text: While we have not experienced any data breaches during the year, our online banking platform was targeted in the beginning of the year by threat actors who created malicious look-alike phishing sites. The Bank did not suffer losses as a result of these attempted attacks and due to efforts made to improve our security posture, the attack efforts have significantly subsided and remained at a stable low-level for the remainder year. We continue to monitor and look for ways to enhance security, safeguard customer data, ensure the continuity of our operations, and mitigate any risks associated with potential cybersecurity events.


text: The Information Security team maintains a Third-Party Risk Vendor Management Program that requires all third-party vendors with access to our systems or sensitive information comply with applicable cybersecurity standards and regulations. Ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies are performed, if applicable.

companyName: HarborOne Bancorp, Inc.

ticker: HONE

secItem: Item 1C


text: While extensive cybersecurity controls and procedures are in place, the risk of experiencing an incident can never be eliminated completely. We maintain and regularly review and update an Incident Response Plan that outlines procedures for identifying, containing, and mitigating any cyber event that may affect our systems, data, or operations and includes potential credit monitoring services, customer and regulatory notification guidelines and templates. This plan is regularly tested and updated. The plan is designed to address adverse events that could impact the security of information, that affect our ability to conduct secure financial transactions, or that present reputational risk. We have retainers in place with privacy counsel and forensic incident response firms.


text: The Company is committed to maintaining a strong cybersecurity posture devoting significant resources to cybersecurity and risk management processes to adapt to the rapidly evolving landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company has designed and implemented cybersecurity policies and procedures for identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular basis. At the tactical level, our information technology (IT) security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The Company monitors and evaluates our cybersecurity position and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Additionally, the Company maintains a formal information security training program for all employees that includes training on matters such as phishing, email security best practices and data privacy. To evaluate and enhance our cybersecurity program, it is regularly evaluated by external experts with the results of those reviews reported to senior management and the Audit Committee of our Board of Directors (Audit Committee). We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: Oversight of cybersecurity risk is maintained by the Company's Board of Directors and is supported by the Audit Committee. The Audit Committee is primarily responsible for overseeing our design, execution and administration of the Company's enterprise risk management process, and with regard to cybersecurity risks, setting expectations and accountability for management and reviewing management's assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks and overseeing the Company's cybersecurity disclosures. The Company's information security program is managed by the Company's Chief Information Officer ( CIO), whom reports to the Chief Financial Officer (CFO), and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CIO periodically briefs the Audit Committee and our CFO, as well as our Chief Executive Officer (CEO), other members of the Board of Directors and other members of our senior management as appropriate. These reports include, but are not limited to, new developments, evolving standards, vulnerability assessments, third-party and independent reviews, threat environment summaries and technological trends. In the event of a potentially material cybersecurity incident, the CIO will meet with the Company's Audit Committee, CEO, CFO, legal counsel and any other members of senior management as appropriate to review the cybersecurity event, perform a materiality analysis and, if appropriate, identify any information required to be disclosed in a Current Report on Form 8-K.


text: Risk Assessment: On a regular basis, the Company conducts assessments to identify potential cybersecurity threats and vulnerabilities within its systems and networks. This includes evaluating the impact of potential breaches and the likelihood of occurrence.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Employee Training: The Company provides associates with cybersecurity training and awareness programs. These initiatives are intended to help employees recognize and respond appropriately to potential threats like phishing attempts, or social engineering and account takeover. This includes conducting tabletop exercises, fostering preparedness and effective response within the Company.


text: Incident Response Plan: The Company has established an incident response plan in an effort to address and contain any breaches or cybersecurity incidents. This plan includes defining roles, responsibilities, and steps to recover from a potential attack.


text: Regular Audits and Monitoring: The Company conducts periodic audits and continuous monitoring of systems intended to detect any anomalies or potential security breaches. This involves using advanced tools to monitor network traffic and behavior for suspicious activities.


