text: We collaborate with third parties to assess the effectiveness of our cybersecurity incident prevention and response systems and processes as our SOT deems necessary or appropriate. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity threats and risks, as well as to support associated mitigation plans when necessary. Our System and Organization Controls (SOC) Type 2 audit, completed in September 2024, attests to the effectiveness of our security and risk management controls. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities critical to our ongoing business operations, including those that perform cybersecurity services.


text: The ACT, in consultation with the ELT and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our cybersecurity program. The results of this assessment, which are reported to the Board, assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: QXO, Inc.

ticker: QXO

secItem: Item 1C


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the headings "General Risks – We could be affected by cyberattacks or beaches of our information systems, any of which could have a material adverse effect on our business" and "General Risks – A failure of our information technology infrastructure, information systems, networks or processes may materially adversely affect our business" in this Annual Report.


text: Cybersecurity Risk Management and Strategy We are a global bioscience company dedicated to healthy aging. In the ordinary course of our business, we may collect, process, store and transmit proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties. We use our data centers and our networks, and those of third parties, to store and access our proprietary business and other sensitive information. We rely upon third parties service providers and technologies to operate critical business systems to process confidential and personal information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, and other functions. We have established cybersecurity risk management policies and procedures aimed at safeguarding the confidentiality, integrity, and availability of our critical systems and information, including those involving third-party service providers. Further, we are actively working to enhance our policies and procedures into a more comprehensive cybersecurity risk management program, our current measures are designed to address cybersecurity risks effectively. Our cybersecurity risk management policies and procedures include the Incident Management Plan.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function. In connection with the Audit Committee's oversight of the Company's risk management, the Audit Committee reviews with management, as appropriate, the Company's cybersecurity risk exposure and the steps management has taken to monitor or mitigate such exposure, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes. In addition, management will update the Audit Committee and the full Board, as necessary, regarding cybersecurity incidents that we may experience.


text: Risk Management and Strategy The secure collection, maintenance, processing and transmission of confidential and sensitive information, including personal data, is a critical element of our operations. We rely on encryption and authentication technology licensed from third parties in an effort to securely transmit certain confidential and sensitive information, including credit card numbers. Our information technology and other systems, and those of our third-party service providers, that collect, maintain, process and transmit customer, employee, service provider and business partner information are susceptible to increasing threats of continually evolving cybersecurity risks.

companyName: Flutter Entertainment plc

ticker: FLUT


text: Third-party supply risk is managed by functional teams for the Group. Our third-party risk management process ensures that we evaluate relevant third-party cybersecurity controls through a cybersecurity questionnaire. Risks are identified and assessed, and we include security addendums to our contracts where applicable. We have worked to develop and further implement our supplier-risk framework to help us to manage our suppliers more holistically across the lifecycle. In addition, we have an external third-party threat intelligence service that monitors the dark web and other intelligence sources to provide real-time threat information to the Group and for selected critical suppliers. This information is a proactive position on cyber threats. The intelligence is acted upon and disseminated to the relevant functional teams for action and information.


text: We have an established cyber risk appetite, framework and policies to support risk-based decisions on where and how to allocate security resources. The management of cybersecurity related risks is integrated into our overall enterprise risk management process. Risks are regularly identified, assessed, monitored and reported on to ensure that we are able to allocate security resources appropriately. Risks get reported at divisional, executive and Board risk committees.


text: We are regularly audited by various internal and external bodies that validate compliance with regulatory requirements and industry standards. We perform periodical internal assessments of the design and operating effectiveness of our cybersecurity controls, including penetration testing. Dedicated cyber teams in each division and at the Group level perform assurance activities against the Flutter cyber risk and control framework. A dedicated, independent IT internal audit team performs several audits each year on a risk-based approach to key and changing cyber risks. Internal audit's audit plan frequently covers cyber domains such as: patch and vulnerability, cyber threat management, security incident management, access management, network security, data loss prevention and business continuity planning. Agreed improvements are tracked through to completion.


text: We have specialist security teams available 24/7 located in key locations to respond to security incidents should they occur. We maintain cyber insurance to further reduce the consequences of certain types of incidents, and we disclose material incidents to relevant regulatory bodies. We have third-party providers who provide real-time and proactive threat and intelligence and retainer services that assist in forensics and incident support alongside retained legal counsel services.


text: As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.


text: At this time, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. That said, as discussed more fully under "Item 1A. Risk Factors," the sophistication of cyber threats continues to increase, and we cannot assure that our systems and processes will be successful, that we will be able to anticipate or detect all cyberattacks or other breaches, that we will be able to react to cyberattacks or other breaches in a timely manner or that our remediation efforts will be successful.


text: Role of Management The Group Chief Information Security Officer ("Global CISO") is responsible for the Group's cyber strategy and policies and supporting risk, assurance and reporting processes. Our Global CISO has over 20 years of extensive experience in cyber security domains and in senior leadership roles in the financial, media and government sectors. In addition, there are divisional directors of information security who are supported by over 250 cybersecurity specialists employed across Flutter to support the implementation of our cyber strategy.


text: We have established an Operational Risk and Compliance Committee ("ORCC"), which includes our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Chief Information Officer ("CIO"), and Group directors across all functional teams. This committee, which meets monthly, oversees how risk and compliance standards are operationalized and enforced throughout the Group, including the implementation of risk mitigation activities where required. Areas that the ORCC covers, among others, include the Group's cybersecurity risk and control environment and the enterprise risks and control environment of technology and legal risks.


text: Role of the Board Our Board is primarily comprised of US nationals. The Risk and Sustainability Committee of the Board, is responsible for the review and oversight of issues related to the key technology risks facing the Company, including, but not limited to, the Company's programs, policies, practices and safeguards for information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and the Company's cyberattack incident response and recovery plan. The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.


text: In addition, the Board receives regular updates via the Chair of the Risk and Sustainability Committee and various management committees, including the ORCC, Group internal audit, Group Risk and Group internal controls, and annual updates from the Global CISO and CIO on the state of cybersecurity across the Group. The Board is also notified of any relevant issues or incidents which have occurred or are reasonably likely to occur.


