicators are monitored by the Risk Oversight Committee of the Company's board of directors (the "Risk Oversight Committee"), which receives quarterly reports from the Company's Chief Risk Officer, Information Security Officer ("ISO") and Enterprise Risk Management Committee regarding management's efforts to protect the Company from cybersecurity threats and the general threat landscape facing companies with operational characteristics similar to the Company's. The Risk Oversight Committee reports quarterly to the Company's board of directors regarding the Company's cybersecurity risk oversight processes as the board of directors seeks to ensure the Company is operating within its stated risk appetite.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse the Company's systems or information. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, security assessments, tabletop exercises, and other exercises focused on evaluating effectiveness of the Company's processes and programs. The Company also deploys technical safeguards that are designed to protect its information systems from cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the Company's business. The Company has also developed and periodically updates incident response plans that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation to the appropriate management committees and to the Risk Oversight Committee and full board of directors as appropriate. These incident response plans are coordinated through the ISO and other key members of management, including the Chief Risk Officer.


text: The Company's Enterprise Risk Management Committee, which is a management committee consisting of certain employees of the Company, including the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Credit Officer, Chief Administrative Officer, Chief Information Officer, and Chief Risk Officer, oversees implementation and monitoring of the Information Security Policy and Program. Testing of the Information Security Policy and Program is accomplished through the use of a comprehensive Information Systems Audit that is performed, at a minimum, on an annual basis by third-party expert consulting firms, the results of which are reviewed with the Risk Oversight Committee and Audit Committee. The Company also conducts an internal and external penetration test, at a minimum, on an annual basis by outside expert consulting firms. In addition, in accordance with the Information Security Policy and Program, the Company's Enterprise Risk Management Committee assesses information security risks on at least an annual basis, or more often in response to changes in products or services that are offered, technological changes, changes in the threat landscape facing the Company, including as a result of cybersecurity incidents affecting financial institutions or their vendors generally or any change that may materially affect the Company's risk environment.


text: The ISO has over 15 years of experience in cybersecurity, and such expertise is primarily related to cybersecurity assurance, compliance, digital forensics, investigations, process design and collegiate instruction. The ISO also holds various certifications in areas relevant to cybersecurity risk monitoring, including, a master's degree in IT security, a bachelor's degree in criminal justice with a minor in business administration, and certifications in IT, cell phone, and mobile device forensics. The ISO, working together with the Company's Chief Information Officer and Chief Risk Officer, handles the development and implementation of the Information Security Policy and Program and, together with the Company's information technology staff and third-party vendors and other outside resources, the ISO monitors the Company's information technology systems for threats and implements changes to those systems in an effort to protect the systems from attack. The ISO also coordinates the risk assessment process, facilitates annual employee training, and prepares an annual report to the Company's board of directors that contains a summary of any cybersecurity incidents occurring during the report year, and an analysis of the results of the Information Systems Audit and the Company's performance against the Information Security Policy and Program. The ISO reports directly to the Bank's Chief Risk Officer, independent of the Company's technology department, and the responsibilities of this role are in conjunction with security, fraud and other special projects concerning risk and operational issues identified. The Bank's Chief Risk Officer reports directly to the Chief Executive Officer.


text: Information Security Training and Awareness Information security awareness training is provided to all employees and Bank business units no less often than annually and focuses on: new hire orientation, the Company's overall information security program, roles and responsibilities of employees during an incident, how to report suspicious activity, and direction of employees to routinely check the Bank's cybersecurity blog for consistent and relevant information.


text: Our cybersecurity program assesses our cybersecurity risk profile through inventories of physical devices, software, and information systems, evaluations of critical third-party systems, and a catalog of security risks. Periodic assessments are conducted to ensure the risk catalog is up to date.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: We protect our information systems, data, and network through technical and procedural controls and security awareness training. We deploy multiple technical controls to achieve a layered security strategy including systems access controls, firewalls, web application gateways, antivirus software, e-mail filtering, and endpoint protection. Security awareness training is mandatory for all employees and conducted at time of hire and periodically thereafter. The security awareness training program is designed to ensure employees are prepared to identify and avoid cyber risks and may cover topics such as phishing, ransomware, social engineering, public Wi-Fi risks, password security, and mobile device security. Training is supplemented by testing initiatives, including periodic phishing tests, which may result in targeted or remedial training.


text: No known cybersecurity threats or incidents have materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition. While we maintain robust prevention and detection measures, we cannot eliminate all cybersecurity risks or guarantee absence of undetected incidents. For further details on cybersecurity risks, see "Item 1A. Risk Factors" in this Form 10-K.


text: Role of the Board of Directors and Management Our CISO and Chief Technology Officer ("CTO") oversee the day-to-day technology and security activities. Our CISO has been with the firm since 2013 and has over 20 years of IT experience in various industries. He is a Certified Chief Information Security Officer from the Carnegie Mellon University executive education program, as well as a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Our CTO joined the firm in 2020 with 30 years of IT experience, including over 20 years of executive level technology experience in the asset management industry. Both the CISO and CTO serve on the ISC.


text: The Audit Committee of the Board of Directors oversees our enterprise risk management, which includes cybersecurity. The ISC provides a report on our cybersecurity program to our Board at least annually.


text: Other key functions of the ISC are to align the overall security strategy with business objectives and to oversee the cataloging of cybersecurity risks and assessments. Additional review and oversight is provided by the Enterprise Risk Committee where cybersecurity risk is vetted against other risk categories. Management also maintains a Vendor Oversight Committee which governs the use of third-party vendors and assesses cybersecurity risk related to those vendors. The Enterprise Risk Committee and the Vendor Oversight Committee report their activities to the Audit Committee at least annually.


text: The third-party security operations center, the endpoint managed detection and response service, and third-party penetration testing vendors are overseen by the CISO.


text: In the event of a potential cybersecurity incident, the third-party security operations center is authorized to take preemptive action to address the incident and must promptly notify a member of the ISC. The ISC coordinates the response to and communication of an incident in accordance with our Incident Response Plan ("IRP") and applicable law. The IRP is designed to provide guidance for effective, efficient, and orderly response to a variety of cybersecurity incidents. The ISC is responsible for communication escalation as necessary up to and including to the Board of Directors. The IRP is periodically exercised through tabletop exercises.


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. To manage cybersecurity risk, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. The cybersecurity strategy is memorialized within the Company's information security program. The program incorporates regulatory guidance and industry standards while leveraging information from industry associations, third-party benchmarking, audits, threat intelligence and peer industry groups. The information security program is reviewed by the Chief Risk Officer and presented to the Risk, Compliance and Planning Committee to periodically account for the changes in the cyber threat landscape. It is also periodically assessed by the Internal Audit department.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: The Company has deployed an in-depth cybersecurity strategy to protect its assets, which includes a diverse preventive and detective tool set to stop, monitor, and alert management of suspicious activities and potential advanced persistent threats. We have implemented other preventive technologies and mitigating processes that include on-going education and training for employees, periodic tabletop exercises and recovery tests, and regular infrastructure penetration tests conducted by cybersecurity professionals and third-party specialists. Our internal and external auditors, along with independent external partners, periodically assess our processes, systems and controls for design and operating effectiveness, and provide recommendations to bolster our cybersecurity program. In addition, employees are subjected to regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. We also monitor our email gateways for malicious phishing emails and monitor remote connections through a secure virtual private network. Like many companies, we rely on third-party vendor solutions to support our operations. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence. We have a vendor management program in place to assess and manage risks associated with third-party service providers.


text: To prepare to respond to incidents, the Enterprise Risk Management Committee periodically reviews and updates our cyber Incident Response Plan ("IRP"). The IRP provides a framework to address potential and actual cybersecurity incidents to include assessment to recovery by our Incident Response Team and notification to the appropriate management and board committees and regulatory agencies. The Incident Response Team is comprised of representatives from various departments including Information Security, Information Technology, Risk Management, Legal, Operations, Marketing and Accounting. Our Information Security Officer manages the IRP and coordinates with senior level management and multiple areas of the company in execution of the plan. While we have experienced cybersecurity incidents, we have not, to our knowledge, experienced an incident materially affecting, or reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Information Security Officer is accountable for managing the information security department and executing the information security program. The information security department is responsible for cybersecurity risk assessments, alert monitoring, incident response, vulnerability assessment, threat intelligence, identity access governance, and third-party information security risk management. The department consists of information security professionals with varying levels of education, experience and certifications. Our information security department is further supported by our first line of defense, the Information Technology department and a third-party managed service security provider. The information technology department is responsible for the patch and vulnerability management, identity and access management, endpoint and network security, IT asset management program, and backups and recovery operations.


text: The Risk, Compliance and Planning Committee of our Board of Directors provides oversight of the information security program including cybersecurity and is chaired by an independent director. Cybersecurity metrics are reported to the committee quarterly. Additionally, management has established an Information Technology Executive Steering Committee focused on technology impact, and an Enterprise Risk Management Committee focused on business and risk impact, both consisting of executives and department leaders across multiple domains. These committees generally meet quarterly and more frequently when warranted. The information security department holds a monthly security meeting with the managers from the information technology department to discuss significant security incidents and status of the threat landscape. The Information Security Officer reports significant cybersecurity or privacy incidents and the state of the information security program to the Risk, Compliance and Planning Committee of the board on a quarterly basis. The Risk, Compliance and Planning Committee of the Board of Directors provide a report of activities to the full board at each quarterly board meeting.


text: The Company's Information Security Officer (ISO), James Hinks, leads our cybersecurity program and oversees the Company's Security Operations Team (SOC), supporting our security functions of identifying, preventing, detecting, responding, and recovering. The SOC team comprises personnel with extensive experience in information technology across the private and public sectors. Mr. Hinks holds multiple security accreditations and 25 years of experience in cybersecurity, software development, systems, networking, and other technology-related roles within public and private industries, with 15 years in IT leadership roles. Mr. Hinks has been employed with the Company since 2019, overseeing information security, disaster recovery, vendor management, and physical security.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: Risk Management and Strategy Primerica has processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats which are integrated into Primerica's enterprise risk management system. Primerica's enterprise risk management and internal audit functions conduct regular assessments and audits of risks from cybersecurity threats and report the results to the Board of Directors at least quarterly. The Board considers cybersecurity risk as part of its business strategy, risk management, and financial oversight.

companyName: Primerica, Inc.

ticker: PRI


text: Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company's policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy.


text: The Board of Directors has responsibility for oversight of risks from cybersecurity threats. The Board receives a quarterly report from the Chief Information Officer and Chief Information Security Officer on risks from cybersecurity threats and, under the Company's incident reporting plan, the Board is informed by management of certain cybersecurity incidents as appropriate. In 2024, the Board participated in a facilitator-led training and simulation of an information security incident.


text: Primerica's senior executive leadership is actively involved in managing material risks from cybersecurity threats. Primerica's cybersecurity operations risk steering group is chaired by the Chief Insurance Officer and holds quarterly meetings. It includes key executives from the Company's technology, security, privacy, and legal teams, coordinates corporate security initiatives and provides high-level guidance on technology-and security-related issues. The Chief Information Security Officer has responsibility for assessing and managing the Company's material risks from cybersecurity threats. The Chief Information Security Officer has served in various roles in information technology and information security for 36 years, including serving as the Company's Chief Information Security Officer for over 24 years.


text: As discussed in the "Item 1A. Risk Factors – Privacy, Cybersecurity, Technology, and Data Protection Risks," we face certain ongoing risks from cybersecurity threats and recognize the critical importance of effective cybersecurity risk management in today's interconnected digital landscape. As part of our commitment to safeguarding our operations, sensitive data, and stakeholder trust, we have implemented robust cybersecurity practices and governance.

companyName: ICF International, Inc.

ticker: ICFI


text: Our risk mitigation strategy focuses on measures to prevent, detect, and respond to cybersecurity incidents. The primary components of our risk mitigation strategy include: • Security Controls: We maintain a comprehensive set of controls aligned with industry standards such as the National Institute of Standards and Technology ("NIST") and the International Organization of Standards ("ISO") 27001 to protect our systems, networks, and data. • Incident Response Plan: We have a well-defined incident response plan that outlines roles, responsibilities, and procedures for handling cybersecurity incidents. • Employee Training and Awareness: We have training programs to ensure that our employees understand their role in maintaining a secure environment and recognize potential threats. • Third-Party Risk Assessment and Management: We assess and manage cybersecurity risks associated with our vendors, partners, and service providers.


text: Notwithstanding the vigorous approach we take to cybersecurity, we may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, we have not identified cybersecurity risks, threats, or incidents that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.


text: Cybersecurity Governance and Oversight Our Board, directly or through its committees, is responsible for the oversight of the Company's overall enterprise risk management program, which includes cybersecurity risks. Our Audit Committee regularly reviews and evaluates cybersecurity risks and the procedures and policies implemented by management to identify, manage, and mitigate such risks.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our current Chief Information Officer (the "CIO"), the Deputy Chief Information Office (the "Deputy CIO") and the Chief Information Security Officer (the "CISO") have primary oversight of material risks from cybersecurity threats. The CIO has decades of professional experience across various engineering, business and management roles. Our Deputy CIO has over 30 years of experience leading implementation of various IT infrastructure and systems, and our CISO has over 20 years of specific cybersecurity experience and is responsible for maintaining compliance with applicable security requirements. They have a combined tenure of over three decades with the Company in various progressive management roles in information systems and technology and information security. They conduct regular meetings with the Audit Committee and the Board to communicate updates on cybersecurity risks, incidents, and mitigation efforts. The CISO and our security staff provide ongoing support to internal operations and oversight to our systems that offer services to our clients within our enterprise network. Our security staff is also augmented through an industry-recognized security operations center where systems are continuously monitored.


text: Risk Management and Strategy Premier's risk management program is designed to identify, measure, prioritize, and manage risk, including information security and cybersecurity risk, in relation to the Company's desired risk appetite established by its Board of Directors. Premier uses a risk-based approach to manage and mitigate threats to information technology resources. Periodic risks assessments are conducted to identify, assess, and reduce information security and cybersecurity risks to acceptable levels.

companyName: PREMIER FINANCIAL CORP


text: Premier addresses third-party risks as part of Premier's Vendor Risk Management ("VRM") Policy and Program. The purpose of the VRM is to provide a consistent framework to direct Premier in the assessment, measurement, monitoring and control of risks related to vendors and third parties with whom Premier does business. Premier assesses and monitors the cybersecurity controls of third party service providers and partners. As part of the initial and regular monitoring of the vendor, the Company reviews a vendors internal controls based on the COSO framework in alignment with their formal SOC II assessments. The focus of the review is on a vendor's internal management and security practices including but not limited to, physical/systems security, business resiliency, application programming practices, systems security monitoring, and systems change control/authorization.


text: Notwithstanding the focus Premier places on cybersecurity, Premier may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Premier Board of Directors has assigned to the Board Risk Committee ("BRC"), along with the ERMC, oversight of risk management, including risks associated with information security and cybersecurity. The BRC is comprised of independent directors of Premier with participation from Premier's executive leadership and additional members of management. The ERMC is chaired by the Chief Risk Officer and, in addition to general oversight of risk management, is responsible for documenting all risks for the organization and reporting to the BRC issues of a critical nature. The ERMC meets monthly and is a cross-functional group comprised of all members of executive leadership and additional members of management from different areas of the Company. The ISOC is responsible for managing and mitigating information security and cybersecurity risks where appropriate and escalates issues to the ERMC. The ISOC is chaired by the CISO and includes select members of executive leadership and representatives from the Risk Management Department and Information Technology Department. The ISOC meets at least monthly. Routine reporting of the status of cybersecurity risks and mitigation activities progress from the ISOC to ERMC and finally to BRC.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Longeveron Inc.

ticker: LGVN


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's General Counsel ("GC"), Chief Technology Officer ("CTO"), other members of management and relevant management committees, including Company's Senior Leadership Team ("SLT"), regarding cybersecurity oversight and risk management. • Collaborative Approach: The Company, through its information technology partner, has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company, through its information technology partner, deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti- malware functionality and access controls, which are evaluated and improved through vulnerability assessments, penetration testing, and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company, with its information technology partner, maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident. • Education and Awareness: The Company, through its information technology partner, provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, systems, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability and penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company with our information technology partner regularly engages assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the CTO and GC who shares data with the SLT and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The CTO, in coordination with the SLT, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The CTO and the SLT, through its information technology partner receives regular reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations. On an annual basis, the Audit Committee and the Board discuss the Company's approach to cybersecurity risk management with the members of the SLT, which includes the Company's CTO, GC, and Chief Financial Officer ("CFO").


text: The CTO, in coordination with the SLT, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams are prepared to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the Company's information technology partner, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Company's SLT and Audit Committee, when appropriate.


text: The Company's information technology partner has worked in information technology and information security for over 30 years with over 300 employees with six locations in the United States. A virtual Chief Information Officer ("vCIO") from the partner works directly with the Company to align business and technical strategies, decisions, and implementations. The CTO has nearly 20 years of experience in the pharmaceutical and biotech industry managing programs and projects across a variety of implementation methodologies and risk factors and holds undergraduate degrees and certifications in his respective field. The Company's Chief Executive Officer, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: Risk management and strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personal data, including that of our employees, consultants and clinical trial participants (Information Systems and Data).

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The Chief Financial Officer, Chief Business Officer, Chief Accounting Officer, Senior Vice President of Legal, Vice President of Information Technology, and certain third-party providers are members of our Cybersecurity Risk Management Committee and help identify, assess and manage the Company's cybersecurity threats and risks. This Cybersecurity Risk Management Committee, which reports to the Audit Committee of the Company's Board of Directors, is responsible for identifying and assessing risks from cybersecurity threats. The Cybersecurity Risk Management Committee monitors and evaluates our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, evaluating certain cybersecurity threats reported to us, conducting internal and external audits of certain environments and systems, and performing third-party threat assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan; information security program; acceptable use policy; incident detection and response tools; risk assessments of certain environments and systems; encryption of certain data; network security for certain environments and systems; access controls for certain environments and systems; data segregation of certain data; physical security; asset management; third-party systems monitoring; employee cybersecurity training; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Cybersecurity Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, such as legal counsel, cybersecurity consultants, forensic investigators, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software application providers, hosting companies, and contract research organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including reviewing security questionnaires and imposing contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—General risk factors—If our information technology systems, or those of any of our third-party partners (such as contract research organizations and clinical trial sites), or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; additional costs; loss of revenue or profits; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer, Vice President of Information Technology and Senior Vice President of Legal, working closely with our third-party information technology team; the senior staff members of our third-party information technology team have been in business providing services to similarly situated companies in our industry for more than approximately 28 years, including extensive experience addressing complex information technology and cybersecurity matters. Company management has over 27 years of experience in cybersecurity and information technology matters, including multiple senior information technology leadership roles supervising cybersecurity teams and establishing cybersecurity risk assessment programs in the biotech industry.


text: In particular, the Chief Operating Officer is responsible for hiring appropriate personnel and third-party vendors, communicating key priorities to relevant personnel, and, in concert with members of the Cybersecurity Risk Management Committee, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy. Our Chief Operating Officer, Vice President of Information Technology and Senior Vice President of Legal, in consultation with our third-party information technology team, is responsible for maintaining cybersecurity-related budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The audit committee receives reports concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them, including during audit committee meetings and other periodic updates. These reports are provided by members of the Company's management team responsible for such reporting, including the Cybersecurity Risk Management Committee. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We maintain a risk-based cybersecurity program, including various protections designed to safeguard against cyber attacks and manage material information and cybersecurity risks to address the confidentiality, integrity, and availability of our critical systems and information. This program includes: • the implementation of access controls, firewalls and virus detection software; • the establishment (and periodic testing) of our disaster recovery plan, including protecting against business interruption by backing up our major systems; • periodic scans of our environment for vulnerabilities and engagement of third parties to perform penetration testing and assess effectiveness of our information security practices; and • the maintenance of insurance that currently includes cybersecurity coverage.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: In the normal course of business, we also collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, customer information including bank account information and invoice and payment information, sensitive third-party information and employee information, and certain personal information. To protect this information and our systems, our existing cybersecurity protections include monitoring and detection programs and technical security measures. Additionally, we have processes in place that are designed to assess and manage cybersecurity risks associated with our use of higher-risk third-party service providers.


text: Governance—Board Oversight and Management's Role in Assessing and Managing Cybersecurity Risks Our board of directors and Chief Executive Officer have ultimate accountability for risk. This includes oversight of our risk management program, which includes risks from cybersecurity threats. Our board of directors and Chief Executive Officer, including through the risk management committee of our board of directors, provide oversight to ensure the appropriate measures are in place so that management can identify, assess, prioritize, and respond to risk, including cybersecurity risks. We believe our board of directors, the risk management committee of our board of directors, and our Chief Executive Officer collectively have the requisite experience, knowledge, inquisitiveness, and visibility into the design and operation of our information security practices to fulfill this responsibility effectively.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks At an operating level, our cybersecurity program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO has over 20 years of information technology experience that spans architecture and design, governance, disaster recovery, department development, and risk identification and remediation. In addition, our CISO has over 25 years of cybersecurity experience with a skill set that includes incident and remediation management, company-wide training, and the creation and implementation of cybersecurity compliance programs that address administrative, physical, and technical safeguards.


text: Our cybersecurity program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity leadership regularly reports to the board of directors and its risk management committees on information security and cybersecurity matters, including risk assessments, incident responses, and strategic initiatives aimed at mitigating potential threats. For example, the risk management committee in conjunction with management and our enterprise risk management team reviews and discusses cybersecurity metrics on a regular basis that include phishing incidents and training, vulnerability management, and security incident trends.


text: We have implemented policies, standards, and technical controls based on the National Institute of Standards and Technology ("NIST") framework with the aim of protecting our networks and applications, to safeguard the confidentiality of sensitive information entrusted to us. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Material Impacts from Cybersecurity Threats and Incidents Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyber-attack will not occur. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: During the fiscal year ended December 31, 2024, we incurred $ 302 in response costs related to the incident, including professional services and legal fees, before insurance recoveries. We do not expect to experience material expenses and costs associated with our response to this cybersecurity incident during 2025. No liability for losses has been recorded related to the incident as of December 31, 2024.


text: We maintain cyber insurance coverage and have tendered claims for certain expenses incurred in connection with this event. During the year ended December 31, 2024, we recovered $ 2.1 million from our insurer. Insurance recoveries are recorded as a reduction of general and administrative expense. Refer to Note 13 of the Notes to Consolidated Financial Statements included elsewhere in this Annual Report on Form 10-K for additional information concerning the incident.


text: The head of our IT department, who has more than 25 years of experience in IT and more than 15 years of experience in cybersecurity for public companies, reports to our Chief Operating Officer and works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We have established an Incident Review Team, which consists of representatives of our Finance, IT and Legal departments, to investigate, evaluate and respond to cybersecurity incidents. The Incident Review Team is responsible for escalating confirmed cybersecurity incidents to a Materiality Assessment Team, consisting of members of management. The Materiality Assessment Team is responsible for reporting cybersecurity incidents to the audit committee of the board of directors, as appropriate based upon the nature of the incident (or series of incidents).

companyName: Kura Oncology, Inc.

ticker: KURA


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity software, and darkweb monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, CROs and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, the access to be provided to such Information Systems and Data, and the identity of the provider, our vendor due diligence involves different levels of assessment of systems and controls designed to help identify cybersecurity risks associated with a provider. In addition, we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: As an HCM company, we face a multitude of cybersecurity threats from threat actors seeking to access, compromise access, or leverage the data we possess for malicious ends. Review of our information security program, including our cybersecurity policies, standards, and processes, is integrated into our Enterprise Risk Management ("ERM") program which is based on the COSO Enterprise Risk Management Framework and International Organization for Standardization ("ISO") 31000, the two most widely used global standards for ERM.

companyName: Dayforce, Inc.

ticker: DAY


text: Our information security program aligns with recommended practices in security standards issued by ISO, American Institute of Certified Public Accountants (SSAE18), National Institute of Standards and Technology ("NIST") and other industry sources. Specifically, we maintain several ISO certifications (ISO 27001, 27701, 27017, 27018, 27036), NIST 800-171 compliance, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. We have invested in our data security team, information security program, and security environment in an effort to identify, prevent, and mitigate cybersecurity threats and promptly identify and respond to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program to ensure that it remains reasonable and appropriate with respect to changes in the security threat landscape, available technology, security vulnerabilities, and legal and contractual requirements applicable to us, is a continuous effort.


text: Risk Management and Strategy We believe that effective cybersecurity depends upon the successful implementation and maintenance of a comprehensive information security program. Deploying suitable security technology, which encompasses analytics and automation, and leveraging the expertise of highly skilled security and risk professionals, is crucial in our strategy. Additionally, we prioritize data governance and data-centric security as integral components of our approach in an effort to ensure compliance, uphold privacy standards, and safeguard customer and enterprise data.


text: We continue to enhance our capabilities in cloud security and assurance testing, security operations and automation, product security, and enterprise risk management. To combat the evolving cybersecurity risk landscape and the enhanced level of sophistication of cybersecurity threats, management has prioritized five areas of our information security program: global standards and operations, a risk-aware workforce, product security, detection and response, and data governance management. In addition, we maintain cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: We contract with several outside cybersecurity experts to audit and test security controls on a regular basis. Any risks or control gaps identified as a result of such assessments, audits, and reviews are reported to the senior leadership of all functional areas of the Company, the Audit Committee of the Board (the "Audit Committee"), and the Board as appropriate, and we adjust our cybersecurity policies, standards, and practices as necessary.


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry-leading practices, and we evaluate them for additional information, product, and physical security requirements.


text: We face a number of risks from cybersecurity threats, which may materially affect our business, financial condition, and results of operations, because our business is dependent on the successful operation of our payroll, transaction, financial, accounting, and other data processing systems. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have detected all cybersecurity incidents. Please refer to Part I, Item 1A, "Risk Factors" for further discussion of our cybersecurity-related risks.


text: Our commitment to cybersecurity begins at the Board and extends to the senior leadership of all functional areas of the Company. Our Audit Committee oversees our risk management process at the Board level. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management, including in the areas of cybersecurity and other information technology risk and privacy.


text: The Company's cybersecurity program is supervised by our Chief Information Security Officer ("CISO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity, strategy, policy, standards, and processes. The CISO provides quarterly updates related to the cybersecurity program, including any notable incidents at regularly scheduled Audit Committee meetings. The CISO updates include details regarding the magnitude, financial impact, and remediation of cybersecurity incidents. Members of our Board and senior Company executives participate in annual tabletop exercises that focus on testing response plans to ransomware, cloud security, payroll disruption, and other incidents. In addition, in order to deploy a consistent cybersecurity framework, and to manage the risk of social engineering, software downloads, and phishing, we educate employees globally through ongoing security awareness training.


text: Our CISO has over 25 years of experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and is a member of the National Association of Corporate Directors ("NACD"). Our CISO works closely with our Vice President, Enterprise Risk, Compliance and Service Management to assess and manage the cybersecurity element of our ERM program. In the area of risk, the Vice President, Enterprise Risk, Compliance and Service Management focuses on risk management, business continuity planning, crisis management, operations management, and executive and Board reporting.


text: Our CISO and Vice President, Enterprise Risk, Compliance and Service Management report to our Chief Digital Officer, who in turn reports to our President and Chief Operating Officer. These officers drive our cybersecurity priorities at the executive level.


text: We have established a documented cybersecurity incident materiality assessment and disclosure program that is jointly managed by our Incident Response, Cybersecurity, and Corporate Legal teams. This program calls for the immediate assessment of potentially material cybersecurity incidents, and the appropriate escalation to our cross-functional Disclosure Committee in order to facilitate the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner and elevated to our Audit Committee or Board, as appropriate.


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on applicable banking regulations, including the Interagency Guidelines Establishing Information Security Standards ("Interagency Guidelines"), and a Cybersecurity Assessment Framework. Our cybersecurity program in particular focuses on the following key areas: Process

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Our cybersecurity risks are identified and addressed through a cross-functional approach that includes coordination through our Corporate Information Security Committee, which includes senior managers in our information security, information technology, operations, risk, compliance and privacy departments or functions. Key security, operations, risk, compliance and privacy stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to follow state and federal regulations to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board in a timely manner.


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. These assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our CISO has more than 27 years of Information Technology and 21 years of Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 25 years of information technology experience and 18 years of experience in the financial services industry. Our CRO has more than 33 years of experience in Banking and over 15 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with over 35 years of banking experience in Operations, Vendor Management, IT, Security, Treasury Management and Payment Operations.


text: Information Technology and Cybersecurity The Company depends on the proper functioning, availability, and security of its information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties, grants limited access to the Company's systems to third parties providing specific outsourced functions or other services, and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the Company's critical information systems, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees, and others (including joint venture partners and Curbline Properties), could result in liability for the Company to third parties and have a significant impact on the Company's operations and reputation.

companyName: SITE Centers Corp.

ticker: SITC


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the Company's networks, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. This oversight has been integrated into the Company's enterprise risk management system. For example, the Company's management team reviews the findings, if any, of the internal audit team's assessments, analyzed the identified risks, and takes action based on the Company's overall risk profile. In order to assess the risks posed to the Company's information systems by third-party service providers and vendors, the information technology department, coordinating with the Company's internal audit services team, evaluates new software and network application vendors' contracts, internal policies, certifications, and System and Organization Controls ("SOC") reports during the procurement of solutions and services.


text: The Company has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect the Company's on-site data center, and electrical power protection and generation facilities. The Company also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.


text: The Company conducts annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of the Company's risk mitigation efforts. The Company also maintains cybersecurity insurance; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.