text: Disclosure and Transparency: The Company has implemented policies and procedures related to disclosing its cybersecurity risks and management strategies in its annual report, SEC filings, or other regulatory filings providing investors with an understanding of the potential impact on the Company's operations and financials.


text: During the periods covered by this report, there were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company's operations, including third-party and client interactions, are increasingly done via electronic means, and this has increased the risks related to cybersecurity threats," which are incorporated by reference into this Item 1C.


text: The Board is kept informed about cybersecurity issues through a structured and responsive communication process tailored to its needs. This involves updates provided by the Chief Information Security Officer ("CISO") or other members of management during Board and Risk Committee meetings. Additionally, management reports to the Board on significant cyber incidents, emerging threats, and the effectiveness of existing security measures. The communication framework is intended to keep the board informed about cybersecurity matters, allowing them to make informed decisions and provide strategic guidance to fortify the Company's defenses against potential threats.


text: In cases where cybersecurity threats are deemed significant or pose a potential risk to the Company's operations, they are escalated to members of management who oversee cybersecurity matters. Depending on the nature and criticality of the threat, it may be escalated to executives such as the CISO, Chief Information Officer, Chief Risk Officer, Chief Financial Officer, General Counsel, or other relevant senior management personnel. These leaders possess the expertise and authority to assess the situation's impact on the Company's operations, finances, and reputation. Further, these leaders have over 15 years of experience each in their respective fields of expertise. Upon receiving this information, they engage in deliberation and decision-making, collaborating with the cybersecurity team to formulate and execute an appropriate response plan, which may include elevating the matter to the Risk Committee, or the Board, if warranted. This hierarchical escalation process is intended to ensure that key decision-makers are properly informed, enabling appropriate actions to mitigate the identified cybersecurity risks.


text: The CISO manages the Security Operations Center (SOC) and is responsible for implementing and maintaining controls designed to detect and defend us against cyber-attacks and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among the Bank's third-party suppliers. The CISO conducts a quarterly review of our inherent risk posture against the effectiveness of our cyber risk management strategies. This review helps in measuring the effectiveness of controls and identifying areas for improvement ensuring cyber controls is commensurate with our inherent risk profile and the Board's risk appetite.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: We assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop remediation or mitigation controls and safeguards. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing to evaluate the effectiveness of our information security program and improve our security measures and planning. Risk Assessment: Regular assessments identify and prioritize technical risks to critical assets through threat identification and vulnerability assessments.

companyName: Paragon 28, Inc.


text: Risk Identification and Analysis: Prioritization of risks is based on standardized scoring frameworks, focusing resources on addressing the most significant threats.


text: Risk Mitigation and Management: A range of controls and measures are implemented to mitigate identified risks, incorporating technical and procedural safeguards.


text: Monitoring and Detection: Continuous monitoring systems are deployed to detect potential security incidents in real-time, ensuring a 24x7x365 capability to respond and mitigate. Cybersecurity Training and Awareness: New hire, annual, and ongoing security awareness training is given to all employees. Incident Response: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Continuous Improvement: Commitment to continuous improvement is reflected in regular reviews, updates of risk assessments, and simulated cyberattacks to identify and remediate risks from existing and emerging threats.


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis.

companyName: IRADIMED CORP

ticker: IRMD


text: Our cybersecurity team works in conjunction with management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. The Chief Executive Officer is responsible for overseeing our information technology leadership team and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership team reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.


text: The Board provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risks and assists the Board of Directors in fulfilling its oversight responsibilities regarding Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: Our cybersecurity program is led by our chief information officer (CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology (IT) and program management experience and leads a team that has many years of experience with our organization. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments. Our CIO reports to our chief executive officer.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least twice a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to our response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief financial officer, chief operating officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Our IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CIO and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware, and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled " Technology failures or cybersecurity breaches could have a material adverse effect on our operations. " in Item 1A- Risk Factors.