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Fund and the Advisers. Cyber risk management is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Fund and other affiliates of TIAA.

companyName: Nuveen Churchill Private Capital Income Fund


text: TIAA's management team periodically reports to the Fund's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Fund, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: Risk Management and Strategy The primary objective of our security program is to prevent, detect and respond to security risks and threats to protect the confidentiality, integrity and availability of our information systems and our sensitive data. Our cybersecurity program approach is risk-based, using continuous threat modeling to help us identify, track and measure our progress to reduce security risk based on three pillars: • Prevention, through planning and designing solutions to implement security controls. The security functions that support prevention efforts are aligned with security architecture, strategy and risk management activities; • Detection and response activities, which enable us to discover and respond to cybersecurity events in a timely manner. When a potentially damaging or threatening cybersecurity event is detected, our security operations team, focused on delivering detection and response services, executes the appropriate cybersecurity incident response plan; and • Governance and compliance, through cross-functional engagement, good operational hygiene and consistent discipline. Ongoing stakeholder collaboration, communications and training within a well-defined policy framework aligned with industry standards is foundational for strong governance and effective compliance. As part of the policy framework, operating procedures are kept up-to-date to reflect the current state of execution and to drive investment and iterative improvements in the highest priority areas of the security program. See Governance below for additional detail.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Our program framework and foundation are based on common security standards and frameworks, including ISO/IEC 27001/2:2022 and NIST Cyber Resiliency Framework and Model, in alignment with PCI DSS, privacy laws and regulatory requirements.


text: Our information and cybersecurity policy, standards, strategy, roadmap and processes are aligned with industry-recognized security risk management framework and practices, including detailed tasks, plans and initiatives, which are reviewed and updated periodically, and at least annually. Our program also incorporates incident response plans and notification protocols, to assess and manage security incidents and threats, including their materiality.


text: Our cybersecurity program uses layered security defenses, cyber resiliency and automation capabilities for our security functions and operations. Our cybersecurity roadmap outlines and defines the security initiatives, projects and tasks. Security investments and projects are discussed by the Security Steering Committee ("SSC").


text: Our employees and vendor partners are also trained to report any security events to the cybersecurity team, who will escalate and notify the legal team, senior executives, and Board of Directors as needed.


text: As of the date of this report, we are not aware of any actively exploited security risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management program is informed by legal and regulatory requirements and considerations. Cybersecurity risks are included as an integral part of our broader Enterprise Risk Management ("ERM") program and reviewed regularly by internal stakeholders comprised of a cross-functional team to assess the risk level and strength of our mitigation strategies. Our cybersecurity risk assessment is performed regularly throughout the year, and may include: • Regular cybersecurity program, risk and incidents reporting to the Board of Directors; • Regular cybersecurity risk reporting to the Enterprise Risk Committee, which includes the Company's Chief Executive Officer, Chief Financial Officer, Senior Vice President, Legal, General Counsel & Secretary, Internal Audit, Chief Information Officer and Chief Information Security Officer ("CISO"); and • Routine Security Steering Committee meetings with members from the Company's cybersecurity, ERM, Information Technology ("IT"), internal audit and legal teams.


text: Our CISO leads our cybersecurity team and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has 30 years of experience serving in various roles related to cybersecurity and information security. The SSC, chaired by our CISO, is comprised of executive level representatives from our IT, legal, enterprise risk management and internal audit teams and is responsible for oversight, evaluation and coordination of activities related to safeguards, security risk, controls, remediation activities, policy governance and other related security program activities.


text: The Board of Directors is responsible for overseeing overall risk management for the Company. The Audit Committee receives reports from the CISO regarding the cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Members of the Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are critical to our business and our process for identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. We rely on complex information technology systems and networks to conduct business, including communicating with employees and our distribution centers, ordering and managing materials from suppliers, selling and shipping products and analyzing and reporting results of operations, as well as for storing sensitive, personal and other confidential information. While we employ resources to monitor and protect our technology infrastructure and sensitive information, these security measures or those of our third-party vendors may not prevent all attempted data security breaches or cyber-attacks. If our or our third-party vendors' information technology systems are damaged or cease to be available or function properly for an extended period of time, whether as a result of a significant cyber incident or otherwise, our ability to communicate internally as well as with our customers could be significantly impaired, which may adversely impact our business. Our acquisition strategy may also result in exposure to certain technology risks during integration of systems of acquired companies to our existing platform.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Addressing cybersecurity risks requires ongoing monitoring and vigilance, and the Company is making enhancements to its cybersecurity policies, procedures and practices to safeguard sensitive information as well as information from our partners, customers and employees. We employ a risk-based strategy, aligned with the National Institute of Standards and Technology Cybersecurity framework, focused on safeguarding critical assets by implementing controls around access, data, and infrastructure security to protect the confidentiality, integrity, and availability of our data. Maturation and refinement of the Company's cybersecurity risk management strategy and related procedures is a continuous activity to ensure appropriate identification, assessment, and response to risks from cybersecurity threats that may adversely impact our operations. Our employee training and awareness programs are in place to improve cybersecurity awareness throughout the organization and we are committed to educating our employees on best practices for data protection, phishing awareness, and incident response. We also engage with third-party cybersecurity assessors, consultants, and auditors that provide independent assessments of our systems and processes, as well as those of certain third-party service providers, contributing to our efforts to strengthen our cybersecurity posture and enhance our defenses.


