text: Our Chief Operations Officer and Information Security Officer, along with their departments, are accountable for managing our enterprise information security and delivering our information security program. Their responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. Certain individuals within their departments are generally subject to professional education and certification requirements. In particular, our Information Security Officer and Director of Technology have relevant expertise in the areas of information security and cybersecurity risk management.


text: The Bank's Technology Steering Committee provides oversight and governance of the Bank's technology program and the information security program. Members of this committee include executive management, our Information Security Officer and Director of Technology. This committee meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. The Chief Operations Officer regularly reports summaries of key issues that would include cybersecurity incidents or other related information from the Technology Steering Committee to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK

secItem: Item 1C


text: The Bank Board is ultimately responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and Director of Technology provide reports to the Bank Board, at least annually, regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Bank Board reviews and approves our information security and technology policies annually.


text: Cybersecurity Risk Management and Strategy In the ordinary course of our business, we may use, store and process confidential information and data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of data segregation, physical, procedural, and technical safeguards along with some documented policies and procedures. By fully outsourcing our IT environment and placing it within expert third party software-as-a-service, human resource, and clinical providers, our primary means of minimizing cybersecurity risk is limiting the amount of sensitive data within our enterprise.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, tests on our systems, review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including IT consultants and computer security firms, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: In an effort to deter and detect cyber threats, we regularly provide all employees with a data protection, cybersecurity, incident response, and prevention, training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Governance; Board Oversight Under the ultimate direction of our Chief Executive Officer, with oversight from our Board and Audit Committee (as described below), we maintain a security governance structure to evaluate and address cybersecurity risks. Our Chief Executive Officer regularly consults with our Chief Financial Officer and third-party IT consultants and computer security firms, leveraging and relying upon these consultants' cybersecurity expertise, to develop strategies that assess and address threats while aligning cybersecurity efforts with business objectives and operational requirements.


text: The Audit Committee of our Board provides direct oversight over cybersecurity risk and provides updates to the Board regarding such oversight on a periodic basis. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents. The Audit Committee also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: Our board stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. We outsource most aspects of our information technology management and these third-party providers are available to address any cybersecurity issues that may arise.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO


text: We have implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, we have continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture. We also hired a information technology manager to oversee and identify any risks from cybersecurity threats associated with our use of third-party service providers.

companyName: 374Water Inc.

ticker: SCWO


text: a security team led and supervised by our information technology manager, which is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security control, as well as processes to oversee and identify any cybersecurity risks associated with our use of third-party service providers;


text: Cybersecurity Governance Our Chief Administrative Officer ("CAO") is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CAO leads our security team and coordinates with our Chief Executive Officer, Chief Financial Officer and Information Technology Manager to fully integrate our cybersecurity risk management programs with our overall enterprise risk management program. Our Information Technology Manager CAO is responsible for overseeing and managing all potential and actual incidents that are identified by our security team. Our security team regularly updates our systems with updates, anti-virus signatures, policies and security best practices. At least annually, our CAO reports to the Audit Committee of the Board updates to the Company's cybersecurity risk management program and any material cyber incidents. Our Sr Information Technology Manager has extensive expertise and experience on cybersecurity matters, including identification, remediation, and management..


text: Incident Response and Assessment Policies and Procedures We align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we are in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.


text: The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to:

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Cyber-attacks: We are vulnerable to cyber-attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.


text: Risk Management Personnel The Information Security Officer has the primary responsibility for managing the Program to identify, assess, manage, and control cybersecurity risk. The Information Security Officer reports directly to the President. The Information Security Officer has approximately 16 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.

companyName: F&M BANK CORP

ticker: FMBM


text: Cybersecurity risk management is part of the Company's overall risk management program. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity programs are under the direction of its Treasurer with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors.

companyName: Idaho Strategic Resources, Inc.

ticker: IDR


text: There were no material cyber security incidents discovered in 2024.While cybersecurity risks have not materially affected the Company's business, operations, or financial condition to date, the Company recognized that an increase in cyber threats, data breaches, or system vulnerabilities could have a material impact on future operations.


