text: Our executive management and board of directors oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. Our executive management and board of directors each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our executive management and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our vice president, information operations works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity threats in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our vice president, information operations monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to executive management when appropriate. Our vice president, information systems has served in such role since October 2021 and in various roles in information security and information technology for over 25 years.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX

secItem: Item 1C


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company to date, including our business strategy, results of operation or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Data breaches and cyber-attacks could compromise our intellectual property or other sensitive information and cause significant damage to our business, reputational harm and financial loss."


text: Our cybersecurity program is strategically crafted to achieve the paramount goals of identifying, protecting, detecting, and responding to all potential risks and threats. Employing a defense-in-depth strategy, we proactively identify, investigate, and resolve vulnerabilities and security incidents in a timely manner.

companyName: SunOpta Inc.

ticker: STKL


text: Continuous improvement is integral to our cybersecurity approach. Regular assessments, conducted with the expertise of external security firms against international standards, allow us to quantify our program's effectiveness. The insights gained from these assessments serve as a foundation for continuous improvement efforts. Outcomes are reported to our Audit Committee for transparency and accountability. We rely on services from a variety of third-party providers to supply things such as cloud storage and networks. On an annual basis, we review these providers to assess their risk profiles. We rely on these third parties to have their own cybersecurity programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. SUNOPTA INC.


text: Despite facing directed attacks, our systems have withstood such challenges without material interruptions to our business operations. Recognizing the potential impact of significant disruptions, we remain steadfast in our commitment to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. Refer to Item 1A "Risk Factors - Our business operations could be disrupted if our information technology systems fail to perform adequately or are breached."


text: Heading our cybersecurity program is our Chief Information Officer ("CIO"). Our CIO has over 30 years of experience in Software Engineering and Information Technology/Cybersecurity and is supported by skilled professionals from our Information Technology team. This seasoned team provides regular updates to our Enterprise Risk Management Steering Committee (the "ERM"), composed of our Chief Executive Officer, Chief Financial Officer, Chief Administrative Officer, and other members of our senior leadership. Our Audit Committee and Board of Directors receive regular reports from the ERM, as well as directly from our CIO on a quarterly basis. These reports cover various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Furthermore, our Board of Directors takes a proactive stance in overseeing our annual enterprise risk assessment. This comprehensive evaluation encompasses key risks, including those associated with security, technology, and cybersecurity threats, demonstrating our commitment to robust governance and risk management.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: The Company is in the process of establishing a cybersecurity policy which implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures. Please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks.


text: The Chief Financial Officer will oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. The Audit committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.


text: We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our critical data includes confidential, personal, proprietary, and sensitive data, collectively our "Information Assets". Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: Leatt Corp

ticker: LEAT


text: The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities. We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; cyber insurance.


text: We work with third parties from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing. To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, IT asset management, cloud-based infrastructure, data center facilities, content delivery, encryption and authentication technology, corporate productivity services, and other functions.


text: We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting annual re-assessments during their engagement.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, we may not be able to protect all information systems. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information. Governance.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a dedicated information technology manager, who reports to the CEO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Board of Directors for certain cybersecurity incidents.


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents. The Board of Directors is responsible for overseeing the company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We operate in an industry subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or partners; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and Cybersecurity and Infrastructure Security Agency ("CISA") best practices.

companyName: IntelGenx Technologies Corp.


text: We are adopting various tools and methodologies to manage cybersecurity risk that will be tested on a regular cadence. We are also in the process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We may require third-party service providers and consultants with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network. No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. The Company is currently in the process of implementing a more formalized cybersecurity program.


text: Our cybersecurity risk management and processes are led by our Vice President, Finance and Administration, with support of management, internal personnel and third-party providers. While management is responsible for the day-to-day management of cybersecurity risks, our Board of Directors, through its Audit Committee, has oversight of the Company's processes, policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats including the integration and establishment of cybersecurity processes into the Company's overall risk management system or processes. On a quarterly basis, our VP Finance and Administration, presents necessary updates on our cybersecurity and other information technology risks that may affect us.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Dakota Gold Corp.

ticker: DC


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks, with assistance from third-party service providers. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: Cybersecurity Threats During the year ended December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ZeroStack Corp.