text: Risk Management and Strategy We maintain a cybersecurity risk management program designed to mitigate cybersecurity risks through a comprehensive framework that integrates cybersecurity into our overall risk management processes.

companyName: EVgo Inc.

ticker: EVGO


text: Risk Assessment. Our internal cybersecurity team conducts regular assessments designed to assess, identify, and manage material risks from cybersecurity threats and vulnerabilities within our systems and processes. These assessments are part of our ongoing risk management strategy and inform strategic decisions regarding security investments and policy developments. The internal risk assessment process includes periodic reviews of our charging infrastructure, software applications and operational procedures against best practices and address current and potential threats.


text: To augment our internal efforts, we engage third parties to conduct independent assessments of our cybersecurity posture. These external assessments provide an objective review of our security controls, breach readiness and compliance with industry standards and regulations. The insights gained from these audits inform refinements to our risk management strategies with respect to cybersecurity-related threats.


text: Cybersecurity Policies and Procedures. We maintain a set of cybersecurity policies and procedures that are regularly reviewed and updated. These policies are crafted in accordance with certain components of the National Institute of Standards and Technology Cybersecurity Framework, which provides a policy foundation for critical infrastructure security. These policies govern our cybersecurity program, including but not limited to access control, system development life cycle management, change management, and incident response.


text: Monitoring Controls. In addition to our cybersecurity policies and procedures, we place significant emphasis on monitoring controls as a critical component of our cybersecurity strategy. These controls are designed to enable us to consistently oversee and evaluate the effectiveness of our cybersecurity measures to help ensure prompt detection of and response to potential threats or anomalies.


text: We maintain a continuous monitoring strategy that utilizes advanced tools and technologies to oversee our network infrastructure and digital assets. This includes data loss prevention controls, system log reviews and unusual activities that could indicate a potential security breach. Automated alert systems deployed as part of our monitoring controls are designed to enable rapid identification and escalation of suspicious activities. These systems are configured to detect a range of cyber threats, from malware infections to unauthorized access attempts.


text: Cyber Incident Response and Reporting. Our Security Incident Response Policy is designed to enable prompt and effective action in the event of a cybersecurity incident to safeguard our information technology systems, customer data and overall business operations. We are cognizant of the ever-evolving landscape of cybersecurity threats and their potential to materially impact our operations. To date, we do not believe that we have experienced any cybersecurity incidents that have had a material adverse effect on our business strategy, operations or financial condition. However, we recognize that cybersecurity threats are a significant risk factor for any organization, especially those involved in digital infrastructure. See Part I, Item 1A, "Risk Factors – Risks Related to Our Business - Our systems are susceptible to various forms of cyber threats, including computer malware, viruses, ransomware, hacking attempts, phishing attacks and other network disruptions. These incidents have the potential to lead to security and privacy breaches, loss of proprietary information and interruptions or delays in our services and operations, any of which could significantly harm our business," for further discussion.


text: Detection and Analysis. Under our Security Incident Response Policy, all of our employees and other personnel are responsible for reporting any known, suspected or possible security events, including those that may have originated with a third-party service provider, to our Information Security Department, which promptly notifies our President, who serves as our Information Security Coordinator. The Information Security Coordinator reviews the initial facts and findings regarding any security events, provides direction to the Information Security Department regarding any additional information that should be obtained, and convenes a meeting of the SIRT to review the matter, including to determine if the event could constitute a security incident.


text: The SIRT is composed of employees with expertise in various aspects of our operations including information security, information technology, DevOps, legal, and EVSE engineering, as well as senior leaders, including our President, Chief Financial Officer and Chief Legal Officer.