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management system and are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems. Our operations involve collecting and storing information in cloud systems, such as Google Drive, and we rely on third-party providers, such as Google, whose systems may encounter interruptions and/or cybersecurity incidents.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: We adhere to a risk management framework based on applicable laws and regulations to handle cybersecurity risks across our products, services, infrastructure and corporate assets. We regularly conduct risk assessments to gauge the effectiveness of our systems, identifying areas for improvement. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including Squarespace and Google Workspace, which assist us with information technology system monitoring, detection, and response support services.


text: Risk Management and Strategy In accordance with the Securities Exchange Commission ("SEC") rules, the Company is required to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: SCIENTIFIC INDUSTRIES INC

ticker: SCND


text: We have developed, implemented, and maintain certain cybersecurity processes and controls intended to safeguard our information systems and protect the confidentiality, integrity, and availability of our data, based on material risks identified.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management and as part of our decision-making processes. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including but not limited to regular network and endpoint monitoring, vulnerability assessments, various system backups of all information, and through policy and procedure inform and train employees on the Company's underlying practices, and annual assessment and testing of such controls. Our information security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile.


text: As of and for the year ended December 31, 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Our Board of Directors addresses cybersecurity risk management as part of its general oversight function and delegates cybersecurity risk management oversight to our Audit Committee. Our management team is responsible for assessing and managing our material risks from cybersecurity threats and provides updates to the Audit Committee on major developments regarding cybersecurity matters. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and reports any findings and recommendations, as appropriate, to the Board of Directors for consideration.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: PEDEVCO CORP

ticker: PED


text: Although we have designed our cybersecurity program and governance procedures discussed above to mitigate cybersecurity risks, we may in the future experience cybersecurity risks, threats and attacks. To date, no risks, threats or attacks have had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact on us in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: CYBERSECURITY GOVERNANCE The Company's Board of Directors has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk; however, the full Board is typically present for Information Technology (IT) and Cybersecurity briefings. As part of its oversight role, the Audit Committee receives reporting about the Company's cybersecurity program, activities, threats and incidents (if any) through periodic updates. The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, who reports directly to our CEO. Utilization of an outsourced IT infrastructure team allows Data I/O to access the necessary breadth and depth of leading cybersecurity programs, staff, expertise, and tools. The IT infrastructure team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity function, including the operation of the Company's incident response plans, which include appropriate escalation to the CFO, CEO and the Audit Committee.

companyName: DATA I/O CORP

ticker: DAIO


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management and have been embedded in the information systems operating procedures and internal controls. Our IT function manages IT operations and continually evolves and enhances our systems to meet the constantly changing digital environment. Periodic cybersecurity risk assessments are performed to identify, assess, and prioritize potential risks to information, data assets, infrastructure and third-party vendors. The Company addresses significant risks through corrective or mitigating actions as necessary.


text: Risk management and strategy Data integrity, privacy, availability, and security are critical to the corporate information technology, communication networks, accounting and financial reporting platforms, and related systems which are necessary for the operation of our business. These systems are used to manage our vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business including site security. Our business operations rely on the data privacy and security necessary to safeguard and protect secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: We are continually assessing the need to implement and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature.


text: We engage a third-party provider to identify, assess, and manage cybersecurity threats and risks which is achieved through monitoring and evaluating our threat environment and our risk profile using various methods including the use of manual and automated tools, analysis of reports of threats and threat actors, scanning the threat environment, and evaluation of our industry's risk profile.


text: Various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data have been implemented and are maintained. These include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.


text: We engage certain third-party service providers to perform a variety of functions within our business and seek to ensure that we work with reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing provider cybersecurity practices, conducting provider security assessments, and conducting periodic provider reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats or cybersecurity incidents which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Our board of directors is responsible for oversight of our strategy and risk management, including material risks related to cybersecurity threats. The board of directors engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Our management, represented by Director, Rick Orman, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance, including integration of cybersecurity risk considerations into our overall risk management strategy and communication of key priorities to relevant personnel. Management is responsible for cybersecurity-related matters including approval of processes; review of assessments and other matters; evaluation of potential impact of incidents to determine materiality based on the nature and scope of the incident and any impact to operations, assets, or reputation; and response to incidents, including reporting certain incidents to the audit committee. The audit committee receives periodic reports from management, including our acting Chief Executive Officer concerning any cybersecurity threats and risks considered to be significant and the processes we have implemented to address them.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cyber security threats, as such term is defined in Item 106(a) of Regulation S-K. We have established internal procedures for assessing, identifying and managing cyber security risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: The Company's cybersecurity strategy focuses on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies primarily on its qualified internal team, with assistance from third party service providers, to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature.