ticker: ZSTK


text: We have implemented numerous policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources, among other relevant topics. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information, or intellectual property. Risk from cybersecurity threats, including relating to past incidents, have not materially affected our systems or business. Any significant disruption to our operations or access to our systems could adversely affect our business and results of operations. Further, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team is in charge of developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.


text: When a potential incident is first detected, the matter is communicated to the CFO as soon as possible so that the Company may work quickly and diligently to re-secure its systems and work to minimize any damage and further risk to it as a result thereof. Upon receipt, the CFO is charged with immediately investigating the report to ensure the existence or possibility of a cyberattack and employs every effort toward thwarting or limiting a cyberattack, if ongoing, to the fullest extent possible to avoid further damage and exposure to the Company and its systems. As soon as an immediate threat or cyberattack is sufficiently contained to permit it, the CFO notifies the Chief Executive Officer of the situation, who is charged to direct the CFO on any additional or special measures to be taken, including but not limited to a Company-wide alert or directive, which the CFO must follow/implement without delay. Questions or concerns relating to a directive's validity may be confirmed only by the CFO, or a designated executive officer, through a known form of contact not questionably in breach. As soon as reasonably practicable after response efforts commence, the designated executive officers are required to notify the Chair of the Audit Committee of the situation and to thereafter keep the Chair apprised of all material developments, who may escalate the matter to the full Board in the Chair's discretion. Our emergency response plan also sets forth our procedures for a transition back into normal work practices, as well as security incident investigation, remediation procedures, security incident recovery and mandatory reporting.


text: Our Board of Directors oversees the Company's aggregate risk profile and risk management process. The Board of Directors administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.


text: Failures in, material damage to, or interruptions in our information technology systems, including as a result of cyber-attacks, and difficulties in updating our existing software or developing or implementing new software, could have a material adverse effect on our business or results of operations. We depend increasingly on our information technology systems in the conduct of our business. For example, we own, license or otherwise contract for technology and systems to do business with customers, including for order entry and fulfillment, processing and payment, product shipping and product returns. We also maintain internal and external communications, product inventory, supply, production and enterprise management, and personnel information on information systems. Our information systems are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, security breaches and natural and man-made disasters. In particular, from time to time we and third parties who provide services for us experience cyber-attacks, attempted breaches of our or their information technology systems and networks or similar events, which could result in a loss of sensitive business or customer information, systems interruption or the disruption of our operations. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and may be difficult to detect for long periods of time, and accordingly we may be unable to anticipate and prevent all data security incidents. Like many businesses, our systems come under frequent attack from third parties. We are required to expend capital and other resources to protect against such cyber-attacks and potential security breaches or to alleviate problems caused by such potential breaches or attacks. Despite the constant monitoring of our technology systems and hiring of specialized third parties to identify and address any vulnerabilities through implementation of network security measures, it is possible that computer programmers and hackers, or even internal users, may be able to penetrate, create systems disruptions or cause shutdowns of our network security or that of third-party companies with which we have contracted. As a result, we could experience significant disruptions of our operations and incur significant expenses addressing problems created by these breaches. Such unauthorized access could disrupt our business and could result in a loss of revenue or assets and any compromise of customer information could subject us to customer or government litigation and harm our reputation, which could adversely affect our business and growth.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program utilizes the CIS Critical Security Controls framework, as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program includes the following key elements, among others: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a team comprised of IT personnel responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents;


text: the periodic use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training; and a cybersecurity incident response plan to respond to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee receives reports from our Chief Information Officer. Our Chief Information Officer, who works closely with and supervises our IT team, has overall responsibility for assessing and managing any material risks from cybersecurity threats.


text: Risk Management and Strategy We have policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Rise Gold Corp.

ticker: RYES


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Cybersecurity Threats As of July 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enertopia Corp.

ticker: ENRT


text: We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Executive Officer responsible with the responsibility of managing the cybersecurity risk assessment and mitigation process.


text: As part of our overall risk management program, we provide required training to consultants and employees in high risk areas on cybersecurity. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of our contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our technology development programs," "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches," and "Failure of our information technology systems could significantly disrupt the operation of our business.


text: To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. The Company has not implemented any specific policies with respect to monitoring and managing cybersecurity threats. Moreover, the Company is aware of the evolution of cybersecurity risks and is taking proactive steps by keeping up to date our information systems and educating our personnel about these risks.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of the data. The Company will be looking to adopt cybersecurity processes, technologies and controls to aid in its efforts to assess, prevent, identify and manage such risks.


text: Continuous improvement is integral to our cybersecurity approach. Regular assessments, conducted with the expertise of external security firms against international standards, allow us to quantify our program's effectiveness. The insights gained from these assessments serve as a foundation for continuous improvement efforts. Outcomes are reported to our Audit Committee for transparency and accountability. We rely on services from a variety of third-party providers to supply things such as cloud storage and networks. On an annual basis, we review these providers to assess their risk profiles. We rely on these third parties to have their own cybersecurity programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Heading our cybersecurity program is our Chief Information Officer ("CIO"). Our CIO has over 30 years of experience in Software Engineering and Information Technology/Cybersecurity and is supported by skilled professionals from our Information Technology team. This seasoned team provides regular updates to our Enterprise Risk Management Steering Committee (the "ERM"), composed of our Chief Executive Officer, Chief Financial Officer, Chief Administrative Officer, and other members of our senior leadership. Our Audit Committee and Board of Directors receive regular reports from the ERM, as well as directly from our CIO on a quarterly basis. These reports cover various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. SUNOPTA INC.


text: One of the key functions of our Board of Directors (the "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. While we do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition, such threats could occur nonetheless.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks, with assistance from third-party service providers. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: Cybersecurity Threats During the year ended December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team oversees developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. The Company currently manages cybersecurity risks by working with third-party IT consultants and utilizing basic security protocols, such as network monitoring and access controls.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs.


text: Our cybersecurity programs are under the direction of our CFO with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors. The Board of Directors does not have a designated cybersecurity committee, but the Audit Committee receives periodic updates on cybersecurity matters. The Company has not experienced any material cybersecurity incidents to date and there were no material cybersecurity incidents discovered in 2024. Please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks.


text: To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. The Company is aware of the evolution of cybersecurity risks and is taking proactive steps by keeping up to date our information systems and educating our personnel about these risks.


text: The company maintains a structured cybersecurity risk-management framework focused on identifying, assessing, and mitigating material risks from cybersecurity threats within its digital payments division, HammerPay. HammerPay's platform architecture, which supports regulated payment processing, prepaid merchant card issuance, and digital wallet operations, is continuously monitored to protect customer data and transaction integrity. The Company conducts continuous threat detection, routine penetration testing, and access-control audits, while incident-response protocols are coordinated by the Compliance and IT Security teams.


text: Cybersecurity oversight is an integral component of the Company's enterprise risk-management (ERM) process. Identified threats and mitigation plans are reviewed alongside financial and operational risks. The Chief Compliance Officer (CCO) and Chief Technology Officer (CTO) jointly oversee cybersecurity posture and report quarterly to the Board of Directors. Cybersecurity objectives align with corporate governance and business-continuity strategies.


text: The Company engages independent cybersecurity consultants, auditors, and compliance specialists to validate internal controls, including penetration testing, PCI-DSS and SOC 2 assessments, and KYC/AML compliance audits. Findings are documented, tracked, and reviewed with the Board of Directors.


text: HammerPay's vendor-management program governs all third parties that handle or access sensitive data, including banking partners, cloud providers, and API vendors. Each provider undergoes due diligence, contractual data-protection obligations, and ongoing certification reviews (SOC 2, PCI-DSS).


text: Disclosure of cybersecurity risk management, & strategy Management is responsible for the oversight and administration of cyber security protocols. Our strategy is to mitigate risks preventatively through cybersecurity strategies and preventative measures carried out by third-party providers. The Company regularly assesses, identifies, and manages these material risks in partnership with its third-party providers.

companyName: PISMO COAST VILLAGE INC


text: Our management team relies on our third-party providers to administer cybersecurity assessments and to identify, manage, mitigate, and respond to cybersecurity threats. Management of the cybersecurity environment also includes patch management, and a managed network, security, and 24/7 support. Management updates the Board as necessary, regarding any significant cybersecurity occurrences. Pismo Coast Village is not aware of any material cybersecurity incidents in the 2025 fiscal year.


text: Risk Management and Strategy Peabody uses digital technology to conduct its business operations and engage with its customers, vendors and partners. As the Company invests in technologies such as cloud, analytics, automation and artificial intelligence, it strives to provide the necessary controls to protect these digital assets from continuously evolving cybersecurity risks.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Peabody's cybersecurity strategy emphasizes reduction of cybersecurity risk exposure and continuous improvement of its controls and policies based on industry recognized best practices for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This strategy includes: (i) proactive management of cybersecurity risk to ensure compliance with contractual, legal and regulatory requirements; (ii) performing due diligence on third parties to ensure they have sound cybersecurity practices in place; (iii) ensuring essential business services remain available during a business disruption; (iv) annual cybersecurity assessments to include NIST CSF maturity assessments, penetration testing and red team assessments, as well as table top exercises with subsequent remediation of key findings; (v) participation in Information Sharing and Collaboration industry groups; (vi) maintaining an updated cybersecurity policy and incident response plan; (vii) exercising cyber incident response plans and risk mitigation strategies to address potential incidents should they occur; and (viii) annual cybersecurity awareness training for all employees and directors, including formal training and simulated phishing events.


text: Third-party experts are engaged to conduct NIST CSF maturity assessments, penetration testing assessments, periodic red team assessments and table top exercises. At a minimum, at least one of these assessments is conducted annually by a third-party expert. Peabody also engages a third-party expert to assess the risk of its business and operational vendors.


text: Peabody's enterprise risk management (ERM) framework considers cybersecurity risk alongside other company risks as part of the Company's overall risk assessment process. The ERM team collaborates with the Chief Information Security Officer (CISO), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations.


text: Peabody's Board of Directors maintains direct oversight over cybersecurity risks and oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives to enhance long-term performance and stockholder value. The Board, as a whole, and through its committees, is responsible for the oversight of risk management and Peabody's management is responsible for the day-to-day management of the risks the Company faces. Senior leadership, including Peabody's CISO, regularly briefs the Board on cybersecurity matters and the Board is informed of cybersecurity incidents deemed to have a moderate or higher business impact, even if such incidents are determined to be immaterial, on an ongoing basis.


text: Peabody's global cybersecurity department is responsible for overall cybersecurity strategy, policy, operations and cybersecurity incident response. Team members who support the Company's cybersecurity program invest in ongoing skills development including maintaining industry recognized certifications such as the ISC2 CISSP, GIAC GCIH, Comp TIA Security+, as well as platform specific certifications focused on Peabody's current cybersecurity infrastructure.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While Peabody has experienced cybersecurity incidents in the past, to date none have materially affected the Company's business strategy, results of operations or financial condition. Peabody continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems and infrastructure, and the information they contain.


text: Peabody Energy Corporation For more information regarding the risks the Company faces from cybersecurity threats, refer to Item 1A. "Risk Factors."


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While Peabody has experienced cybersecurity incidents in the past, to date none have materially affected the Company's business strategy, results of operations or financial condition. Peabody continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems and infrastructure, and the information they contain. For more information regarding the risks the Company faces from cybersecurity threats, refer to Item 1A. "Risk Factors."


text: Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company's use of third-party service providers.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: To continually evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework, has external experts complete assessments of Centrus' cybersecurity posture, completes internal self-assessments and engages with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.


text: Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.


text: Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company's network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.


text: The Board exercises its oversight of material risks from cybersecurity threats through the Board's Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee. The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to the Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. The Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by the Cybersecurity Risk Committee, with material issues raised with our Board.


text: To evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework. We periodically (i) have external experts complete assessments of Centrus' cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.


text: The Board exercises its oversight of material risks from cybersecurity threats through the Board's newly established Cyber Risk Committee. Per its charter, the Board's Cyber Risk Committee oversees the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the related security, confidentiality, availability, recoverability, integrity, and disaster or incident response programs. It coordinates with the Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity.


text: The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to management's Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. Management's Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by management's Cybersecurity Risk Committee, with material issues raised with our Board.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: NETFLIX INC

ticker: NFLX


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an external auditor to conduct an annual payment card industry data security standard review of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems. The results of these assessments are reported to the Audit Committee.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property, and we have experienced an unauthorized release of certain digital content assets. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of members and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: The Vice President of Security and Privacy Engineering leads our global information security organization responsible for overseeing the Netflix information security program. Our VP of Security and Privacy Engineering has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our VP of Security and Privacy Engineering on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Our systems and those of third parties with which we do business have experienced and may continue to experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property, and we have experienced unauthorized releases of certain digital content assets and unintended disclosure of personal information due to incidents related to third parties. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of members and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's operations and are based on recognized frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: LKQ CORP

ticker: LKQ


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with and receives cybersecurity information or reports from members of the Company's Risk Management Committee, the Company's Chief Information Security Officer ("CISO") and other members of management.


text: Collaborative Approach: The Company's Board and management have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. The Company also purchases cybersecurity insurance to mitigate the financial risk associated with cybersecurity breaches.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including but not limited to secure web gateways, secure e-mail gateways, multi-factor authentication, endpoint detection and response, cloud security posture management, privileged access management, firewalls, intrusion detection/prevention systems, and web application firewalls.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are maintained, tested and evaluated on a regular basis.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of adherence to the Company's policies, standards, processes and practices that are designed to address cybersecurity risks, threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee and the Risk Management Committee, which is comprised of senior management of the Company, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board, Audit Committee and Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board, Audit Committee and Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets materiality reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the CISO holds security risk meetings with LKQ's business segment leadership to highlight the security risk environment, policies, controls, and remedial actions planned to address risks or vulnerabilities. On an annual basis, the Board and the Company's Chief Information Officer ("CIO") and CISO discuss the Company's approach to cybersecurity risk management.


text: The CISO, in coordination with the Risk Management Committee, which includes, among others, our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), CIO and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports significant (including potentially material) threats and incidents to executive leadership.


text: The CISO has served in various roles in IT and information security for over 26 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in computer science and a graduate degree in business and attained professional certification as a Certified Information System Security Professional ("CISSP"), Certified Information Security Manager ("CISM") and GIAC Certified Incident Handler ("GCIH"). The CIO holds an undergraduate degree in Economics and a master's degree in business administration, and has served in various roles in IT for over 25 years, including serving as the Chief Information Officer of three public companies. The Company's CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each has experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's operations and are based on recognized frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology and other industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores and maintaining access to critical systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's Chief Information Security Officer ("CISO") and other members of management.


text: Third Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats and best practices as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's information security policies, standards, processes and practices.


text: The Board, in coordination with the Risk Management Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board, Audit Committee and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets or could potentially meet materiality reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Company's senior executives and CISO discuss the Company's approach to cybersecurity risk management.


text: The CISO, in coordination with the Risk Management Committee, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Senior Vice President of Policy and Administration, and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports significant (including potentially material) threats and incidents to executive leadership.


text: The CISO has served in various roles in IT and information security for over 27 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in computer science and a graduate degree in business and attained professional certification as a Certified Information System Security Professional ("CISSP"), Certified Information Security Manager ("CISM") and GIAC Certified Incident Handler ("GCIH"). The Company's CEO, CFO, Senior Vice President of Policy and Administration, and GC each hold degrees in their respective fields, and each has experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: To date, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner. See the risk factor titled "We rely on information technology and communication systems in critical areas of our operations and a disruption relating to such technology and systems, including cybersecurity threats, could harm our business." in Part I, Item 1A of this Annual Report on Form 10-K for further information.


text: utmost importance on the security of our systems and the data we handle. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments are evaluated by management and reported to our board of directors, and we continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.


text: responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.


text: a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board. Our dedicated CEO has over 10 years of experience in managing and monitoring cybersecurity.


text: from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.


text: utmost importance on the security of our systems and the data we will handle once BDTP TM is operational. We plan to implement a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: BLACKSTAR ENTERPRISE GROUP, INC.


text: To identify and assess risks from cybersecurity threats, we will evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We will regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments will be evaluated by management and reported to our board of directors, and we will continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.


text: a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board.


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents to date.

companyName: Saxon Capital Group, Inc./DE


text: Risk Management and Strategy We consider cybersecurity risk management, confidentiality and information security to be critical to our corporate visions and values. We employ a combination of people, technical safeguards and processes to manage these risks and protect information for which we are responsible. Our security program, policies, standards, processes, tools and talent are aligned with the purpose of preventing and mitigating any potential cybersecurity incidents and data leakage.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: We have a program in place designed to detect and respond to cybersecurity incidents. Our Chief Information Security Officer ("CISO") and the cybersecurity team are responsible for defining, implementing and administering appropriate measures to protect information across the Company. Cybersecurity risks are also identified and considered when conducting our annual Enterprise Risk Management ("ERM") exercise. Pursuant to our ERM program, material cybersecurity risks are identified, assigned to an individual owner with the organization, reviewed twice annually with the CISO, Chief Legal Officer and Corporate Secretary, and Chief Information Officer and tracked to evaluate containment and mitigation efforts on a go-forward basis. As further described below, management also reviews and discusses the ERM program with the Audit & Finance Committee ("AFC") of our Board of Directors ("Board"), as well as the full Board, at least annually.


text: Some key safeguards we have undertaken to assess, identify and manage material risks from cybersecurity threats include, but are not limited to: • Engaging an independent audit firm to conduct a System and Organization Controls ("SOC") 2 audit of the Company in 2023; • Designing information security policies based on the International Organization Standardization ("ISO") 27001 framework; • Maintaining well-documented processes to provide and remove access, for security incident response, for IT change control and for secure software development lifecycle; • Conducting regular system patching; • Conducting frequent, independent third-party vulnerability and penetration testing; • Providing access on a "need to know" basis applied with "least privilege" principle; • Requiring multi-factor authentication for system access; • Protecting the use of data centers with physical and environmental controls; • Encrypting data at rest and in transit; • Requiring regular, independent SOC 1 and/or SOC 2 audits for key SaaS providers; • Requiring third-parties to have information risk management processes; • Requiring regular security awareness training, including annual online security awareness training, for all users of our systems, which covers topics like phishing, social engineering, mobile and device security and protection of sensitive information; • Testing awareness by sending regular test phishing emails; • Monitoring security 24/7/365; and • Providing for system redundancy and resilience to help ensure business continuity.


text: We regularly engage third party service providers to assist with management of cybersecurity risks. For instance, as noted above, we engage third parties to conduct frequent, independent vulnerability and penetration testing of our systems. In addition, in 2023, we engaged Grant Thornton LLP to conduct a SOC 2 audit of our systems and controls. Further, our enterprise level IT general controls are audited annually by our independent registered public accounting firm.


text: We also monitor and oversee risks from cybersecurity threats associated with all third-party service providers that handle data or information for us. In connection with engaging any third-party service provider that will handle data or information for us, we review its internal controls, require that it fill out our security and/or privacy questionnaires and ensure there is appropriate contractual language regarding data privacy, security, and confidentiality. For example, we require all third-party service providers that handle personal data to sign data privacy addenda. We also annually audit compliance of those third-party service providers with these requirements, including through a review of their SOC 1 and/or SOC 2 audits, have them update our security and/or privacy questionnaires and, as appropriate, we conduct on-site audits for certain significant third-party service providers.


text: We face a number of cybersecurity risks in connection with our business. To date and to our knowledge, we have not experienced a material cybersecurity incident, and cybersecurity threats have not had a material impact on our business strategy, results of operations, or financial condition. However, we have, from time to time, experienced threats to and infringement of our data, policies and systems in the ordinary operation of our business. For more information about the cybersecurity risks we face, see the risk factors in Part I, Item 1A. Risk Factors entitled "Increased cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks could pose a risk to our systems, networks, solutions, services and data." and "We are dependent on third parties for the execution of certain critical functions and the failure or inability to perform on the part of one or more of these third parties could materially and adversely affect our reputation and our business.".


text: The AFC, comprised entirely of independent directors, assists the Board in its responsibilities of ensuring that the Company has established, documented and maintained, and periodically reevaluates, its processes with respect to cybersecurity. Our CISO briefs the AFC on cybersecurity matters, including on the evolving threat landscape and the Company's enhanced efforts in light of emerging risks, no less than twice per year, and in 2023, our CISO provided cybersecurity updates to the AFC two times during the course of the year. In addition to formal updates provided to the AFC, our CISO maintains regular communication throughout the year with members of the AFC on these issues. The chair of the AFC also briefs the full Board on cybersecurity matters discussed amongst the AFC. Furthermore, and as discussed above, cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of the annual ERM assessment.


text: Our CISO has experience managing a risk-based, effective, practical and appropriately-sized cybersecurity program that aligns with our strategic business objectives and leads our cybersecurity team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has 28 years of experience in the technology domain and 24 years of experience in information security. Our CISO is also a CISSP (Certified Information Systems Security Professional) and a CIPP/E (Certified Information Privacy Professional/Europe).


text: We have a specifically outlined incident response plan that documents the requirements of notification, classification, analysis and communication of security incidents, including cybersecurity incidents, based on the identified severity level. The CISO is informed of incidents at all severity levels pursuant to the incident response plan. The incident response plan also includes initial steps to convene the response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and consider involving law enforcement. In addition, the CISO is informed of potential cybersecurity incidents through the Company's IT incident response system, which contains security logs that are reviewed by the Company's 24/7/365 security operations center, and through the Company's enterprise incident response system, which involves both daily reports of potential issues and alerts that may be initiated by an employee or former employee of the Company.


text: Some key safeguards we have undertaken to assess, identify and manage material risks from cybersecurity threats include, but are not limited to: • Engaging an independent audit firm to conduct a System and Organization Controls ("SOC") 2 audit of the Company in 2024; • Designing information security policies based on the International Organization Standardization ("ISO") 27001 framework; • Maintaining well-documented processes to provide and remove access, for security incident response, for IT change control and for secure software development lifecycle; • Conducting regular system patching; • Conducting frequent, independent third-party vulnerability and penetration testing; • Providing access on a "need to know" basis applied with "least privilege" principle; • Requiring multi-factor authentication for system access; • Protecting the use of data centers with physical and environmental controls; • Encrypting data at rest and in transit; • Requiring regular, independent SOC 1 and/or SOC 2 audits for key SaaS providers; • Requiring third-parties to have information risk management processes; • Requiring regular security awareness training, including annual online security awareness training, for all users of our systems, which covers topics like phishing, social engineering, mobile and device security and protection of sensitive information; • Testing awareness by sending regular test phishing emails; • Monitoring security 24/7/365; and • Providing for system redundancy and resilience to help ensure business continuity.


text: We regularly engage third party service providers to assist with management of cybersecurity risks. For instance, as noted above, we engage third parties to conduct frequent, independent vulnerability and penetration testing of our systems. In addition, in 2023 and 2024, we engaged Grant Thornton LLP to conduct a SOC 2 audit of our systems and controls. Further, our enterprise level IT general controls are audited annually by our independent registered public accounting firm.


text: The AFC, comprised entirely of independent directors, assists the Board in its responsibilities of ensuring that the Company has established, documented and maintained, and periodically reevaluates, its processes with respect to cybersecurity. Our CISO briefs the AFC on cybersecurity matters, including on the evolving threat landscape and the Company's enhanced efforts in light of emerging risks, no less than twice per year, and in 2024, our CISO provided cybersecurity updates to the AFC two times during the course of the year. In addition to formal updates provided to the AFC, our CISO maintains regular communication throughout the year with members of the AFC on these issues. The chair of the AFC also briefs the full Board on cybersecurity matters discussed amongst the AFC. Furthermore, and as discussed above, cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of the annual ERM assessment.


text: Our CISO has experience managing a risk-based, effective, practical and appropriately-sized cybersecurity program that aligns with our strategic business objectives and leads our cybersecurity team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has 29 years of experience in the technology domain and 25 years of experience in information security. Our CISO is also a CISSP (Certified Information Systems Security Professional) and a CIPP/E (Certified Information Privacy Professional/Europe).


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the Enterprise Risk Management Council (a taskforce comprised of senior representatives from primary corporate functions as well as senior representatives from field operations) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology (IT) security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the Enterprise Risk Management Council's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: UNITED RENTALS NORTH AMERICA INC


text: The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cyber security oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once every three years and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Crisis Management Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2022, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and speakers who discussed digital, technology and innovation trends across industries.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our online ordering system" in Item 1A- Risk Factors.