text: Materiality Assessment, Mitigation and Reporting. Under our Security Incident Response Policy, the SIRT, under the leadership of the Information Security Coordinator, is responsible for promptly assessing the materiality of security events, developing our response to such events and, if a security event is determined to be a material incident, to oversee our disclosures regarding the incident as required by the rule adopted by the SEC related to cybersecurity disclosures. In determining whether a security event could constitute a security incident, the SIRT considers all facts and known information, including (without limitation) the potential harm to customers, employees and other parties; possible effects on our operations, financial statements, brand perception, reputation, customer or vendor relationships and competitiveness; the risk of fraud, extortion or intellectual property theft; litigation, regulatory and other legal risk; and other potential impacts. The Chair of the Audit Committee is informed of the SIRT's review of cybersecurity events and its determinations as to the materiality of such events. The Security Incident Response Policy also includes procedures for the SIRT to coordinate the containment, eradication, mitigation, recovery and remediation related to security events and security incidents and the implementation of procedures and actions designed to prevent additional security events in the future.


text: We also conduct regular cybersecurity training for employees to ensure they are aware of potential cybersecurity threats and understand the role they play in maintaining our defenses. We also monitor evolving regulations and standards to review industry best practices and legal and regulatory obligations.


text: Board Oversight of Cybersecurity. Our Audit Committee, acting pursuant to authority delegated by our full Board of Directors, actively oversees our cybersecurity strategy and risks from cybersecurity threats, as well as our broader enterprise risk management framework. Our cybersecurity team meets biweekly to assess and manage material risks from cybersecurity threats and vulnerabilities, which includes reviewing our risk profile and developing mitigation strategies with respect to those risks. We utilize vulnerability management software, which helps us identify risks within our environment. Our Audit Committee meets quarterly to review cyber security compliance initiatives as they are escalated from our cybersecurity team through management and reviews the enterprise risk matrix prepared by management on an annual basis. Our Information Security Manager has over 15 years of cybersecurity experience in information security and holds CISSP, CRISC, and Security+ certifications and has a MS in Information Assurance. Our Enterprise Risk Committee is briefed quarterly on cybersecurity threats and mitigation strategies by security. Updates include incident trends, compliance status, and responses to emerging threats. Additionally, real-time alerts ensure immediate awareness of critical cybersecurity events.


text: Board's Oversight Role. Our Audit Committee reviews and assesses our risk management program and cybersecurity activities and strategy to help align with our business objectives and compliance with legal and regulatory standards. These updates include reviews of new or evolving cybersecurity threats, our cybersecurity measures, the results of recent third-party security audits, and assessments and oversight of any recent cybersecurity events with certain characteristics that may have occurred. This oversight role includes evaluating the effectiveness of policies and procedures designed to protect our assets and sensitive customer information from cyber threats. The Chair of our Audit Committee regularly reports on our Audit Committee's oversight activities related to enterprise risk management and cybersecurity to our full Board of Directors. The Information Security Coordinator promptly notifies the Chair of our Audit Committee of any significant security events reviewed by the SIRT, the SIRT's determination of whether a security event is reportable on Form 8-K pursuant to the SEC Cyber Rule and the factors underlying that determination. If the SIRT determines that a cybersecurity incident is likely material and therefore reportable on Form 8-K, a draft of the Form 8-K will be provided to our Audit Committee for review and comment prior to us filing the Form 8-K within the deadline specified by the SEC's cybersecurity disclosure rules. Our Audit Committee's active engagement with and oversight of our cybersecurity program helps foster a culture of security awareness throughout our company.


text: Our COO, together with our internal IT team, are responsible for assessing and managing cybersecurity risks. They review at least quarterly with our expert advisors our cybersecurity measures and procedures in view of the Company's cybersecurity risks to anticipate future threats and trends, and determine whether and how to adjust our strategies and processes accordingly. During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We depend on data and our information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."

companyName: NextCure, Inc.

ticker: NXTC


text: As part of our overall risk management and assessment program, we design, implement, and maintain reasonable safeguards to minimize potential risks, including cybersecurity risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We also regularly provide cybersecurity awareness training to our employees at all levels and departments across the Company. The Company believes that we have allocated adequate resources to address the cybersecurity threats that may reasonably affect us.

companyName: Clarus Corp

ticker: CLAR


text: Our information technology, communication networks, enterprise applications, accounting and financial reporting platforms and related systems are integral to our operations. We use these systems, among others, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our operations rely on securing, collecting, storing, transmitting, and processing proprietary and confidential data.