companyName: QUOTEMEDIA INC

ticker: QMCI


text: The Company's employees identify and assess risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats, nor has the Company had a previous cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with management and, if and when deemed appropriate by management or the Audit Committee, third party service providers, regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. We have completed various security audits and certifications, including SOC 2 Type II.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not mean that we meet any technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TSS, Inc.

ticker: TSSI


text: As part of our cybersecurity risk management system, our IT management team tracks and logs privacy and security incidents across our OEM partners, Microsoft and Oracle and other IT system providers, our vendors, and other third-party service providers to remediate and resolve any such incidents. Any significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to designated members of our senior management. We would consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosures and other compliance decisions. Our management is tasked with apprising TSS' independent public accounting firm of matters and any relevant developments.


text: Currently, we have not identified risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.


text: NIST SP 800-34, Rev 1, "Contingency Planning Guide for Federal Information Systems," November 2010 NIST SP 800-37 Rev. 2, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," December 2018 NIST SP 800-53, Rev. 5, "Security and Privacy Controls for Information Systems and Organizations," September 20, 2020, updated December 10, 2020 NIST SP 800-61, Rev 2, "Computer Security Incident Handling Guide," August 2012 Our approach to cybersecurity aims to protect the confidentiality, integrity, and availability of the data we handle. This process involves measures to identify and prevent cybersecurity threats and mechanisms to mitigate and respond to cybersecurity incidents.

companyName: WIDEPOINT CORP

ticker: WYY


text: By engaging in these rigorous and diverse testing and assessment activities, we verify the current effectiveness of our cybersecurity measures and identify areas for continual improvement, ensuring our defenses evolve in line with the dynamic nature of cyber threats.


text: Executive Experience and Qualifications Our CEO has over thirty (30) years of risk management experience, and our COO with over twenty (20) years of experience including cybersecurity, possess deep expertise in their respective fields, evidenced by their academic qualifications and professional trajectories. This collective experience underpins our robust approach to managing cybersecurity risks. In addition, we have numerous employees with experience and qualifications related to cybersecurity. We have named a Chief Information Security Officer as part our cybersecurity program. Our executive officers are responsible for informing the Board and Governance Committee of any new material cyber events or risks.


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support table top exercises and to conduct security testing.


text: Management and the Company's third-party information security officer discuss information technology needs and activity and assess and manage material cybersecurity risks and the Company's practices for the prevention, detection, mitigation, and remediation of cybersecurity incidents, as necessary and appropriate. Our third-party information security officer has 30 years of experience in the IT management field and has consulted with large and mid-size corporations on proper IT processes and security. Our CEO and CFO have managed information technology departments during their careers. Our CFO was trained as an auditor and an information technology auditor at the public accounting firm of Ernst & Young LLP and audited the internal controls, including IT controls, of public companies, information technology departments, and third-party information technology service providers for 12 years.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: Our Board of Directors has overall responsibility for risk oversight and oversees the implementation and continuous improvement of our cybersecurity program and compliance with disclosure requirements. The Board of Directors receives regular reports and periodic briefings from the Chief Executive Officer (in view of the absence of a Chief Financial Officer) on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities. Our cybersecurity program is overseen by the Chief Executive Officer (in view of the absence of a Chief Financial Officer) in conjunction with a third-party service provider. The third-party service provider has the primary responsibility for the Company's cybersecurity risk management program. At the time an incident is identified, the Company completes an evaluation and summarizes the incident that is shared with the Board of Directors to effectively manage resources to reduce risk and prevent future incidents.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Incident Disclosure To date, the Company has been subject to cyber related incidents, as previously disclosed in the Company's Quarterly Report for the quarters ended June 30, 2023 and September 30, 2023 and within this Annual Report. Since the identification of these incidents, we have implemented additional safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company.


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, amongst others, data encryption, risk assessments, network security and access controls, physical security, asset management, and systems monitoring. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls reports of such third-party service providers when onboarding the provider and quarterly thereafter.

companyName: Loop Industries, Inc.

ticker: LOOP


text: While we have not, as of the date of this Report, experienced any material cybersecurity incidents that materially affected us, including our operations, business strategy, results of operations, or financial condition, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, financial condition, results of operations. See "Risk Factors – We are exposed to cybersecurity threats or incidents."

