text: The governance of our risk management program is a partnership between our cross functional management team and our Board. This program includes both a cyber team led by our Chief Information Officer ("CIO"), as well as an Enterprise Risk Management ("ERM") program led by our head of compliance. Our CIO has over 30 years of information technology experience, including over 4 years of direct oversight of information security. Risk oversight for both our cyber and ERM programs is primarily the responsibility of the Audit Committee of the Board who receive quarterly updates, at a minimum, with additional updates shared to the full Board on a recurring basis.

companyName: J.Jill, Inc.

ticker: JILL


text: As of the date of this filing, we are no t aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.

secItem: Item 1C


text: We maintain a Data Privacy & Security working group that is responsible for setting data security and privacy policies, overseeing those policies, and tracking and reporting on data security and privacy performance. The working group is comprised of our Chief Information Security Officer, Global Data Privacy Officer, Chief Administrative Officer, and General Counsel. The working group reports to the Audit Committee at least annually. In addition, the Company has an Impact Committee that maintains functional working groups that focus on a number of issues, including Data Privacy & Security. The Impact Committee reports to the Board at least annually. The Company's Global Data Privacy Officer reports to the Audit Committee at least quarterly and provides the Audit Committee with updates regarding the Company's data privacy environment. We also have a Chief Information Security Officer who provides quarterly updates to management and reports to the Audit Committee at least annually regarding the Company's data security environment.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factors captioned "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—The security or operation of our platform, networks, computer systems or data, or those of third parties with whom we work, have in the past, and may in the future, be breached or otherwise disrupted, and any such breach or other disruption could have a material adverse effect on our business and reputation" and "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—Interruptions or performance problems associated with our technology and infrastructure, or that of our third party service providers, including AWS and Azure, may adversely affect our business and operating results."

companyName: Veritone, Inc.

ticker: VERI


text: Risk Management, Governance and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: OOMA INC

ticker: OOMA


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.


text: The "Risk Factors" section includes further detail about the material cybersecurity risks we face. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.


text: We view cybersecurity as a shared responsibility throughout the Company. At a management level, we have performed tabletop exercises incorporating external resources, advisors and relevant members of the Board as needed. The Company requires all employees to participate in an annual cybersecurity training reviewed by the information security function, and management regularly communicates with employees about potential cybersecurity risks and methods for reporting incidents. The Company has adopted and maintains an Incident Response Plan, which provides for various methods of reporting and escalation of incidents, activation of an incident response team consisting of relevant cross-functional leaders (e.g., legal, information security, operations), assessment of the severity of incidents, processes for investigating and remediating incidents and compliance with related legal and regulatory obligations, among other matters. The Incident Response Plan provides for the involvement of the Company's Disclosure Review Committee to assess the materiality of cybersecurity incidents and any disclosure obligations required in respect thereof. Management periodically reviews the Company's cybersecurity risk management strategy and processes - including the Incident Response Plan - to assess their efficacy in light of current and emerging threats.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: We face a number of cybersecurity risks in connection with our business. Although such risks have no t materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to, and breaches of, our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled, "Cyberattacks, security, privacy, or data breaches or other security incidents that affect our networks or systems, or those of our service providers, involving our or our customers' sensitive, personal, classified or confidential information could expose us to liability under various laws and regulations across jurisdictions, decrease trust in us and our products and services, increase the risk of litigation and governmental investigation, and harm to our reputation, business, and financial condition" in Item 1A- Risk Factors - "Information Technology and Data Risks."


text: We design and assess our program based on International Organization for Standardization ("ISO") 27001 and Payment Card Industry Data Security Standard ("PCI DSS") standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO and PCI DSS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • internal audits; • bug bounties, phishing and penetration tests; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, as well as dedicated and expert incident commander(s) to steer incident response and resolution; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the section titled "Risk Factors—Risks Related to Data Privacy, Data Protection, Cybersecurity and Technology—The collection, processing, storage, use and disclosure of personal information are governed by a rapidly evolving framework of privacy, data protection, cybersecurity information transfers or other laws or regulations worldwide and may limit the use and adoption of our services and adversely affect our business."