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the compensation and services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Chief Financial Officer and Senior Vice President-Financial. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is required to, be made).


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report for additional discussions about cybersecurity-related risks.


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we rely on such providers to maintain appropriate cybersecurity practices.


text: During 2024, the Corporation did not experience a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Corporation, including its business strategy, results of consolidated operations or financial condition. Refer to the risk factor captioned "Cyber Security Risks and Technology Dependence" in Part I, Item 1A. "Risk Factors" for additional information.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: Governance- The Board of Directors provides oversight of the risk management program and setting the Corporation's cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. The Board has appointed a Risk Management Committee currently made up of six members of the Board with governance and oversight of the Corporation's enterprise-wide risk management program. The members of the Risk Management Committee collectively have years of business management and professional experience in the banking industry and other industries including exposure to cyber risk management considerations. The Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters. In fulfilling its role, the Risk Management Committee is actively engaged with management regarding cyber security procedures and controls to manage and mitigate cybersecurity-related risks. Management provides at least quarterly information security reports to the Risk Management Committee who provides a report to the Board of its discussions and decisions. These reports to the Risk Management Committee address management's efforts to monitor, detect and prevent cyber threats. In addition, the Board of Directors is engaged, as needed, in accordance with the Incident Response Plan.


text: We operate through our subsidiaries and receive services through our intercorporate services agreement ("ISA") with Contran (see Note 17 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: VALHI INC /DE/

ticker: VHI


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ("CIO"), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology ("IT"). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating reporting units. Both our CIO and the CompX director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We, Kronos and CompX continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee ("CIDAC") which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer and CIO, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: We, Kronos and CompX face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- "Risk Factors."


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats We rely on the cybersecurity strategy and policies implemented by Ares, the parent company of our Advisor. Ares' cybersecurity strategy prioritizes the detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Ares' enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Ares' cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Ares has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: Ares' cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Ares prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor or Ares. Ares' cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity threats, including those which may impact us, our Advisor or Ares, is integrated into Ares' Enterprise Risk Management program, which is overseen by the Ares Enterprise Risk Committee (the "Ares ERC"), as discussed below. In addition, Ares periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Ares cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training, including for all of the employees of Ares. Ares' cybersecurity training programs also include annual certification requirements for employees of Ares with respect to certain policies supporting the cybersecurity program including the Information Security and Electronic Communications policy, Data Protection policy and Privacy Policy. Ares undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Ares' and our critical third-party service providers and other partners. Ares also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Our General Business Operations and Our Corporate Structure—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by Ares' dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Ares' CISO, who has a Master's degree in Cybersecurity from Brown University and over 25 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Ares CISO reports cybersecurity updates to the Ares ERC. The Ares ERC is a committee that governs and oversees the Ares Enterprise Risk Program, including cybersecurity. The Ares ERC includes members of Ares' senior executive management, including its CEO, Co-Presidents, CFO, General Counsel, Global Chief Compliance Officer and Head of Enterprise Risk, who acts as chairperson of the Ares ERC. The Ares ERC, through regular consultation with the Ares internal cybersecurity team and representatives from our Advisor, assesses, discusses, and prioritizes Ares' approach to high-level risks, mitigating controls, and ongoing cybersecurity efforts.