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents. He consults with experts in enterprise security and risk management to ensure our intellectual property and devices are protected. While we have not experienced a material information security (cybersecurity) incident, we maintain an information security (cybersecurity) risk insurance policy as a matter of good practice.


text: Cybersecurity Governance Our executive team and Board of Directors are actively involved in overseeing cybersecurity risks. The executive team and the CIO oversee the Company's information security efforts and cybersecurity governance. This team regularly reviews our cybersecurity posture and any incidents that have occurred.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our board of directors and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems.


text: Third-party risk management: Assessing the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.


text: The Board is also regularly briefed by our director of information technology (IT) on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.


text: Management, led by the director of IT, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The director of IT is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.


text: Additionally, management conducts regular tabletop exercises and incident simulations to assess readiness for potential cyber threats and continuously evaluates the effectiveness of our cybersecurity defenses.


text: We maintain a comprehensive process following standard compliance frameworks (i.e., NIST) for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We closely follow the security industry and global threat trends, and our security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Our team consists of professionals with deep cybersecurity expertise across multiple industries, including our Director of Infrastructure Management (our ISO) and our Vice President, Cybersecurity Services. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company. Should an incident arise or be identified, they reviewed by a cross-functional team to determine whether further escalation is appropriate, with any material incident being escalated to the appropriate members of the technical management teams.

companyName: INFINITE GROUP INC


text: As part of our cybersecurity risk management system, we track and log privacy and security incidents across IGI, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional team to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: Our cybersecurity and risk management program is designed to protect the confidentiality, integrity, and availability of our critical information systems and the data they hold. Due to the nature of our business and our customers, we face many potential cybersecurity challenges and threats, including attempts to gain unauthorized access to our intellectual property, trade secrets, codebase, proprietary or confidential information, fraud, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. Because we operate in financial-technology and data-sensitive environments, we expect these threats to continue to evolve and increase in complexity. We have implemented IT systems and processes designed to help defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. As we expand efforts in the financial technology sector, we will continue to invest in strengthening and supporting a robust cybersecurity posture and defense.

companyName: USBC, Inc.

ticker: USBC


text: We leverage a combination of cybersecurity frameworks to protect our assets. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs. We have a cybersecurity policy in place, which includes monthly meetings with internal cybersecurity and technology experts to review and maintain the procedures, ensuring they reflect current best practices.


text: Our cybersecurity program is spearheaded by our cybersecurity department, with support from external advisors and approval from executive management. The stakeholders have been identified and know their roles within the documented cybersecurity process.


text: Our Board of Directors receives periodic reports and annual updates on our cybersecurity posture, and both the Chief Information Security Officer and the Chief Financial Officer share responsibility for our program and solicit support from third-party experts as necessary. Our cybersecurity team consists of highly senior resources holding multiple certifications and degrees relating to cybersecurity and best practices.


text: Risk is assessed based on multiple factors and is overseen by the Audit Committee. Our IT and cybersecurity teams update and maintain our digital asset inventory to ensure all digital assets are included in our risk management process. The same is also true for all physical records/files as well as physical assets that would be considered intellectual property. Key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the Audit Committee and stakeholders to create action plans or exception requests for the acceptance of risk.


text: We leverage third party applications and software, as well as vulnerability and cybersecurity testing by third party cybersecurity experts, to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.


text: An incident response plan has been established, which provides detailed information on actions to take in the event of an incident. The plan defines the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high-pressure situations that can occur during incidents. We have had no material cybersecurity incidents in the last 24 months. However, during the fiscal year ended September 30, 2025, our leased office was physically broken into through a firemen's access conduit in an isolated physical security incident that did not result in a material impact on our operations, financial condition or results of operations. No items/assets were taken and the access conduit has since been disabled. We are in the process of installing additional physical security measures to make the location less vulnerable to unauthorized entry.


text: Sensitive and confidential data are an essential part of our business. We leverage a cybersecurity policy that identifies the type of information we store and what level of encryption and access role entitlement is required to store and access the data. This document also details the overarching requirements for encryption, such as encryption methods, and secret/key storage and retention. These requirements are periodically reviewed to ensure continued alignment with industry standards and regulatory expectations.


text: CEL-SCI recognizes the importance of assessing, identifying, and managing material risks from cybersecurity threats. CEL-SCI's policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into its overall risk management system. In this regard, CEL-SCI uses various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, routine employee awareness updates, annual cyber security training, monthly email testing engaging experts and third-party monitoring and detection tools.