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management receives briefings from our CISO on our cyber risk management program and escalates matters to the Board as needed.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. The CISO, who reports to our Chief Technology Officer, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO is an industry-recognized and credentialed executive with over a decade of leadership in information security, holding multiple professional certifications.


text: Our CISO takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk management and strategy We implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and outfitters.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Our Information Security Department and Security Management functions, led by our Chief Information Officer ("CIO") and supported by our Director of Information Security and Compliance, (collectively, "Security Team"), help identify, assess and manage the Company's cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry's risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, outfitter security awareness training, asset management, managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers, and review of System and Organization Controls reports for certain providers. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences", in this Annual Report on Form 10-K.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the CIO, the Chief Executive Officer and others. These individuals work with the Company's incident response team, pursuant to a documented incident response policy, to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Risk Management and Strategy We recognize the importance of cybersecurity risk and the protection of information across our enterprise and have been working towards the integration of our processes for assessing, identifying, and managing risks from cybersecurity threats into our overall risk management system. As further described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information as well as personal information in our computer systems and networks.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: We rely on third parties for a significant portion of our information technology functions and conduct periodic risk assessments with assistance from a third-party consultant. We also rely on third-party hardware, software, network infrastructure, storage systems and vendors to maintain and upgrade our technology systems in order to support our business operations. Computer viruses, hackers, employee misconduct and other external hazards can expose our information systems to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. As previously disclosed, in May 2023, we experienced a network intrusion in which an unauthorized third party accessed and exfiltrated certain information from specific systems. In response to this incident, we secured our digital assets within our computer systems, promptly shut down our financial reporting systems on a temporary basis and commenced an investigation with assistance from an outside cybersecurity firm. In connection with this incident, we have incurred certain incremental one-time costs of $ 0.3 million during the 2023 fiscal year related to consultants, experts and data recovery efforts, and expect to incur additional costs related to cybersecurity protections in the future. Although we have not been the subject of any legal proceedings involving cybersecurity incidents, it is possible that we could be the subject of claims from persons alleging that they suffered damages from such incidents.


text: We have implemented a variety of measures to enhance our cybersecurity protections and minimize the impact of any future attack, including by (i) requiring that all external vendors who need to access any internal/cloud resources utilize secure encrypted tunnels or be physically internal and utilize authorized terminals with provided credentials, (ii) conducting security awareness training for our staff and (iii) requiring longer log retention for all tracking telemetry information. However, cybersecurity threats are constantly evolving, and there can be no guarantee that a future cybersecurity event will not occur. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including through the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as the use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we seek to prioritize the identification and management of cybersecurity risk at several levels in our organization, including through oversight by our Board of Directors and management team. Our Board of Directors oversees risk from cybersecurity threats and our procedures for protecting our cybersecurity infrastructure, and members of management responsible for our cybersecurity risk management program are expected to periodically report to the Board of Directors regarding cybersecurity risk.


text: Our Executive Vice President of Technology has nearly 20 years of experience working in technology and technology infrastructure and has completed college coursework in computer engineering. Together with our Chief Corporate Officer and Chief Development Officer, our Executive Vice President of Technology oversees our cybersecurity risk management processes, including those described in "—Risk Management and Strategy" above. Our cybersecurity risk management program seeks to implement tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, as well as strategies to address threats and incidents.


text: At the employee level, we maintain an information technology team tasked with implementing our privacy and cybersecurity program and who support management in reporting, security and mitigation functions. We also hold employee trainings on privacy and cybersecurity, records and information management, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Transformation Officer ("CTO"), our senior management team and our Board of Directors. We retain an ISO 27001:2013 certification related to our information security management system ("ISMS") that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products. Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident. This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response. In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams. These Legal and Compliance professionals then advise on any additional notification or reporting requirements.

companyName: Spire Global, Inc.

ticker: SPIR


text: Cybersecurity Governance Our cybersecurity program is overseen by the Company's CTO in close collaboration with the CEO and our legal and compliance teams. O ur CTO has a technical background and is well informed about cybersecurity risk management best practices, as well as our Company's risk management framework. Our legal and compliance teams supporting the Company's cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.


text: Risk Management and Strategy We are a clinical stage biopharmaceutical company with no commercial operations or revenue streams and our sole business activity has been ongoing research into our drug therapies. We have certain processes for assessing, identifying and managing cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems, which are built into our overall risk management program. Our processes are designed to preserve the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Such processes include physical, procedural and technical safeguards, and response plans on our systems. We engage an external consultant to manage cybersecurity tooling and incident response, as well as general information technology, or IT, systems, which enhance our cybersecurity oversight. We consider the internal risk of oversight programs of the third-party consultant before engaging them in order to help protect us from any related vulnerabilities. As our company grows, we plan to expand our strategy for cybersecurity in alignment with nationally accepted standards.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: Based on an assessment using the previously described cybersecurity risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K.