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares' Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We operate through our subsidiaries and affiliate and receive services through our intercorporate services agreement (ISA) with Contran (see Note 16 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: NL INDUSTRIES INC

ticker: NL


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer ( CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating business segments. Both our CIO and the director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership, and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation, impact our ability to operate, and other material adverse consequences.

companyName: Willdan Group, Inc.

ticker: WLDN


text: The Company engages third-party cybersecurity consultants and auditors who help the cybersecurity team in identifying, assessing, and managing material risks from cybersecurity threats, including by evaluating and enhancing the Company's cybersecurity posture. The Company also engages third-party service providers to perform a variety of functions throughout its business. The Company performs due diligence before engaging with certain third-party service providers designed to evaluate the service providers' cybersecurity practices, including their security policies, incident response capabilities, and data protection measures; including specific cybersecurity requirements in contracts with certain third-party service providers, such as regarding security standards, data protection, and incident reporting as applicable; and monitoring and auditing certain third-party service providers' cybersecurity practices and compliance with contractual obligations. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, the Company's vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the certain members of Company management, including those who are part of the Company's cybersecurity team. The Company's cybersecurity team is comprised of individuals with expertise in cybersecurity, information technology, risk management, and Company operations. Our cybersecurity team has decades-long experience in cybersecurity and holds industry-standard certifications including Certified Information Systems Security Professional ("CISSP"), and Certified Cloud Security Professional ("CCSP"), among others.


text: Third-Party Risk Management We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers, and other external users of our systems, as well as the systems of third-parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third-parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") maintains structured processes to proactively assess, identify, manage, and mitigate material risks from cybersecurity threats. The Company's business remains dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations and is subject to periodic updates, reviews, and independent assessments.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The program is aligned with the NIST CSF 2.0 framework, providing a structured approach to identify, protect against, detect, respond to, and recover from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. In addition, the Investment Adviser actively monitors the current threat landscape to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company, in coordination with the Investment Adviser's risk management, legal, information technology, and compliance teams, conducts ongoing due diligence on third-party service providers (including contractual provisions and regular compliance attestations) to ensure they meet requisite cybersecurity standards. For critical vendors, the Company requires SOC 2 Type II reports or similar independent cybersecurity assessments. In lieu of these reports, vendors may provide compensating materials demonstrating the structure and management of their cybersecurity programs.


text: Board Oversight of Cybersecurity Risks The board of directors of the Company (the " Board ") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Information Security Officer ("CISO") of the Investment Adviser and Chief Compliance Officer ("CCO") of the Company regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.


text: The full Board is collectively responsible for oversight of cybersecurity matters and is updated at every Board meeting. In these updates, the Company's management and the Investment Adviser's CISO provide reports on key metrics such as vulnerability scan results, third-party risk assessments, and incident response readiness. The Board also ensures its members receive periodic training or engage external advisors with cybersecurity expertise to strengthen oversight capabilities.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the CISO of the Investment Adviser, manages the Company's cybersecurity program, under the supervision of the Company's Chief Executive Officer. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Investment Adviser's CISO has 23 years of experience actively managing cybersecurity and information security programs for financial services companies with complex and evolving information systems. The Company's CCO has been responsible for this oversight function as CCO of the Company for 10 years and has worked in the financial services industry for over 20 years, during which time the CCO of the Company has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company, in coordination with the Investment Adviser, actively monitors cybersecurity incident prevention, detection, mitigation, and remediation efforts. The CCO of the Company and the CISO of the Investment Adviser jointly lead the incident response process and escalate incidents to the Board in accordance with established escalation protocols, typically within 48 hours after determining that a cybersecurity incident reaches materiality thresholds requiring Board notification.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, including how such risks may materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. Management of the Company uses both internal and external inputs—such as threat intelligence feeds, penetration test reports, and third-party cybersecurity assessments—to update these risk evaluations. During the reporting period, the Company had not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Although there have been no identified material incidents to date, Management of the Company periodically reviews even non-material incidents and near misses to evaluate risk trends and improve response processes. In the event a cybersecurity incident is deemed potentially material, the Company's incident response plan requires immediate notification to the CCO of the Company, CISO of the Investment Adviser, and the Board, followed by regular status updates until resolution.


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence tools.