text: On January 31, 2022, certain computer systems related to the Aurora acquisition that had not yet been integrated into our main systems were the victim of a cybersecurity attack. We immediately took steps to isolate those systems and implemented measures to prevent the spread of the attack, including taking systems offline in an abundance of caution. Together with an outside cybersecurity forensics firm, we investigated the attack to determine its nature, scope, duration, and impacts, as well as our vulnerability to another such attack and whether there was any exfiltration or misappropriation of data. There was no evidence that the attack extended beyond the Aurora acquisition's systems, and it was determined that no critical data was accessed. We have subsequently integrated the acquisition's systems with our main systems, which we completed in 2024.


text: As of December 31, 2024, we are not aware of any cybersecurity incidents or identified risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition. There is no guarantee that cybersecurity incidents or risks from cybersecurity incidents may not be material in the future. We maintain cyber insurance coverage to supplement our cybersecurity program given the complex and evolving nature of global cyber threats; however, the insurance may not be sufficient to cover all losses from any breaches of our systems and does not extend to reputational damage or costs incurred to improve or strengthen systems against future threats or activity. Given the increasing sophisticated threats, a disruption from a cybersecurity incident is possible to occur and we are actively taking actions to minimize the likelihood and impact of such incidents. In the event of such an incident, our information security team is continuously engaged to investigate and respond, including isolating systems, performing forensics, containing and eradicating malicious activity, and recovering systems in-line with business expectations and operations.


text: Cybersecurity Governance Our board of directors oversees the cybersecurity risk management program and is regularly informed of cybersecurity risks through periodic updates provided by the Director of Information Technology ("IT") and Information Security team, to address our cybersecurity processes and risk mitigation efforts. Certain members of the board of directors have cybersecurity risk certification credentials and experience with, and exposure to, cyber risk oversight. The periodic updates provided by the Director of IT and Information Security team to the board of directors generally encompass emerging cyber threats, the Company's security posture changes, significant cybersecurity incidents, progress of risk mitigation efforts, and cybersecurity strategies and investments. The frequency of these updates allows for timely decision-making and ensures that our board of directors is fully informed of our cybersecurity risks.


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party cybersecurity firm to assist with aspects of our cybersecurity program including, but not limited to, network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. We also maintain cyber liability insurance.

companyName: Ocugen, Inc.

ticker: OCGN


text: There have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this Annual Report, including "Our internal computer systems or those of our development collaborators, third-party CDMOs, or other contractors or consultants may fail or suffer cybersecurity incidents, data breaches, or other disruptions, which could result in a material disruption of our product development programs and cause our business and operations to suffer," for additional discussion about cybersecurity-related risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes. Our Associate Vice President of IT & Facilities is responsible for overseeing the cybersecurity risk management program. He has over 20 years of IT management, cybersecurity, and information governance experience. In order to monitor and appropriately escalate cybersecurity risks, our Associate Vice President of IT & Facilities receives reports on a monthly basis, and more frequently as appropriate, from our third-party cybersecurity vendor.


text: Our Board's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks both at the Board and Committee level. The Board conducts its risk oversight by receiving reports from each of the Committees and our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats. Our Associate Vice President of IT & Facilities briefs the Audit Committee on our cybersecurity risk management program on a quarterly basis, using risk assessment reports from our third-party cybersecurity vendor. The briefing includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.


text: Risk Management and Strategy Our business operations rely on the secure processing, storage, integrity, and transmission of business-critical information, including transaction information as well as personal and other sensitive data, through digital and interconnected systems, including those of our service providers and other third parties. In order to identify, prevent, respond to, and mitigate cybersecurity risks, we maintain a formal data protection program with physical, technical, and administrative safeguards (the "Program"), which is integrated into our overall risk management processes. As part of the Program: • We have implemented and maintain documented policies and comprehensive technical controls (including multifactor authentication and end-to-end encryption) designed using the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and mapped to the specifications of International Organization for Standardization ("ISO") 27001. The Program is regularly reviewed and updated on an annual basis, with a comprehensive annual review cycle. • We maintain a dedicated cybersecurity team under the joint direction of our Executive Vice President and President – Global Platforms Group, and our Chief Information Security Officer ("CISO"). Our cybersecurity team operates a 24/7 Security Operations Center that employs threat detection and response technologies, including AI and ML capabilities. In addition, we maintain the Ingram Micro Trust Center, a centralized hub for stakeholders and the public to access key information about our cybersecurity and privacy programs. • We regularly test our internal IT controls through a combination of automated and manual testing procedures, including continuous automated vulnerability scanning and periodic penetration tests, and we regularly test our disaster recovery and other back-up plans. Our Program also undergoes annual external audits by independent auditors as part of our ISO 27001 certification process. Critical vulnerabilities identified through these processes are remediated according to defined timelines based on severity and other relevant factors. • We maintain, and we require our third-party service providers to maintain reasonable security controls designed to protect the confidentiality, integrity, and availability of our information systems and the sensitive data we process or that is processed on our behalf. We address potential risks posed by the use of such third-party service providers via established vendor risk assessments, due diligence, and contract review by our cybersecurity team. • We require our employees to complete security awareness training upon hiring and on a regular basis, with modules covering applicable Company policies and emerging threats. Our training program includes practical exercises such as simulated phishing campaigns.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our program, including accountants, independent assessors, external legal counsel, and other consultants.


text: Our incident reporting and escalation process is designed to detect and analyze cyber incidents in real time, to assess their impact, to escalate the incident to our CISO and the Company's Information Security Management Committee (which consists of our CEO, CFO, General Counsel, CISO, and EVP and President – Global Platform Group), as appropriate and consistent with our Incident Response Plan, and to determine and effectuate the appropriate response and reporting actions, including evaluating the impact and materiality of such incidents to our financial condition and operations.


text: All cybersecurity threats are documented by our Security Incident Response Team, with incidents exceeding a certain threshold escalated to our CISO. Critical incidents involving confirmed data breaches, ransomware, or system-wide outages trigger immediate Security Management Committee involvement and require the board of directors to be informed of significant or material cybersecurity incidents within 24 hours.


text: While we, along with our customers, vendors, suppliers, and service providers, are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate, has materially affected the Company during the periods covered by this report. See Item 1A, "Risk Factors", for more information on the cybersecurity threats facing our Company.


text: Our board of directors maintains active oversight of cybersecurity risks through a structured governance framework: • The full boar d of directors receives comprehensive cybersecurity briefings at least annually, supplemented by sessions focused on emerging threats and program strategy. • The Audit Committee receives regular updates (typically quarterly) that cover, among other topics, performance against operational metrics and results of recent audits and assessments. • Our CISO, under the direction of our Executive Vice President and President – Global Platform Group, leads our Program, working with key stakeholders and resource groups, including industry groups, peer institutions, internal committees (the Information Security Management Committee), and law enforcement, as needed, to understand, identify, and address cybersecurity risks. Our CISO maintains direct reporting access to the board of directors, ensuring that time-sensitive matters may be escalated as needed. • Our internal audit team is responsible for testing key IT controls, while leaders from our legal, finance, communications, and risk management teams participate in incident response training, including annual tabletop exercises, to ensure swift and effective responses to cybersecurity incidents.


text: Our cybersecurity leadership team brings extensive qualifications and expertise: • Our CISO has over 15 years of experience in information security, including leadership roles at Nissan Motors and Ingram Micro. He has performed investigations in the public sector as a deputized high-tech crimes investigator with a digital forensic certification. He serves on numerous cyber industry organization boards and lends his expertise as a leader and practitioner. He speaks at numerous events annually on various cyber topics. • Members of the broader security team maintain various professional certifications including CISSP, CISM, CEH, and SANS certifications. We maintain partnerships with leading universities to support continuing education and stay current with emerging threats and technologies.


text: Risk Management and Strategy Aquestive's cybersecurity program is built on four key pillars: Governance, Process, Compliance and Audit. While we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, and results of operations, Aquestive's cybersecurity program is built upon a set of policies, procedures, and standards supported by training and awareness. In addition, cybersecurity risks are also reviewed as part of our overall Enterprise Risk Management program.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: The cybersecurity team has significant experience in managing cybersecurity programs and has engaged with a MSSP to deploy state of the art cybersecurity technologies and gather threat intelligence and cyber risk trends. The cybersecurity program is executed with the MSSP, which provides active threat monitoring, risk assessment and incident response capabilities to timely assess and address any material cyber risk that could impact our business operations.


text: On occasion, we engage other external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to Aquestive. We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate. We rely on the expertise of our risk management, legal, information technology, and compliance personnel, as well as our MSSP, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Role of Management/Board The Senior Vice President of Information Technology (the "IT Officer"), along with the broader Information Technology function, is responsible for assessing and managing Aquestive's cybersecurity risk and informing senior management and the Audit Committee of the Board regarding cybersecurity risks and the prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Officer reports to the Chief Executive Officer and leads our cybersecurity program. Our IT Officer has been responsible for this function at Aquestive for 10 years and has over eleven years of experience in information security strategy and the management of cybersecurity risk. The internal Aquestive IT team has over fifteen years of technical experience, program management and architecture experience in managing cyber risk and information security.


text: The Audit Committee of the Board provides strategic oversight of Aquestive's cybersecurity matters, including risks associated with cybersecurity threats. The IT Officer briefs the Audit Committee on the effectiveness of Aquestive's cybersecurity program quarterly with a more in depth review done annually.


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats or incidents, including as a result of previous cybersecurity incidents, that we believe have materially impacted, or are reasonably likely to materially affect, the Company, including our business strategy, operational results, and financial condition.


text: Understanding the importance of cybersecurity, the Board maintains oversight of the cybersecurity risks and threats within the organization. Specifically, the Board has delegated authority to the Audit Committee to oversee risk management relating to cybersecurity. The Audit Committee is composed of members with various expertise including risk management, technology, and finance.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: The Company's Security and Privacy Steering Committee meets on a regular basis and provides oversight of our security and privacy programs inclusive of defining the security strategy, reviewing risks and risk management strategies, and program performance. The committee is chaired by the VP of Security and comprises a broad selection of Senior Management leaders within the organization. This facilitates enterprise-wide collaboration in aligning cybersecurity objectives with organizational goals.


text: The Company understands that the effective management of cybersecurity risks requires continuous assessment and improvement. Security benchmarking is a critical component to assess how well our security investments and processes compare with internal and external standards and objectives.


text: C. Management's Role and Expertise Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the VP of Security, who has over 16 years of dedicated experience in the field of cybersecurity across multiple industries. Their background includes extensive experience in cybersecurity program development, leadership, and risk management, which is instrumental in the execution of our cybersecurity strategies. Some specific responsibilities include overseeing our governance and compliance, risk management (identification, assessments, and treatment), and security and privacy awareness programs.


text: The Company's CIO possesses a wealth of information technology expertise and has served in various technology leadership roles across multiple industries. They are responsible for all technology systems, services, and solutions. The cybersecurity function reports directly into the office of the CIO.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Our SVP, Global Operations is responsible for monitoring the prevention, mitigation, detection, and remediation of cybersecurity incidents and reports the same to the Audit Committee of the Board each quarter. The Audit Committee has been delegated the responsibility for fulfilling the Board's oversight responsibilities regarding cybersecurity risk.

companyName: Silvaco Group, Inc.

ticker: SVCO


text: Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications, or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier, and partner information that we collect and store.


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our security information and event management system and team, in coordination with our edge security, monitor the events, analyze threats, and coordinate with our incident response team pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, assessing and prioritizing risks, employing various tools and techniques, including vulnerability scanning and penetration testing. Based on the risk assessment, appropriate security measures are implemented. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: Cybersecurity Governance Our Board, in coordination with the Audit Committee, oversees our cybersecurity program, including the management of risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks from our Chief Information Officer ("CIO"), which address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), and information security considerations arising with respect to our peers and third parties. On a regular basis, our Audit Committee discusses our approach to cybersecurity risk management with our CIO, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. The Board receives occasional updates from the Audit Committee and CIO on the effectiveness of our cybersecurity program. When appropriate, the Board also receives reports concerning the detection, mitigation and remediation of cybersecurity threats and incidents Our CIO has over 25 years of software engineering experience including over ten years of being responsible for MarketWise's cybersecurity. In coordination with our executive team, our CIO and our Senior Vice President of IT Operations work collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Our CIO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board.

companyName: MARKETWISE, INC.

ticker: MKTW


text: The Company's Chief Finance Officer ("CFO") and Associate Vice President of Information Technology ("AVPIT") help identify, assess and manage cybersecurity risk, including input from employees, and devote resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. The CFO and AVPIT identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example maintaining manual and automated tools, conducting scans of threats and actors, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, completing internal and external audits, using external intelligence feeds and completing third-party threat assessments.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our AVPIT along with management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: The CFO and AVPIT, who has over thirty years of experience in information technology and has both a computer science and information science degree, a re responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. We support our information security program with external resources including cybersecurity software providers and advisors as needed.


text: We have a vendor management process to manage cybersecurity risks associated with our use of external providers that includes a risk assessment, reviews of vendor audits and reports, and we also impose certain contractual information security obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Board, as part of its general oversight function, participates in discussions with senior management and amongst themselves regarding cybersecurity risks. With the assistance of the Company's most senior IT manager, we review annually the cyber and data security risks of our overall IT environment. We assess cybersecurity risk and the overall environment which includes devices, IT systems, websites, social media accounts, manufacturing technology/systems and suppliers/vendors. The oversight from the Board includes material changes to relevant policies, procedures, employee training and elements of the overall environment, as necessary, and senior management provides an update to the Board on emerging cyber threats. The Board has access, as requested, to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We face a number of cybersecurity risks in connection with our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We and the third parties with whom we work rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems, or our data, could have a material adverse effect on our business, including by not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" in Item 1A- Risk Factors.


text: Management's Role in Cybersecurity Risk Management TIAA's management, including its Chief Information Security Officer ("CISO"), is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Account. The CISO and cybersecurity leaders have significant expertise in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. In particular, the CISO holds an master of business administration (MBA) degree and a bachelor of science (BS) degree in computer science. He has several security industry certifications including the Certified Information Systems Security Professional (CISSP) and Certified Secure Software Lifecycle Profession (CSSLP) designations, and has held prior management positions in the technology space with Snap Finance, American Express, Visa and Paypal. Management of the Account is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Account, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: TIAA REAL ESTATE ACCOUNT


text: Risk management and strategy We have processes in place to identify, assess and monitor material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and are part of our operating procedures, internal controls, and information systems. These risks include, among other things, operational risks; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Cybersecurity Governance The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee regularly reviews and discusses with management the strategies, processes, and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. Our Senior Vice President (SVP) of Information Technology and other internal members of our technology team provide regular reports to the audit committee regarding the evolving cybersecurity landscape, including emerging risks, as well as our processes, programs, and initiatives for managing these risks. The audit committee, in turn, periodically reports on its review with the board of directors.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy processes are led by our SVP of Information Technology and Assistant Vice President (AVP) of IT Infrastructure and Security. Such individuals have collectiv ely over 50 years of work experience in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.


text: The SVP of Information Technology also presents at least annually to the Board an overview of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results of third-party assessments, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: Our Board of Directors and Audit Committee oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. On at least an annual basis, the Board of Directors and Audit Committee receive presentations and reports on cybersecurity risks from our Vice President of Information Technology, which may address topics including our overall assessment of cybersecurity risks, compliance with cybersecurity policies and procedures, third-party test results, the current threat environment, and technological trends and information security considerations arising with respect to our peers in the biotechnology space. The Board and Audit Committee also receive ad hoc reporting as appropriate. Our Vice President of Information Technology, who reports to our Chief Legal Officer, is primarily responsible for assessing such risks. This individual has over 20 years of information technology and cybersecurity experience in the biotechnology industry.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: Our cybersecurity approach is designed to minimize risks from cybersecurity threats identified by internal stakeholders, threat intelligence providers, vulnerability management programs, and security management programs. Our internal team manages and maintains remediation strategies for identified risks, and reports on them periodically to senior leadership. We also require our employees to participate in monthly cybersecurity awareness trainings, which include phishing awareness simulations, to raise employee awareness of cybersecurity risks.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: Governance Related to Cybersecurity Risks Our cybersecurity program and related operations and processes are directed by our Executive Director of Information Technology, whom we refer to as the IT Director. Currently, the IT Director role is held by an individual who has over 16 years of cybersecurity, information technology, and systems engineering experience. The Director of IT reports to our management – currently the Chief Business Officer.


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • internal resources who are responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect, alert on, respond to, and help mitigate cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments, and other procedures which identify potential weaknesses in our systems and help validate and improve internal processes and tooling; and • periodic cybersecurity training for our workforce.

companyName: HBT Financial, Inc.

ticker: HBT


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition. We continue to evolve our controls to mitigate these threats as effectively as we can reasonably foresee them occurring.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer. Our current Chief Information Officer has over 20 years of technology experience, including 16 years in Banking.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to the our cybersecurity policies, standards, processes and practices, which are integrated into our overall risk management system.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: We take a risk-based approach to cybersecurity aligned with National Institute of Standards and Technology (NIST) Cybersecurity Framework principles and have implemented controls throughout our operations that are designed to address cybersecurity threats and incidents. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.


text: Our cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. Our cybersecurity program and policies are operated by a dedicated cybersecurity operations team in conjunction with our enterprise Risk Management and Compliance program.


text: Our cyber risk management program identifies, tracks, escalates, remediates, and reports cyber related risks throughout the Company. These risk areas include internal, product, vendor, supply chain, and external services utilized across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking. We utilize internal and external resources, including leading third party providers in the cybersecurity prevention, detection and monitoring space, to monitor for cybersecurity threats to our systems and networks and to understand the broader threat environment.


text: Our cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the NIST Cybersecurity Framework, and emerging business needs. Cybersecurity risks are continually monitored and shared with the executive leadership team on a quarterly basis. We maintain a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes designed to support our teams, our senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.


text: Our cybersecurity operations team manages all facets of cybersecurity monitoring, coordinating with managed services security providers and internal analysts across the Company. All employees are provided cybersecurity awareness training, which includes topics on our policies and procedures for reporting potential incidents. Our cybersecurity team regularly evaluates emerging risks, regulations, and compliance matters and updates applicable policies and procedures accordingly.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to "Part I, Item 1A. Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company, including the risk factor captioned "Cybersecurity attacks or security breaches or incidents impacting our systems or data could adversely affect our ability to operate, could result in personal information and our proprietary information being lost, stolen, made inaccessible, improperly disclosed or misappropriated and may cause us to be held liable or subject to regulatory penalties and sanctions and to litigation (including class action litigation), which could have a material adverse effect on our reputation and business."


text: The Board, directly and through its committees, oversees our risk management process, including cybersecurity risks and regularly receive presentations and reports from management. Pursuant to the Risk Management and Compliance Committee Charter, the Risk Management and Compliance Committee of the Board provides compliance oversight of our risk assessment and risk management policies, which include cybersecurity, and receives regular reports and updates on the steps management has taken to monitor and mitigate such exposures and risks.


text: Our Chief Information Security Officer ("CISO"), in coordination with our Chief Technology Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience managing robust security programs, including in heavily regulated environments such as financial services. The CISO possesses extensive experience in information security, risk management, and technology governance, with a strong background in both strategic leadership and technical security operations. The CISO presents to the Risk Management and Compliance Committee on a bi-annual basis concerning our cybersecurity program.


text: Cybersecurity Risk Management and Strategy The Company recognizes the security of our banking operations is essential to protecting our customers, maintaining our reputation, and preserving the value of the Company. The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Enterprise Risk Management Program establishes policies and procedures for assessing the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program: Federal Financial Institutions Examination Council Cybersecurity Assessment Tools and GLB Act and regulations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Enterprise Risk Management Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the section titled "Cybersecurity Governance," the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program. Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees. To maintain alignment and appropriate insight regarding information security activities, a bi-weekly operational committee provides general program insight. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, assessing, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management. • Security Competencies: The Company has security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense and Incident Response Plan: The Company utilizes sophisticated security monitoring and detection tools for continuous monitoring of our information systems 24 hours per day, seven days per week. The Company utilizes third-party tools and solutions to actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. We also receive the latest cybersecurity alerts and threat intelligence from government agencies and information sharing and analysis centers. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidance on our response to incidents by focusing on the coordination of personnel, policies, and procedures to ensure incidents are detected, analyzed and managed. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Third-Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management. A review process is conducted on new or significantly changed key third parties, to ensure certain cybersecurity baseline requirements are met and cybersecurity incidents are appropriately disclosed. This process is aimed at advocating for appropriate standards and controls, based on risk factors, to secure the third parties' information systems, and to ensure the third parties have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness to better equip Company personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices. This training is supplemented with annual required third party information security training. Additionally, the Company conducts monthly email security awareness testing, with follow-up training assigned when deemed necessary.


text: Notwithstanding our efforts at cybersecurity, the Company cannot guarantee that it will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A., Risk Factors – Risks Related to Our Business.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and proprietary information. Our cybersecurity risk management program includes a multi-point cybersecurity incident response plan.

companyName: System1, Inc.

ticker: SST


text: First, we have designed and assessed our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our businesses and technology infrastructure.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that we evaluate and address on a regular basis based on a risk-weighted determination.


text: Our cybersecurity risk management program includes the following elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing: (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external experts, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • cyber/technology errors & omissions insurance; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and assessment of materiality against external reporting requirements; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: There can be no assurance that our cybersecurity risk management program and evaluation and security processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in adequately protecting our systems, technology infrastructure and proprietary information. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors".


text: We have not identified specific risks from known or other broadly publicized cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors".


text: Cybersecurity Governance Our Board of Directors (the "Board) considers evaluating and proactively addressing cybersecurity risk as part of its risk oversight function and has delegated to the Board's Nominating and Corporate Governance Committee (the "Committee") oversight of cybersecurity and other information technology risks facing us and our businesses. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on the cybersecurity risks that we evaluate and which we may face in the future. In addition, management updates the Committee as necessary regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity oversight and assessment. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO and Director of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The information technology team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the I.T. environment.


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to team members, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage such material risks and to safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's and its customers' data, and maintain the trust and confidence of our customers, business partners and team members.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: In furtherance of assessing, identifying, and managing material cybersecurity risks; the Company: • Employs advanced technology solutions, such as proactive detection tools, to safeguard our assets and identify threats within its environment. • Conducts routine cyber education and awareness training sessions to empower team members with the necessary knowledge and cultivate a strong security culture across the organization. • Regularly assesses our cybersecurity program against the NIST Cybersecurity Framework, using the findings to develop action plans and track progress to completion. • Organizes tabletop exercises and drills to simulate cyber incidents, enhancing its incident response and recovery capabilities. • Analyzes internal and external cybersecurity incidents and threat intelligence to assess their relevance to its environment and industry, crafting actionable plans accordingly. • Manages an enterprise-wide disaster recovery governance program, including cybersecurity-related standards and compliance procedures. • Performs regular cybersecurity-related disaster recovery testing to ensure the recoverability of its critical systems, supporting business continuity across various lines. • Fosters integration between business units and corporate divisions with its internal cybersecurity team, embedding cybersecurity requirements into operational environments and influencing strategic decisions, budgeting, and processes (e.g., Security by Design). Additionally, senior management, executives, and the Board of Directors consistently review financial planning processes concerning cybersecurity initiatives.


text: Additionally, the Company is aware of the risks associated with third-party service providers, it implements stringent processes to oversee and manage these risks. The Company conducts security assessments of third-party technology providers before engagement and maintains ongoing monitoring to ensure compliance with Company cybersecurity standards. The monitoring includes assessments (e.g., reviewing vendor cybersecurity related attestation and disclosures (SOC 2 Type 2, etc.)) by the Company's Senior Vice President and Chief Information Officer ("CIO") and on an ongoing basis by its security engineers.


text: The Company's CIO is the member of the Company's management team primarily responsible for assessing, monitoring and managing the Company cybersecurity program. The Company's CIO has over 20 years of experience in the field of technology and security including experience as an enterprise CIO, as well as consulting experience advising organizations on their technology and risk profiles. The Company believes its CIO's in-depth knowledge and experience are instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies.


text: The Company's CIO oversees the day-to-day implementation of the Company's cybersecurity risk management programs, tests its compliance with standards, remediates known risks, and leads its employee cybersecurity training program. The CIO is tasked with keeping informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, in an attempt to assist in effectively preventing, detecting, mitigating, and remediating cybersecurity incidents. The CIO implements and oversees processes for the regular monitoring of the Company's information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is responsible for implementing the Company's incident response plan to mitigate the cybersecurity incident's immediate impact, implement long-term strategies for remediation, and prevent future incidents.


text: The CIO regularly informs the Company's Executive Vice President and Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") of material aspects related to cybersecurity risks and incidents regarding the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated as primary responsible for oversight of the Company's cybersecurity risk management. As discussed below, management reports to the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks regarding financial statements or financial statements reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise, including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively. Further, certain members of the Board of Directors are National Association of Corporate Directors ("NACD") CERT Certified in cybersecurity oversight.


text: The Board of Directors and the Audit Committee receive briefings from the Company's CFO and CEO on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to their regularly scheduled meetings, members of the Board of Directors, the CIO, CFO and CEO regularly engage in ad hoc conversations regarding emerging or potential cybersecurity risk and developments in the cybersecurity domain. The Board of Directors actively participates in strategic decisions making related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board of Directors conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review is helpful for identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: As of the date hereof, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to have been identified or are anticipated to have a material adverse effect on the Company's business strategy, results of operations, and financial condition. Despite its efforts to maintain processes which mitigate cybersecurity risks, there is no guarantee that such risks may not have a material effect on the Company's business strategy, results of operations, and financial condition in the future. For additional information on cybersecurity risks the Company may face, see Part I, Item 1A. Risk Factors – "Information technology system failures, network disruptions or cybersecurity breaches could adversely affect our business."


text: SoundHound acknowledges the increasing importance of cybersecurity in its operations and recognizes the potential risks and threats associated with cyber incidents. The Company is committed to maintaining the confidentiality, integrity, and availability of its information systems and data. However, no system can be completely immune to cyber threats. We face a number of cybersecurity risks in connection with our business. To date, such risks have not materially affected our business, including threats to and breaches of our data systems, malware and computer virus attacks.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Risk Management and Strategy The following information provides an overview of our approach to managing cybersecurity risks. The Company assesses, identifies and manages cybersecurity related risks. Cybersecurity related risks are evaluated to assess top risks to the enterprise on a bi-annual basis. SoundHound has implemented a comprehensive cybersecurity program designed to identify, assess, and manage cyber risks.


text: This program includes, but is not limited to: • Regular risk assessments and vulnerability assessments. • Implementation of industry-accepted cybersecurity controls and best practices. • Employee training and awareness programs to enhance the company's overall cybersecurity posture. • Continuous monitoring and incident response plans to detect and mitigate potential threats promptly.


text: We have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an annual internal review process and are approved by appropriate members of management.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level and by reviewing our operational policies and procedures. We review our operational policies and procedures with third party experts on an annual basis as part of our annual audit process. We also maintain cyber insurance coverage. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Vendor Management Team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: SoundHound will report any cybersecurity incidents determined to be material. Material aspects of the nature, scope and timing of the incident, and the impact or reasonably likely impact of the incident on the Company, including on SoundHound's financial condition and results of operations will be disclosed.


text: The audit committee oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The board recognizes the importance of cybersecurity in safeguarding the company's assets and operations.


text: SoundHound has a dedicated Information Security Management committee responsible for overseeing risks from cybersecurity threats. The committee's charter outlines its specific responsibilities related to cybersecurity risk oversight, and assists senior management in fulfilling its oversight responsibilities by creating, implementing, overseeing and maintaining SoundHound's Information Security Management System. The purpose of the ISMS is to protect the Company's information systems and assets, taking into account the potential for external threats, internal threats, and threats arising from transactions with trusted third parties and vendors. The board of directors is informed of cybersecurity risks, at least annually, through established processes, including periodic briefings, reports, and updates on the evolving landscape of cybersecurity threats.


text: SoundHound designates the Information Security Management Committee as responsible for assessing and managing cybersecurity risks. Committee members possess professional experience or backgrounds presenting relevant experience or capacity to address those matters within the scope of the Committee's responsibility, including senior executives, department leaders, and subject matter experts. Committee members are familiar, or have the ability to quickly gain familiarity, with major technology platforms employed by the Company; have knowledge of technological ecosystems and challenges confronted in current or emerging business environments; have the capacity to understand new or emerging technologies and cyber security threats; are familiar, or have the ability to quickly gain familiarity, with information security principles, privacy regulations, standards, and guidelines; and possess experience relating to enterprise risk management and process.


text: We view cybersecurity as a shared responsibility. All employees are required to complete cybersecurity training as part of onboarding, on an annual basis and have access to more frequent cybersecurity training online. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. The designated persons or committees actively monitor cybersecurity incidents through processes that monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, including continuous assessment and adaptation to emerging threats.


text: Risks from Cybersecurity Threats As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, incidents impacting data processed and systems maintained or operated by us or on our behalf, and incidents otherwise impacting our operations, can and do occur. For example, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our EXOGEN device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. As a result of the Change Healthcare incident, certain of our patient billing and collections processes were disrupted. We have identified an alternative claim processing intermediary and have resumed claims submissions, but this incident caused delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us. As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data. We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows. We continue to evaluate the impact of the Change Healthcare incident on our Company.

companyName: Bioventus Inc.

ticker: BVS


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data"). Our information security function is led by our Director of Information Technology, overseen by our Senior Vice President of Finance and Financial Planning, with the support of our third-party specialists. Our information security function helps identify, assess and manage risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including automated tools, domain name system filtering, antivirus protection, vulnerability scanning and penetration testing.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: For a description of our cybersecurity risks, refer to the risk factor in Item 1A. "Risk Factors," to this Annual Report on Form 10-K titled "If our information technology systems or data, or those of the third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who reports to our Senior Vice President of Finance and Financial Planning. Our Director of Information Technology is responsible for monitoring third-party specialists, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Senior Vice President of Finance and Financial Planning is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our Incident Response Policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Senior Vice President of Finance and Financial Planning. Our Senior Vice President of Finance and Financial Planning and, if escalated, other senior management, work with our incident response team to help mitigate and remediate cybersecurity incidents. In addition, our Incident Response Policy includes reporting to the Audit Committee for certain cybersecurity incidents. The Incident Response Policy is managed and maintained by our Director of Information Technology, with oversight from our Senior Vice President of Finance and Financial Planning. The Audit Committee receives periodic updates from our Senior Vice President of Finance and Financial Planning regarding the status of our cybersecurity program and our posture to identify and mitigate risks to our information security.


text: To operate our business, we utilize certain third party service providers to perform a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms, managed services, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology and corporate productivity services. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections and requiring their completion of written questionnaires regarding their cybersecurity programs.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: For additional information about the risks from cybersecurity threats that may materially affect us and how they may do so, see the section entitled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."


text: Our board of directors has overall responsibility for evaluating key business risks faced by us, including cyber security and information technology. The audit committee of our board of directors assists the board of directors in the oversight and assessment of risks relating to data privacy, technology and information security, including cybersecurity. Our audit committee holds regular meetings to discuss issues including our cybersecurity threats and has a dedicated agenda during such meetings that are designed to assist our board of directors and our audit committee in exercising their oversight function. The meetings involve presentations and reports from our management and specifically includes updates of current cybersecurity threats faced by us and steps we are taking to address them.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Owlet, Inc.

ticker: OWLT


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities; • cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer; • cybersecurity awareness training for employees; • security tools in our system to monitor and detect cybersecurity threats; • cyber liability insurance; • a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and • a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, where it deems appropriate, regarding any significant cybersecurity incidents.