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. We seek to address cybersecurity risks through a cross-functional approach.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our audit committee, comprised of members with substantial experience in information technology governance and risk management, oversees our cybersecurity strategy. Our board of directors receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our executive officers are responsible for the day-to-day management of the material risks that we face. Our executive officers are led by a third-party consultant, who oversees company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The third-party consultant is advised by their Security Operations Center Manager with a variety of technical certifications, as well as extensive background in IT infrastructure, risk mitigation, and incident response planning.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and we take a holistic approach to the oversight and management of cybersecurity and related risks. This approach is supported by our Board of Directors and management who are actively involved in the oversight of our risk management program.

companyName: Karman Holdings Inc.

ticker: KRMN


text: Like all companies that utilize technology, we face significant cybersecurity threats that include, among other things, attempts to gain unauthorized access to sensitive student and employee information; attempts to compromise the integrity, confidentiality and/or availability of our systems, hardware and networks, and the information on them; insider threats; malware; ransomware; threats to the safety of our directors, officers and employees; and threats to our facilities, infrastructure and service. As cybersecurity threats may arise, the cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of a perceived threat or possible cybersecurity incident, the cybersecurity team is trained to assess, among other factors, student safety impact, data and personal information impact, the possibility of business operations disruption, projected cost, if any, and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.


text: Management of the Company is responsible for overseeing our enterprise risk management. In that regard, management receives periodic updates, as appropriate (and no less frequently than annually), regarding the Company's cybersecurity risk management processes and the risk trends related to cybersecurity. Our Board of Directors, in coordination with the Audit Committee, shall review and discuss with management the Company's risks related to information security, including cybersecurity.


text: While we have experienced minor cybersecurity threats in the past, such as spear phishing or smishing (SMS phishing), to date no such threats have materially affected the Company or our financial position, results of operations and/or cash flows.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information contained therein.


text: We maintain cybersecurity insurance coverage in amounts that we believe are adequate to address any incidents such as data destruction, extortion, theft, hacking, denial of service attacks and other such incidents.


text: See "Risk Factors— Technology failures or cybersecurity breaches or other unauthorized access to or use of our information technology systems or sensitive or proprietary information could have a material adverse effect on the Company's business and operations."


text: Risk Management and Strategy We periodically assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity processes, and practices as part of our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our senior management, in consultation with our third-party information technology, or IT, vendor assesses risks based on probability and potential impact to our business and information systems and processes. Any identified risks that are considered high are monitored and tracked as part of our overall risk management program overseen by our board of directors.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: We collaborate with our third-party IT vendor to assess the effectiveness of our cybersecurity prevention and response systems and processes and have not had a need to utilize cybersecurity assessors, consultants or other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks or to support any necessary mitigation plans.


text: Neither cybersecurity incidents nor cybersecurity threats have materially affected our company, including our business strategy, results of operations, or financial condition. We are not aware of any cybersecurity threats that are reasonably likely to materially affect our company. Refer to the risk factor captioned "Our business and operations may be adversely affected by information technology ("IT") system failures or cybersecurity or data breaches" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company. Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies and measures in collaboration with our IT vendor that are designed to address cybersecurity threats and incidents. Our IT vendor with oversight from our Chief Executive Officer, Mr. Lee, is currently responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our IT vendor has over 25 years of experience in information security and possesses the requisite expertise and experience expected of such an individual given our company's risk profile.


text: Mr. Lee provides periodic updates on any cybersecurity incidents and threats to our Board of Directors and to the Audit Committee of our board of directors as such incidents may arise.


text: We have established policies and procedures for assessing, identifying and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We leverage well-known and established third parties as industry partners to support our key business processes and utilize the services of reputable external advisory firms for running important functions such as cybersecurity assessments and technical security management activities, including network security management. Our Chief Financial Officer and Chief Operating Officer are jointly responsible for managing cybersecurity risks and implementing the required policies across the Company. Our Chief Executive Officer is responsible for making strategic decisions and approving external communication releases related to cybersecurity risks or incidents. Our Chief Executive Officer and Chief Financial Officer work closely with our third-party IT manager to stay informed about and monitor the prevention, detection, mitigation and remediation of any potentially significant cybersecurity incidents, including making determinations on the materiality of a cybersecurity incident.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees our risk management program, which focuses on the most significant risks we face. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity. Our Chief Financial Officer or Chief Operating Officer reports on our enterprise risk profile on an annual basis or more frequently as needed. Our Audit Committee also engages with external counsel on legal matters related to cybersecurity incident management and reporting.


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our operations or financial standing. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Risk Management and Strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the International Organization for Standardization's ("ISO") international standard for Information Security ("ISO 27001") and the National Institute of Standards and Technology's Cybersecurity Framework 2.0 ("NCSF") and we evaluate and evolve our security measures as appropriate. As of December 31, 2024, we have not completed all of the requirements to be ISO 27001 or NCSF certified. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO's international standard for Supply Chain Security Management ("ISO 28001"), the NCSF, and the Customs-Trade Partnership Against Terrorism), and evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk Factors" in this Annual Report for additional information about risks related to cybersecurity.


text: Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management. The Board also receives annual reports on information security matters from members of our security team.


text: Our security efforts are managed by a team of IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.


text: We have designated a Network and Security Engineer, who reports to the Director of IT & Security, to assess and manage our material cybersecurity risks and threats. In this role, the Network and Security Engineer installs and manages our corporate firewalls, Enterprise Infrastructure engineering, and network analysis, but also supports our incident response and vulnerability management efforts. With over 10 years of experience in cybersecurity, the Engineer ensures our controls remain effective and that any emerging threats are promptly addressed.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the sections titled "Risk Factors— If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" and "Risk Factors— We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations, and rules; contractual obligations; industry standards; and policies. Our (including the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions (which could include civil or criminal penalties); private litigation (including class-action claims) and mass arbitration demands; disruptions to our business operations; adverse publicity; and other adverse consequences that could negatively affect our operating results and business."

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Cybersecurity Risk Management and Strategy We continue to invest substantially in cybersecurity risk management, which is a core part of our overall enterprise risk management program. Our security program is based on ISO 27001, NIST 800-53, and GDPR frameworks to support our global business. We utilize various tools and processes to identify, monitor, evaluate, and address cybersecurity threats and incidents, including those involving third-party vendors and service providers. Our process includes identifying the source of a threat or incident, implementing countermeasures and mitigation strategies, and informing management and our board of directors about significant threats and changes in the cybersecurity landscape. We remain committed to investing in risk management tools and processes as cybersecurity threats evolve. Despite our efforts, we cannot guarantee that we can prevent, mitigate, or remediate risks in our own or third-party cybersecurity infrastructure.

companyName: AstroNova, Inc.

ticker: ALOT


text: Our Information Technology team which reports to senior management, is responsible for maintaining our cybersecurity risk management program. They collaborate with third-party security specialists as they believe necessary to conduct thorough risk assessments and system improvements. Together with our third-party security service providers, the Information Technology team oversees cybersecurity incidents, prevention, detection, mitigation, and resolution. We regularly train our employees on cybersecurity awareness and confidential information protection and continuously review and update our policies to adapt to the evolving threat landscape and legal developments.


text: Cybersecurity threats have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the dynamic nature of these risks and remain vigilant in our efforts to mitigate potential impacts. Refer to "Item 1A. - Risk Factors" in this Annual Report on Form 10-K, including, "We could experience a significant disruption in or security breach of our information technology system which could harm our business and adversely affect our results of operations," for additional discussion on our cybersecurity related risks.


text: Cybersecurity Governance Our management, including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer ("CTO"), and Information Technology team, is responsible for identifying and assessing cybersecurity risks, establishing monitoring processes and implementing mitigation and remediation measures. In fiscal 2025, we hired a full-time Director of Information Technology, who is a Certified Information Security Professional. Our cybersecurity programs are managed under the direction of our CTO and the Director of Information Technology, with support from internal and external third-party resources.


text: Our IT Steering Committee, which consists of our CEO. CFO, and other senior leadership employees, is responsible for coordinating our day-to-day management of cybersecurity risk. Each quarter, the IT Steering Committee receives reports from the CTO and Director of Information Technology on our cybersecurity program performance and emerging threats and incidents. The IT Steering Committee makes recommendations intended to ensure that hawse have adequate resources to address information technology risks.


text: Our board of directors has ultimate oversight responsibility for our overall enterprise risk management and, with input from our senior management, oversees our cybersecurity risk management. As part of its enterprise risk management efforts, our board of directors regularly receives reports from management on our cybersecurity programs with regard to any risks that may arise from specific cybersecurity threats and incidents. The board of directors oversees management's programs, policies and processes in place that identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which we are exposed.


text: Cybersecurity Governance Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of our risk management controls, including controls in connection with risks from cybersecurity threats.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: The Audit Committee of our Board of Directors (the "Audit Committee") is primarily responsible for overseeing our compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of our information system and cybersecurity controls.


text: On a quarterly basis, the Audit Committee discusses with senior management, our processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of our cybersecurity processes. The Audit Committee also receives updates on, and monitors, our prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and processes and controls supporting requirements with the General Data Protection Regulation (GDPR). The NIST CSF offers a thorough set of guidelines and best practices to help establish a strong cybersecurity posture. Utilizing NIST CSF enables us to systemically identify, assess, and manage cybersecurity risks most relevant and impactful to our business operations. It is important to note that using the NIST CSF as a guide does not imply our cybersecurity program meets any specific technical standards or requirements.

companyName: Banzai International, Inc.

ticker: BNZI


text: We have an annual assessment performed by a third-party specialist of the cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a Risk Mitigation Plan to mitigate such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: We maintain policies over areas such as information security, incident management, business continuity, IT change and configuration management, acceptable use and access on/offboarding to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in our IT environment.


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to, configuration management, vulnerability scans, network protection and monitoring, remote monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.


text: In evaluating the risks identified as a result of the annual cybersecurity assessment process, our cybersecurity partners assist the Company to assess the likelihood, severity, and impact of relevant risks, including the impact on employees, stakeholders, and vendors. These risks are prioritized and monitored by the cybersecurity partners and management of the Company.


text: Our cybersecurity program includes an incident response plan that includes all relevant and critical members of management and third-party service providers alike. The team is responsible for assessing and managing cybersecurity incident response processes, response times, and communication plans in the event corrective actions and mitigation procedures are required to isolate and eradicate an incident.


text: Our management team, in conjunction with the Chief Technology Officer and cybersecurity service providers are responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. Management relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged in strategic cyber risk management, advisory and decision making.


text: Our Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber threats and vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practical through changes or updates to our internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as the cybersecurity risk assessment process and developed an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.


text: Our Chief Operating Officer and Systems Administrator are primarily responsible for assessing and managing the cybersecurity risks we face under our policies and procedures, including those described in "Risk Management and Strategy" above. Our Chief Operating Officer is primarily responsible for reporting any material cybersecurity related incidents to our Audit Committee.

companyName: VACCINEX, INC.

ticker: VCNX


text: The Company maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. We are subject to federal and state laws and regulations governing privacy, security, and breaches of patient information and the conduct of certain electronic health care transactions, including, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other health information privacy and security requirements. We rely on information technology networks and systems to process and store electronic information. We collect and store sensitive data, including PHI on our information technology networks. As we collect and manage large quantities of data, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our partners regard as significant. Increased global cybersecurity vulnerabilities, threats, computer viruses, ransomware and phishing attacks, and more sophisticated and targeted cyber-related attacks, as well as cybersecurity failures resulting from human error and technological errors, pose a risk to the security of the Company's systems and networks and the confidentiality, availability, and integrity of data on these products, systems, and networks. We have implemented security measures designed to prevent disruptions and shutdowns of our information technology networks due to attacks by hackers or breaches due to malfeasance by contractors, employees and others who have access to our networks and systems.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We expect to continue to invest in long-term solutions to protect against cybersecurity risks and threats. Except as otherwise provided herein, this Item 1C reflects the Company's cybersecurity policies and procedures as of December 31, 2024.


text: In 2024, we did not identify any cybersecurity threats that would have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report.


text: The Company has a designated IT Security Team to maintain its cybersecurity program and oversee third-party service providers that provide cybersecurity protection. The IT Security Team is tasked with the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and reports to our DevOPS/Security Manager. The team is comprised of personnel with a broad range of experience across the business and information technology industries, including our DevOPS/Security Manager, and employees in senior legal and administrative roles. The IT Security Team relies on the advice of the Manager DevOPS/Security related to the security of our data and any mitigation steps necessary.


text: Our DevOPS/Security Manager leads our cybersecurity program and is tasked with supporting our security functions of identifying, preventing, detecting, responding to, and recovering from cybersecurity threats and incidents. The DevOPS/Security Manager has 28 years of experience in IT networking, administration, and security related roles, including nine years at the Company. Prior to joining the Company, our DevOPS/Security Manager served for 15 years in a senior leadership role in the IT department of a large, publicly traded Fortune 500 company. The DevOPS/Security Manager reports directly to the Company's Chief Technology Officer, and provides quarterly updates to the Cybersecurity Subcommittee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.


text: The identification of cybersecurity risks is a continuous and evolving assessment. As a data company, we are subject to cybersecurity risks. We have identified certain cybersecurity risks specific to our business, which are identified above in Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: Our offices are physically secured with key card access controls for parking and floor access. In addition, security guards monitor building reception areas and parking garages, and receptionists are located in our lobbies to greet visitors. The Company engages assessors, consultants, auditors, or other third parties in connection with its cybersecurity processes.


text: The Company engages third party vendors in connection with our cybersecurity processes, including penetration and vulnerability scanning, auditing of our information security management program (ISMP); and a provider of products and services to secure users, networks, and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. In addition, the Company engaged national accounting and advisory services firms to audit the operating effectiveness of our security program, which incorporates cybersecurity in our processes. On an annual basis, the Company conducts a SOC 2 Type II audit and a HITRUST assessment.


text: In 2023, the Company engaged a HITRUST Authorized External Assessor and AICPA member firm `, which completed independent assessments of MSP Recovery's system. These independent assessments verified that we met the healthcare industry's highest standards in protecting healthcare information and mitigating this risk, including compliance with the HIPAA Security Rule. On October 13, 2023, HITRUST certified that the platforms, facilities, and supporting infrastructure of our organization meet the HITRUST CSF v11 Implemented, 1-year (i1) certification criteria. For our cloud computing services, we currently use Amazon Web Services ("AWS") which is also HITRUST certified. On June 14, 2024, an Independent Service Auditor provided MSP Recovery a report opining that our data recovery system's commitments and system requirements meet or exceed the stringent SOC 2 Type II applicable trust services criteria.


text: On February 7, 2024, the Board established the Cybersecurity Subcommittee of the Audit Committee (the "Cybersecurity Subcommittee") to assist the Board in fulfilling its oversight responsibilities with respect to assessing and mitigating the Company's cybersecurity risks. The Company's management, under the guidance of the IT Security Team, is responsible for the preparation, presentation, and self-assessment of the Company's cybersecurity policies and practices. The Cybersecurity Subcommittee shall be comprised of at least one independent director, and is tasked with reviewing and providing high level guidance on cybersecurity-related issues of importance to the Company.


text: The IT Security Team reports to the Cybersecurity Subcommittee on a quarterly basis to inform the committee about and monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents, and is tasked with notifying the Cybersecurity Subcommittee of a cybersecurity incident upon discovery. The Cybersecurity Subcommittee held three meetings during the year ended December 31, 2024.


text: The Company's cybersecurity risk management and strategy processes are overseen by leaders from the Information Technology team (specifically, the Company's chief technology officer, its chief information officer, and its senior manager for cybersecurity) who collectively have over 75 years of prior work experience in various information technology roles, including security, auditing, compliance, systems and programming, and whose credentials have included Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Security Professional certifications. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of the Company's incident response plan. Potentially significant cybersecurity incidents are reported to the Breach Response Team. If the Breach Response Team deems the incident material, it will promptly notify the Audit Committee or the full Board of Directors. The Audit Committee or Board receives updates regarding other incidents during management's regular quarterly cybersecurity updates. In addition, the Company's Internal Audit function, whose leader possesses a Certified Information System Auditor (CISA) certification, reviews certain cybersecurity controls in connection with its information technology audit procedures.

companyName: MOVADO GROUP INC

ticker: MOV


text: Our processes for assessing, identifying and managing material risks from cybersecurity threats are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which governs our cybersecurity oversight and management structure as well as our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: Board of Directors Oversight The Risk Committee of our board of directors is responsible for the oversight of our Cyber Risk Program. The Chief Legal Officer provides quarterly updates to the Risk committee regarding the status, findings and developments within the Cyber Risk Program. In addition, the Risk Committee receives updates and presentations from the Senior Vice President, Information Security and Compliance (SVP) at each Risk Committee meeting that cover, among other things, our cyber incidents and responses, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs. The Risk Committee then reports to the full board of directors at each regular meeting of the board of directors. Additionally, at least one member of our board of directors possesses cybersecurity risk oversight experience, which contributes to the board's ability to understand and evaluate cybersecurity-related matters.


text: Management's Assessment and Management of Cybersecurity Threats Members of the executive management team, along with others from senior management and others with varying areas of expertise, are engaged as part of our Cyber Risk Program: • Senior Vice President, Information Security and Compliance: Our SVP manages our Cyber Risk Program and reports directly to the Chief Legal Officer. He manages the day-to-day information security operation, oversees our security analysts and engineers and is a member of our Cybersecurity Subcommittee. He is trained in cybersecurity strategy, planning and execution and holds industry recognized security certification, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). Our SVP has extensive experience regarding cybersecurity matters and threats affecting business-to-business software and cloud service vendors such as E2open. • Chief Legal Officer: Our Chief Legal Officer, who also serves as our Acting Chief Risk Officer, supervises the SVP's management of our Cyber Risk Program and is the chair of our Cybersecurity Subcommittee of our Disclosure Committee. Our Chief Legal Officer has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims and loss mitigation. • Cybersecurity Subcommittee of the Disclosure Committee: We have created a Cybersecurity Subcommittee of our management Disclosure Committee which includes, the Chief Legal Officer, SVP and Chief Accounting Officer. The Cybersecurity Subcommittee meets to discuss and evaluate whether certain cybersecurity incidents require public disclosure and makes recommendations regarding disclosure to the Disclosure Committee. Additionally, the Chair of the Subcommittee shall convene a meeting when either: (a) she believes a reported incident or the occurrence of a series of related incidents, requires the analysis and discussion of the Subcommittee; or (b) when any member of the Subcommittee believes that such a discussion would be appropriate. Such meeting shall be convened within 48 hours of the incident, or sooner if reasonably practicable, to expediate a materiality determination for public company reporting purposes. This Cybersecurity Subcommittee is pivotal in ensuring timely disclosure of material information and complying with the SEC's final rules on cybersecurity risk governance adopted in late 2023. • Cyber Response Team: Pursuant to our Crisis Response Program, our Response Team, which comprises the Chief Legal Officer, Chief Financial Officer and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the Chief Legal Officer or Chief Financial Officer, on behalf of the Response Team, will report to or engage the Chief Executive Officer and the Chairman of the board of directors if and when an incident becomes a crisis or potential crisis.


text: • Other Roles: The Cyber Risk Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines.


text: Risk Management and Strategy Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks The principal objectives of our Cyber Risk Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property and other assets of E2open, and those of our clients, vendors, partners, employees and consumers that can be at risk due to cybersecurity threats to E2open.


text: Under our Cyber Risk Program, our SVP, and the cybersecurity staff, along with the Cyber Response Team, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in our various policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Risk Committee and board of directors informed. Pertinent policy and practice documents include, among others, our Crisis Response Plan, which describes the detailed processes and procedures that should be followed in the event of a cybersecurity incident.


text: As an important cybersecurity risk mitigant, E2open provides mandatory training to its new hires and existing employees on a regular basis, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.


text: Integration into Overall Risk Management System or Processes The Cyber Risk Program is integrated into our overall risk management systems and processes. Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools and protocols (automated and human); internal and external independent auditing; management committee review; defined lines of communications; employee training; engagement of outside advisors and experts; assessment and utilization of both commercial and self-insurance opportunities; client contract standardization where possible; legal review of vendor engagements and new products for regulatory compliance; and regular operations reviews with the Chief Executive Officer and Risk Committee. E2open utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats.


text: Engagement of Third Parties As part of our Cyber Risk Program, we engage outside independent auditors, consultants, and professional advisors. We use independent auditors to certify compliance with internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework. We also conduct reviews for compliance with data protection regulation such as Europe's GDPR and regulation of various U.S. states as the California Consumer Privacy Act (CCPA). We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.


text: Risks from Third Party Service Providers and Others Our cybersecurity team, under the oversight of the SVP, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations. Based on the results of these regular assessments (including assessments made before engaging a third party), we may decide to take action to address and mitigate certain risks or determine that the risk is not acceptable and terminate the relationship with the third party (or determine not to engage a third party).


text: Risks from Cybersecurity Threats—Likely Material Impact See the risk factor entitled Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition. in Item 1A, Risk Factors. To date, we have not identified any material cybersecurity threats or incidents that have materially affected our business strategy, results of operations or financial condition. However, we cannot guarantee that future incidents will not have a material impact.


text: During the year ended December 31, 2024, the Company did not experience any risks from cybersecurity threats that materially affected or were reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: The Company's Board of Directors, through its Audit Committee (the "Committee"), provides oversight of risks from cybersecurity threats by monitoring incident-based reports from Tuearis as to the existence and severity of such risks. When risks are identified, the Committee works with the Company's Chief Financial Officer to develop appropriate responses, based on the recommendations of Tuearis. The Company does not have an employee with specific expertise in cybersecurity risk management but relies on Tuearis to provide that expertise. All material cybersecurity risks, incidents, and responses are reported to the Committee as a routine matter.


text: Internal and third-party risks are reviewed, monitored and managed by the Company's IT ISC2, SANS, CompTIA certified security partners and external expert consultants. The Company annually engages third-party experts to assess the effectiveness of system and network security. Periodically, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the National Institute of Standards and Technology Cybersecurity Framework. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: The Company's process for identifying and managing first and third-party risks from cybersecurity threats includes proactive threat hunting, continuous monitoring of the Company's systems and network for cybersecurity events, and regular testing of the Company's Security Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan. An external managed security services provider and an industry-leading security tool continuously monitors, detects, and responds to the Company's systems and network for cybersecurity threats. The Company's IT security partners evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. A third-party with extensive experience in incident response and forensics is on retainer to assist with incidents. The Incident Response Plan includes reporting and escalation procedures to inform the Company's executives, the Audit Committee, and full Board of Directors, as appropriate, to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Incident Response Plan and Disaster Recovery Plan include procedures for business recovery and are tested at least annually. The Company also maintains a cyber insurance policy that provides coverage for material IT security incidents.


text: Management Responsibilities Our cybersecurity program is managed by our Senior Director of Information Technology ("Technology Senior Director"). Our Technology Senior Director has 21 years of experience in information technology and cybersecurity, having been at the Company since 2003. The Technology Senior Director, along with the Company's IT security partners, is responsible for reducing cybersecurity risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events, responding quickly and building procedures to rapidly recover, if needed.


text: Board Responsibilities On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee quarterly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. The Company's Technology Senior Director briefs the Audit Committee quarterly on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: During the fiscal year ended February 28, 2025, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.

companyName: ENNIS, INC.

ticker: EBF


text: Our IT team is led by the Director of Information Technology and is responsible for regular assessment and management of cybersecurity risks. The Director of Information Technology has constant access to the Audit Committee to provide regular updates as necessary regarding any new developments.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our Director of Cybersecurity, who reports to our Chief Information Officer, and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our Chief Information Officer leads our cybersecurity team and regularly reports to our Audit Committee.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our Chief Information Officer based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threa ts. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by our Chief Information Officer and Director of Cybersecurity, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our Director of Cybersecurity has served in various roles in technology leadership and cybersecurity for over 20 years. Our Chief Information Officer has served in various roles in technology and business leadership for more than 40 years. Our Chief Executive Officer, Chief Financial Officer and Chief Information Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: Managing Material Risks and Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs, and industry-accepted standards, such as National Institute of Standards and Technology frameworks.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Risk Management Personnel The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 39 years of IT experience, 34 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.


text: Board of Directors Oversight The Audit Committee of the Company's Board is responsible for overseeing the Company's policies and practices related to cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • current cybersecurity threat landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learning from unique cybersecurity events, including those of other companies; and • compliance status and efforts with regulatory requirements and industry standards.


text: Risk Management and Strategy We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see "Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation" included as part of our risk factor disclosures in Part I, Item 1A of this report.


text: Our practices include providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying advanced tools for detecting and analyzing anomalous network activities, and implementing robust containment and incident response procedures. We leverage threat intelligence from our security vendors, as well as from trusted sources such as CISA and the FBI, to enhance our defenses and stay ahead of emerging threats. Additionally, we are committed to staying aligned with the latest industry standards and actively participating in industry forums to exchange insights and proactively address evolving cybersecurity challenges.


text: We did not experience any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Adtran maintains a cybersecurity governance structure led by its Information Security Management "ISM" team, which oversees the Company's cybersecurity risk management efforts. The ISM team ensures that appropriate controls are in place to protect Adtran's corporate assets, ensuring their availability, confidentiality, and integrity. This risk management approach informs strategic decision-making, resource allocation, and oversight mechanisms. The governance of Adtran's cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.


text: The Company's cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran's information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company's security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.


text: Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.


text: Cybersecurity risk management is integrated into Adtran's Enterprise Risk Management "ERM" program, in order to provide for continuous oversight and executive engagement. The ERM program undergoes quarterly executive reviews and annual assessments by the Board of Directors, and the Board receives regular briefings on cybersecurity risks, regulatory compliance, and security program updates from management. Key policies include the Information Security Program, which establishes governance principles across facilities, employees, business partners, and customers; the Cybersecurity Framework, which ensures compliance with ISO 27001 and industry standards; employee handbooks outlining security best practices; and the Incident Response Plan, which includes a material impact assessment workflow to support timely regulatory disclosures.


text: For additional discussion of risks associated with cybersecurity, see "Risk Factors – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT risk register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • periodic tabletop exercises conducted by outside counsel to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Our management team, including our Chief Digital and Information Officer and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have an information security team with varying backgrounds, years of experience and levels of information security certification.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools and third-party managed security services that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. Security awareness training is also a key component of our information security program and involves required training for our employees several times per year.

companyName: AGILYSYS INC

ticker: AGYS


text: We also evaluate the information security of potential partners and vendors as part of our vendor selection process and attempt to negotiate adequate protections from such third parties when we enter into contracts with them. Although our security program is designed to identify, prioritize, assess, mitigate and remediate third party risks, we rely on our partners and vendors to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards to mitigate such risks. We conduct regular reviews and tests of our information security program and also leverage tabletop exercises, penetration and vulnerability testing, and third-party red team exercises to evaluate the effectiveness of our information security program and improve our security measures.


text: We also engage an external auditor to conduct an annual Security and Organizational Controls 2 (SOC 2) examination of the security controls for systems storing customer data. The external auditor additionally conducts an annual payment card industry (PCI) data security standard review of our security controls that protect payment information.


text: Our systems periodically experience attacks intended to lead to interruptions and delays in our services and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, no cybersecurity incidents have had a material impact on our business, financial condition or results of operations, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us. Any significant disruption to our service or access to our systems could result in a loss of customer data and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a material adverse effect on our business, financial condition and results of operations. See "Risk Factors — Cyber-attacks involving our systems and data could expose us to liability or harm our reputation and have a material adverse effect on our business."


text: The Vice President and Chief Information Security Officer (CISO) leads the global information security organization responsible for overseeing our information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies, and is a Certified Information Security Professional and Information Systems Security Architecture Professional. Team members who support our information security program have relevant educational and industry experience, including having held similar positions at large technology companies. Given the nature of our business, management is highly focused on identifying and managing cybersecurity risks, and our CISO and information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.


text: The results of our SOC 2 and PCI assessments are annually reported to the Cybersecurity Risk Subcommittee. Both the Subcommittee and the Board receive regular reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. The Board also oversees our annual enterprise risk assessment, where we assess key risks within the company, including cyber security and technology risks.