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology, employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act, the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool. Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.


text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the ERM and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's Risk Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The Risk Committee is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's Information Technology ("IT") Steering Committee in conjunction with the Bank's Project Management Office oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.


text: The Risk Committee provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the Risk Committee at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Risk Committee. Cybersecurity metrics are reported to both management level committees and the ERM Committee and Risk Committee on a quarterly basis.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches; Ensuring that changes to security configurations are documented, approved, and tested; Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks;


text: Conducting subsequent penetration testing and vulnerability assessments, as warranted; and Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information.


text: In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Board Reporting. At least annually, the CIO reports to the Board of Directors, directly or through the ERM Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents; Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents;


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures; Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP;


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures and Report up to the Executive Incident Response Committee, as needed.


text: Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 20 years of information technology experience and 11 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.

companyName: 908 Devices Inc.

ticker: MASS


text: Our information security function is supported by members of our legal team and a third party service provider, which helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting vulnerability assessments to identify vulnerabilities; and analyzing external threat intelligence feeds.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Depending on the environment, product, or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: performing risk analyses, establishing an incident response policy, having vulnerability management processes, and implementing certain security certificates for certain functions of our business; encrypting certain data, using network security controls; segregating data; maintaining access and physical security controls; managing, tracking, and disposing of assets; and monitoring our systems. In addition, we may refer to and perform assessments against the Center for Internet Security's Critical Security Controls to help inform our cybersecurity program, as well as perform assessments such as penetration tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) our information security function works with management, including our Chief Technology Officer ("CTO"), to prioritize our risk management processes and mitigate cybersecurity threats that could more likely lead to a material impact to our business; (3) our senior management/committee evaluates material risks from cybersecurity threats against our overall business objectives and on a quarterly basis reports to the cybersecurity subcommittee of the audit committee of the board of directors, with the cybersecurity subcommittee reporting to the audit committee of the board of directors, which oversees our cybersecurity risk as part of our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; and cybersecurity software and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers and public cloud providers, as well as various third-party suppliers that support our manufacturing and development processes. We use certain vendor management processes to manage cybersecurity risks associated with our use of these providers, which includes reviewing the written information security programs of certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. This can extend to contingent workers as well, who are required to complete background investigations and agree to adhere to policies, including for privacy and cybersecurity.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our legal team along with third-party service providers in coordination with the CTO. The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for potential cybersecurity incidents, approving technical cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our CTO has over 20 years of experience in engineering and information technology management at various organizations. Our CTO collaborates regularly with our third-party service provider who provides a fractional Chief Information Security Officer, who has extensive experience in cybersecurity and a certification as a CISSP.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances in accordance with the incident response policy, including the CTO, CFO, CEO, and others. Our information security function, together with our CTO, works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the cybersecurity subcommittee of the board of directors' audit committee for certain cybersecurity incidents in accordance with the incident response plan. The cybersecurity subcommittee receives periodic reports from the CTO, which reflect input from the third-party service provider, concerning the Company's risk profile, including significant cybersecurity threats and risk and the processes the Company has implemented to address them. The cybersecurity subcommittee also has access to various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Threats As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we have in the past and also anticipate in the future we will be subject to cybersecurity incidents. We have in place insurance coverage designed to provide coverage in connection with cybersecurity incidents, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; loss of intellectual property or other confidential business information; and other adverse consequences, which may adversely affect our business.


text: Our board of directors holds oversight responsibility over Cryoport's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its audit committee. Our audit committee oversees the management of Cryoport's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds quarterly meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: Cryoport, Inc.

ticker: CYRX


text: Within management, our Chief Information Security Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Our Chief Information Security Officer is supported by the Chief Information Officer or Information Technology Director, as applicable, of our business units with respect to the assessment and management of our material risks from cybersecurity risks on a day-to-day basis. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.


text: Risk Management and Strategy Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Operating Officer and who reports regularly to our Board's Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Company's Information Security Program encompasses the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective, receives regular reports from the Chief Information Security Officer and other third party advisors, to assure the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.