companyName: CEL SCI CORP

ticker: CVM


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program led by the Company's Vice President, IT, that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third party risk management process for service providers, suppliers, and vendors.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors—Risks Related to Our Intellectual Property, Information Technology, Cybersecurity and Privacy—A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business, our reputation and our relationships with customers.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and in February 2024, delegated to the risk committee of the board of directors ("Committee") oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. Prior to February 2024, the board of directors had delegated this oversight to the audit committee of the board of directors. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full board of directors regarding its activities.


text: Our IT team, including our Vice President of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our IT team have over 10+ years of experience in operations technology support across multiple industries. The team holds industry standard certifications, related to System, Security and Network Administration, and are required to complete security awareness training multiple times per year.


text: Our IT team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A. Risk Factors—Risks Related to Our Intellectual Property, Information Technology, Cybersecurity and Privacy—A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business, our reputation and our relationships with customers.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and in February 2024, delegated to the risk committee of the board of directors ("Risk Committee") oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. Prior to February 2024, the board of directors had delegated this oversight to the audit committee of the board of directors. The Risk Committee oversees management's implementation of our cybersecurity risk management program.


text: The Risk Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Risk Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Risk Committee reports to the full board of directors regarding its activities.


text: Our IT team, including our Director of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our IT team have over 10+ years of experience in operations technology support across multiple industries. The team holds industry standard certifications, related to System, Security and Network Administration, and are required to complete security awareness training multiple times per year.


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: ARVINAS, INC.

ticker: ARVN


text: The Company does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have a cross-functional Cybersecurity Board led by our Vice President of Information Technology & Corporate Projects serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Vice President of Information Technology & Corporate Projects leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Vice President of Information Technology & Corporate Projects is an experienced senior leader with more than 20 years of experience in information technology within the pharmaceutical industry leading a team of employee and consultants with a breadth of experience including security management experience along with CISSP certification.


text: In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and legal and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.


text: Based on an assessment using the previously described risk mitigation strategy, we do not believe there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See "Our internal computer systems and those of our collaborators, contractors, consultants and other third parties are vulnerable to cyber attacks, cyber intrusions and security breaches, which could not only materially disrupt our business operations and result in the loss of confidential information, but could also damage the integrity of our clinical trials, impact our regulatory filings, compromise our ability to protect our intellectual property, and subject us to regulatory actions that could result in significant fines or other penalties" in Part I, Item 1A. "Risk Factors" for additional information.


text: Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity risks, threats or incidents. We also provide updates to the full Board of Directors regarding cybersecurity risks, threat landscape and risks, as appropriate.


text: We have a cross-functional Cybersecurity Board led by our Senior Vice President, Information Technology Systems & Security serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer and General Counsel. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Senior Vice President, Information Technology Systems & Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Vice President, Information Technology Systems & Security is an experienced senior leader with more than 25 years of experience in information technology within the pharmaceutical industry leading a team of employees and consultants with a breadth of experience including security management experience along with CISSP certification.


text: In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. This education and awareness program functions to educate employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We automatically assign online reinforcement training upon initial phish test failure and may follow-up one-on-one as needed. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual penetration tests conducted by independent, third-party cybersecurity firms and ongoing vulnerability assessments conducted by the internal security team.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which i is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp II


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidential business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the " C-ROC "), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "ITEM 1A. Risk Factors - Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Blue Owl Capital Corp

ticker: OBDC


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Our information technology ("IT") networks and related systems are essential to the efficient operation of our business and our ability to perform day-to-day operations (including managing our building systems and accounting for our business operations). In some cases, our clients' operations depend on our building systems. The risk of a security breach, incident, compromise or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees. To date, these events have not, individually or in the aggregate, materially affected our operations or business. In addition, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" for additional discussion of the cybersecurity risks related to our Company.

companyName: BXP, Inc.

ticker: BXP


text: Cybersecurity Risk Management & Strategy We have implemented and maintain a cybersecurity program that is designed to identify, assess and manage risks from cybersecurity threats and was established by reference to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The primary goal of our cybersecurity program is to prevent cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We aim to take an active approach to monitoring and evaluating our cybersecurity threat environment and risk profile as part of our cybersecurity program, which is administered by our information systems ("IS") department, led by our Senior Vice President, Chief Technology Officer ("CTO") and Senior Vice President, Chief Information Officer ("CIO," together with our CTO, "IS Leaders"). Our IS Leaders are primarily responsible for the direction and implementation of technology, applications and security at BXP. Our CTO has extensive technology and program management experience with approximately 40 years of technology experience, 26 years of which have been with BXP and a total of 30 years with publicly-traded REITs. In January 2024, our IS leadership expanded to include our CIO, who has 30 years of technology experience developed across multiple industries, including commercial real estate, in guiding organizations through strategic initiatives that span technology, cybersecurity, and digital transformations.


text: We maintain written information security policies and procedures, including a Cybersecurity Incident Response Plan ("CIRP") for incidents involving potential or actual compromises of information security. Our CIRP is overseen by the cyber executive response team, which is chaired by our Vice President, Risk Management and includes representatives from our IS and legal departments. In the event of a cybersecurity incident, we have implemented procedures to (i) mobilize third-party subject matter experts and (ii) notify executive leadership and the Audit Committee and/or the full Board of Directors, in each case, as appropriate.


text: As part of our overall cybersecurity program, we also conduct: • Regular assessments of our cybersecurity program. We assess our cybersecurity program against the NIST Cybersecurity Framework through annual internal assessments, and, every two years, we engage a third-party consultant to conduct an additive cyber assessment. These assessments review, among other things, our IT security measures and activities for alignment with the NIST Cybersecurity Framework. • Periodic penetration testing & vulnerability assessments. On an annual basis, we engage a third-party consultant to conduct two penetration tests per year. We also conduct vulnerability assessments on a monthly basis. • Regular cybersecurity awareness trainings & simulations. We conduct cybersecurity awareness training for employees and primary on-site providers during onboarding, and thereafter, multiple times per year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other security threats, as well as annual tabletop simulations.


text: In addition, our internal audit function integrates the assessment and identification of cybersecurity-related risks into our annual overall enterprise risk assessment ("ERA"). The ERA process is designed to assess and identify the key risks that management believes could adversely impact our business operations or impede the achievement of our business objectives, which includes an assessment of our cybersecurity program and the cybersecurity-related risks that we face. To the extent the ERA identifies a heightened cybersecurity-related risk(s), we have implemented a process for the risk(s) to be presented to the Audit Committee and the full Board of Directors, as appropriate.


text: We utilize certain third-party service providers to perform select functions. These third-party service providers also face cybersecurity threats, and a cybersecurity incident impacting any of our third-party service providers could also indirectly affect our operations, performance and results of operations. We have a data security committee, consisting of members from various BXP departments, including IS, legal and risk management, that meets periodically to assess, identify and manage cybersecurity risks related to certain third-party service providers and to protect our critical financial and sensitive business information, as well as personally identifiable information (collectively, "Sensitive Information"). The data security committee has implemented processes for evaluating the risk profile of those service providers that handle or have access to Sensitive Information, which informs applicable contractual obligations with these service providers. This evaluation, which occurs prior to onboarding, is designed to consider the nature of the services to be provided, the level of sensitivity and quantity of the information that the service provider handles or has access to, and the identity of the service provider.


text: Cybersecurity Governance Our Board of Directors is primarily responsible for risk oversight and discharges its responsibility directly or indirectly through its committees. In general, our risk management is designed to be facilitated through a top-down and bottom-up communication structure whereby the Board and/or its committees provide oversight and direction, and management is charged with the day-to-day management of risks, regular assessment of the risk environment and regular reporting to the Board, which may include management reports and reports from outside advisors and consultants engaged by the Board, a specific committee or management, as appropriate. This overall risk management and oversight framework includes risks related to cybersecurity threats. Pursuant to its charter, the Audit Committee oversees senior management's risk management processes related to assessing, identifying and managing cybersecurity risks in an effort to, among other things, help align our risk exposure with our strategic objectives. The Audit Committee meets no less frequently than annually with our IS department to discuss, among other things, recent trends in cyber risks, cybersecurity incidents, if any, and our cybersecurity defense strategy to protect against cyber-attacks and intrusions. These discussions with the Audit Committee are led by our IS Leaders and senior management. The Audit Committee provides regular updates to the full Board of Directors on matters under its purview, including risk management and cybersecurity matters.


text: Our cybersecurity processes include: • Basic security awareness online training for personnel with company email, on an annual basis; • Phishing tests for personnel with company email, on not less than an annual basis; • Reviews of certain third-party vendors' information security programs (as discussed below); • Consultation with external advisors regarding opportunities and enhancements to strengthen our practices and policies, on an ad hoc basis; • Electronic monitoring of the majority of our technology environments to identify cybersecurity events; • Periodic assessments of existing technology hardware configurations, patches, security and lifecycle; • Periodic assessments, in consultation with software providers, of existing software versions, configurations, patches and updates; and • Periodic assessments of data management and handling, including data use and access reviews. Certain information technology general controls are reviewed and tested as part of our internal control over financial reporting.

companyName: Cronos Group Inc.

ticker: CRON


text: We use third-party services to assist with penetration testing, security incident monitoring, incident response preparation, end point protection, and security awareness online training.


text: Before engaging third-party service providers to whom we grant access to our information technology systems, we may review their information security programs, depending on the feasibility of such review and our assessment of the level of risk the third-party service provider poses to our business operations and our information technology and financial reporting systems. We determine risk level based on a set of internally developed criteria. We do not, however, review the information security programs of all third-party vendors. Where feasible, we also conduct periodic reviews (typically annual) of certain third-party service providers, particularly service providers of financial, financial reporting and accounting systems, depending on our assessment of the level of risk to our business operations and our information technology and financial reporting systems.


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a materially adverse effect on our business, including our business strategy, results of operations and financial condition. However, there can be no assurance that our processes and procedures will prevent or timely detect a cybersecurity incident. For more information regarding risks from cybersecurity threats, see the section entitled "Risk Factors—Risks Relating to Our Products—Risks Relating to Production and Distribution of Products."


text: In fiscal year 2024, as part of our overall enterprise risk management process, our Board received a report on our program for assessing, monitoring and mitigating cybersecurity risks and has delegated oversight of such program to our Audit Committee. Going forward, the Audit Committee will receive periodic reports on our program for assessing, monitoring and mitigating cybersecurity risks. In addition, as part of its overall responsibility for overseeing the adequacy of the Company's internal control over financial reporting, our Audit Committee receives periodic reports about our financial reporting information system controls and security.


text: Our Information Systems department, in addition to managing our general information technology systems, is also responsible for managing our enterprise-wide cybersecurity processes. Personnel in our Information System department collectively have decades of experience in information security, information technology and cybersecurity operations. Our Information Systems department monitors, and receives notifications of, potential cybersecurity incidents detected through automated detection and monitoring tools. In the event we discover a material cybersecurity incident, Information Systems personnel reports such incident to our Chief Financial Officer, who then reports to our Chief Executive Officer and the Audit Committee, as appropriate. We do not currently have a Chief Information Security Officer or other senior security officer of a similar title.


text: Our cybersecurity processes include: • Basic security awareness online training for personnel with company email, at least annually; • Phishing tests for personnel with company email on a periodic basis; • Reviews of certain third-party vendors' information security programs (as discussed below); • Consultation with external advisors regarding opportunities and enhancements to strengthen our practices and policies, on an ad hoc basis; • Electronic monitoring of the majority of our technology environments to identify cybersecurity events, including the use of a security information and event management system; • Periodic assessments of existing technology hardware configurations, patches, security and lifecycle; • Periodic assessments, in consultation with software providers, of existing software versions, configurations, patches and updates; and • Periodic assessments of data management and handling, including data use and access reviews. Certain information technology general controls are reviewed and tested as part of our internal control over financial reporting.


text: We rely on third-party services for penetration testing, security incident monitoring, managing our enterprise-wide cybersecurity processes, incident response preparation, end point protection, and security awareness online training.


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a materially adverse effect on our business, including our business strategy, results of operations and financial condition. However, there can be no assurance that our processes and procedures will prevent or timely detect a cybersecurity incident. For more information regarding risks from cybersecurity threats, see "Risk Factors—Risks Relating to Our Products—Risks Relating to Production and Distribution of Products."


text: Our Board has delegated oversight of our program for assessing, monitoring and mitigating cybersecurity risks to our Audit Committee. Our Audit Committee receives periodic reports on our program for assessing, monitoring and mitigating cybersecurity risks. In addition, as part of its overall responsibility for overseeing the adequacy of the Company's internal control over financial reporting, our Audit Committee receives periodic reports about our financial reporting information system controls and security.