text: The Chief Information Security Officer reports to the Chief Operating Officer, has a dotted line to the Audit Committee and the Chief Information Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Company's Internal Audit department, and IT department in order to stay informed on all aspects of cybersecurity risk affecting the Company.


text: Monitoring Cybersecurity Incidents The Company monitors cybersecurity events using multiple methods. The Company's 24/7 Security Operations Center ("SOC") has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active "threat hunts," searching for potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors to the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We also conduct annual risk-based penetration testing and provide cybersecurity training for applicable employees. Where appropriate, we engage external advisors and consultants to assist with various aspects of our cybersecurity program and processes.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, our cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with our use of third-party service providers. Based on their risk profiles, we contractually require certain third parties with access to our information systems or data to maintain cybersecurity programs and to report actual or suspected security incidents to us. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors based on their criticality and risk profile, who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber incident. This plan is reviewed at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity risks and incidents, such as a breach of the Company's privacy or information security systems, or those of our vendors or other third parties, could compromise our information and expose us to liability, which would cause our business and reputation to suffer." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile. Our SVP of Technology, who reports directly to the Chief Financial Officer and has over 25 years of experience managing information technology and cybersecurity matters, is primarily responsible for leading the assessment and management of cybersecurity risks and reports periodically to the Audit Committee on cybersecurity strategy and risks. Our SVP of Technology stays informed about and monitors the prevention, detection, mitigation and remediation of security incidents through various channels, including but not limited to briefings from the operational team members, threat intelligence sources, and alerts from security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy AerSale has developed and implemented a comprehensive cybersecurity risk management program for identifying, assessing, and managing material risks to protect the confidentiality, integrity and availability of critical systems and information relevant to our business. Our program utilizes a risk-based approach and is designed based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), and shares common methodologies, reporting channels, and governance processes that apply across all areas of our enterprise risk management, including legal, compliance, operational, and financial risks.

companyName: AerSale Corp

ticker: ASLE


text: internal and external assessments, including audits and response simulations, to examine cybersecurity vulnerabilities and potential attack vectors to company systems, as well as evaluating the impact of these vulnerabilities in our operational and financial posture. processes to identify and manage risks related to critical third-party technology providers. a cybersecurity incident response plan that includes procedures for responding to cybersecurity threats or incidents.


text: We are not aware of any risks from cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to AerSale's Business and Industry—Our business could be negatively affected by cyber or other security threats or other disruptions" in Part 1, Item 1A "Risk Factors" in this Annual Report.


text: We utilize third party service providers to support and facilitate business and operational activities to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Vendor Risk Management ("VRM") framework, which provides the tools and practices utilized in the oversight of third-party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values. For the 2024 period, there were no material incidents affecting the VRM framework or controls.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: We have developed cybersecurity and data privacy programs designed to enable and safeguard the confidentiality, integrity and availability of our information systems and data by providing proactive security expertise and risk assessments, creating and maintaining a resilient and secure environment, and fostering a culture of security awareness and compliance throughout our organization. We maintain a robust Information Security Program that sets forth our commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing of, and protecting sensitive information, including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA).


text: Management Role and Board Oversight The cybersecurity programs are supervised by the Bank's Chief Information Security Officer (" CISO ") reporting to the Chief Risk Officer ("CRO") and dotted line to the Chief Information Officer. The Chief Risk Officer has reporting responsibility to the Board's Risk and Compliance Committee while the Chief Information Officer has reporting responsibility to the Board's Information Technology Committee. The Risk and Compliance Committee consists of eight directors, seven of whom are independent, while the Information Technology Committee consists of three directors, two of whom are independent and members of the Risk and Compliance Committee. The Company Board includes members who have expertise in cybersecurity, fraud, and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO who has a Ph. D. in Information Technology with a concentration in Information Assurance and experience in the information technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's knowledge and experience in the cybersecurity field are key to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards and disaster recovery, business continuity, and incident response efforts. Additionally, the Bank's CRO who leads the management risk function, has extensive experience in risk management.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC