text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Cybersecurity considerations are an integral part of our decision-making processes where communication, data and access are involved. Our Information technology ("IT") department works closely with our operations teams to continuously evaluate and address cybersecurity risks in alignment with our business and operational objectives. Our Chief Information Systems Officer, ("CISO") and IT teams play an important role in assessing the cybersecurity infrastructure employed within our acquired practices to ensure that necessary security enhancements are employed in a timely manner. The Company provides annual cybersecurity awareness training to its employees to mitigate risks by educating employees regarding best practices to avoid cybersecurity related breaches.


text: Engage Third-parties on Risk Management Understanding the ever-changing and complex nature of cybersecurity threats, our organization values collaboration with external experts, including cybersecurity consultants, for advisory purposes. These collaborations are aimed at enhancing our understanding and management of cybersecurity risks. Through such engagements, we seek to gain insights and recommendations on improving our risk management frameworks and responses to potential cybersecurity incidents.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH

secItem: Item 1C


text: This approach allows us to benefit from specialized expertise, helping ensure that our cybersecurity strategies and processes are informed by current industry insights. While these collaborations are not mandated, they are encouraged as part of our commitment to maintaining a vigilant and adaptive cybersecurity posture in line with evolving best practices.


text: Oversee Third-party Risk Aware of the potential risks posed by third-party service providers, our Company takes steps to perform security-related diligence on such providers. This diligence process aims to understand and evaluate the security measures and practices of our third-party partners. Our approach includes reviewing available information and seeking insights into their security and data management practices. This method is part of our broader strategy to mitigate the risks associated with data breaches or other security incidents that may arise from third-party engagements.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. While we have experienced cybersecurity incidents within several of our partnership subsidiaries over the years, these incidents have not been material, as each incident (i) has been isolated to certain segregated IT environments, (ii) has affected relatively few patients and their associated health information, and/or (iii) had a low probability of compromised data. Each of the foregoing cybersecurity incidents has been remediated in the ordinary course of business. However, we could experience a cybersecurity incident that materially affects us in the future. See "Risk Factors" in Item 1A on this Form-10K for additional discussion of cybersecurity risks to our business.


text: The Board of Directors recognizes the significance of cybersecurity threats to the Company's operational integrity, data security and stakeholders. The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and sees this as a major priority for the company. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight The Compliance Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Compliance Committee is composed of board members with diverse expertise, including risk management, technology, health care operations, and finance, equipping them to oversee cybersecurity risks effectively. In addition, each of the directors on the Compliance Committee has completed the Diligent Cyber Risk and Strategy Certification Program, developed by Diligent Corporation, a leading corporate governance technology company, which teaches cyber literacy for corporate directors to effectively govern significant enterprise-wide cyber risks and have meaningful conversations with management.


text: Management's Role Managing Risk The CISO plays a pivotal role in informing the Compliance Committee on cybersecurity risks. The CISO, in concert with the Chief Compliance Officer and General Counsel, provides comprehensive briefings to the Compliance Committee on a regular basis. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Compliance Committee and management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Compliance Committee actively participates in strategic decisions related to cybersecurity. This involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Chadd Pence. With over 25 years of experience in the field of IT and cybersecurity, Mr. Pence brings a wealth of expertise to his role. His background includes experience as an enterprise CISO and his knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Our CISO oversees our cybersecurity efforts and governance programs, tests our compliance with standards, remediates known risks, and provides regular guidance to management and the Board on these areas. In addition, to supplement this expertise, we periodically engage external experts, including cybersecurity consultants, to help us evaluate our risk management related policies and to help us to review and remediate cybersecurity incidents.


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of a variety of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs our Chief Financial Officer, President, and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Compliance Committee and the full Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity / information security program. The Information Security Officer reports directly to the Chief Operating Officer, and periodically reports to the Audit and Examination Committee of our board of directors.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance and related industry standards. In addition, we leverage various cyber-related associations, threat intelligence feeds, and audits to facilitate and promote program effectiveness. The information security program is periodically reviewed by the Information Security Officer in collaboration with information technology management with the goal of addressing changing threats and conditions.


text: We employ a layered defensive strategy when designing our cybersecurity controls. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations, and tabletop exercises. We engage in regular monitoring and assessments of our technology infrastructure using internal staff and third-party specialists.


text: We conduct ongoing social engineering testing and training across our entire employee base. We maintain a vendor management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Our independent auditors periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our CEO and Board of Directors as appropriate. The Incident Response Plan is coordinated by the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple areas of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company to date. For further discussion of risks from cybersecurity threats, see the section captioned "We are subject to certain risks in connection with our use of technology" in Item 1A. Risk Factors.


text: Our Information Security Officer is responsible for managing our information security program, inclusive of cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business continuity. Some of these responsibilities are carried out in collaboration with other internal departments, such as the information technology department. In any case, the Information Security Officer provides guidance, oversight, and monitoring of the information security program, and acts in an independent role, reporting directly to the Chief Operating Officer and subsequently to the Audit and Examination Committee of the board of directors. Our Information Security Officer has extensive bank operations experience, has attained Certified Banking Security Manager certification with the banking industry, and attends relevant cybersecurity training sessions on a regular basis. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats.


text: The Audit and Examination Committee of our board of directors is responsible for overseeing our information and cybersecurity risk management program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Audit and Examination Committee of our board of directors regarding the information security program, cybersecurity and/or privacy incidents, key cybersecurity initiatives, and other matters relating to cybersecurity processes. These reports may occur more frequently if a significant issue or incident is being addressed.


text: The Company's information security program is designed to protect the security, confidentiality, integrity and availability of the Company's sensitive and personal information and client information. Employing a risk-based approach, the program systematically identifies, assesses and implements safeguards that seek to mitigate cybersecurity threats and secure the Company's information assets, including those of our sub-servicers. The program is informed by the National Institute of Standards and Technology Cybersecurity Framework and is shaped by the legal requirements derived from authoritative sources such as the Gramm-Leach-Bliley Act and its implementing regulations and guidelines, as well as Freddie Mac's mandates from the office of Federal Housing Enterprise Oversight. Additionally, the program is guided by relevant state laws and regulations.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Periodically, the Company, as it reasonably deems necessary, will identify and categorize potential cybersecurity threats and vulnerabilities, determine acceptable risk tolerance for each such threat and vulnerability and implement adequate mitigation controls. At the senior executive level, the CFO is entrusted with the day-to-day oversight of the program's development, implementation, and maintenance. To help facilitate Company-wide compliance with the plan, the Company, as well as its subservicers, provide ongoing training to the appropriate employees.


text: Our board of directors is responsible for understanding the primary risks to our business. The board is also tasked with developing and advancing our cybersecurity strategy, as well as evaluating the adequacy of our programs and policies. The CFO is responsible for ensuring that the board of directors comprehends the Company's cybersecurity risk profile and receives updates on the program and its policies on a quarterly basis or as necessary. Our current CFO is Michael Hutchby. Mr. Hutchby has a B.A. in Economics from The Johns Hopkins University and an M.B.A. from the Stern School of Business at New York University. Mr. Hutchby was appointed the Company's CFO, Treasurer and Secretary in June 2019 and previously served as the Company's Controller from October 2013 to June 2019.


text: As mentioned above, the CFO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team ("CRT"), comprised of the CFO, Manager of Information Technology ("MIT") and other personnel, as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CFO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College. Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network security, user and email administration, data governance, threat management, and endpoint security.


text: In conjunction with the aforementioned plans, the Company conducts an annual business impact analysis to identify the critical business functions that are required by the Company to sustain business operations and potential impacts to the Company if any those critical functions are disrupted. Deriving from the analysis, the Company maintains a business continuity and disaster recovery plan to coordinate business recovery to resume any disrupted critical business operations. In the event of a critical cybersecurity business disruption, the President of the Company may activate the business continuity plan to implement risk-based strategies devised to maintain business continuity against distributed denial of service attacks or malware.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company.


text: Please refer to "Item 1A. Risk Factors – Risks Related to Our Business – We are highly dependent on information systems and third parties, and systems failures or cybersecurity incidents could disrupt our business."


text: Cybersecurity Risk Management and Strategy Cybersecurity threats have the potential to negatively impact companies of all sizes and complexities. Our normal business operations could be severely disrupted by cyberattacks, both against our own information systems as well as those hosted and managed by our third-party partners. The loss or disclosure of sensitive data as a result of cyberattacks could have a material impact on our business. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: We have implemented a comprehensive Information Security and Risk Management Program that is designed and maintained to be compliant with all applicable federal and state regulations, and is regularly audited by independent experts to ensure continuous effectiveness and compliance. Key elements of this program include: a comprehensive risk management process, integrated with the Enterprise Risk Management system, that continuously assesses, identifies, and manages current and emerging cybersecurity threats and risks, evaluates the effectiveness of information security controls, and reports the overall risk posture to Executive Management and the Board of Directors. assessment of daily cyber threat intelligence from multiple sources; the use of third-party information security services for continuous monitoring and alerting of information systems, network. and user activity;


text: a Vulnerability Management Program that scans networks, devices, and information systems for known cyber vulnerabilities, and initiates processes to mitigate them;


text: a third-party risk management program that evaluates and ensures our key partners adhere to the same level of information security posture as we do internally;


text: Business Continuity and Incident Response plans that are designed and tested for anticipated operational failures, natural disasters, cyberattacks, and other disruptive events; and an Information Security Awareness program to ensure employees and customers maintain an awareness of information security threats and best practices to prevent them.


text: Information Security Governance The Chief Information Security Officer is primarily responsible for the Information Security and Cyber Risk Management programs, and reports to the Chief Risk Officer. The Chief Technology Officer that oversees the Information Technology Department plays a key role in cybersecurity, ensuring that information systems, networks, and endpoints are configured and operated according to the requirements of the Information Security Program and related policies and standards. Both the current Chief Information Security Officer and Chief Technology Officer have over 20 years of experience in Information Technology and Information Security.


text: The Information Security Committee, consisting of senior management and analysts from Information Security and Information Technology, monitors and assesses cyber threat intelligence, responds to cyber incidents at a technical level, and determines whether new controls are needed to address emerging risks or active cyber exploits. Key Risk Indicators for Information Security and Information Technology are reported to the Operations and Information Technology Steering Committees. Key risks and other relevant information are further summarized for the Board Risk and Audit Committees. The Board also receives a full report on the Information Security Program and its effectiveness annually. Other cyber related issues are brought to the attention of the Board as needed.


text: Cybersecurity Risk Management and Strategy The Company recognizes the security of our banking operations and the confidentiality, security and availability of the information that the Company collects and stores, is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. The Company has implemented a comprehensive cybersecurity risk management program that we believe is reasonably designed to mitigate these risks and protect sensitive customer data, financial transactions and our information systems. Key components of the cybersecurity risk management program include:

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors.


text: A third-party Managed Detection and Response ("MDR") service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting.


text: A third-party Managed Security Service Provider ("MSSP") covering all critical cyber defense functions such as data protection, identity and access management, insider risk management, security operations and threat intelligence. A training program that educates employees and management about cybersecurity risks and how to protect themselves from cyberattacks.


text: An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: The Company engages reputable third-party auditors and security assessors to conduct various independent risk assessments on a regular basis, including cybersecurity program maturity assessments and network and systems testing to identify and address potential vulnerabilities. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Our vendor management program is designed to ensure that our vendors meet current cybersecurity and information security standards. This includes conducting periodic reviews of independent control audits of the security, infrastructure, application standards or controls, and recovery plans of our most critical vendors.


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission, to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.


text: The Company has an incident response program in place that is designed to enable a coordinated response to mitigate the impact of cyber-attacks, recover from the attack and provide for the prompt escalation of certain cybersecurity incidents to management, including for decisions regarding timely reporting of material incidents in accordance with SEC rules.


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Company's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Part I, Item 1A, "Risk Factors" in this report.


text: Board of Directors Oversight The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's cybersecurity risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has delegated primary oversight responsibility over the Company's cybersecurity risk and cybersecurity risk management to the Information Services Steering Committee of the Board of Directors. The Information Services Steering Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Information Security Officer ("ISO") and/or the Chief Information Officer ("CIO"). The ISO and/or CIO also provide periodic updates regarding cybersecurity risks and the cybersecurity program to the Audit Committee of the Board of Directors and to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The ISO and the CIO are responsible for implementing and maintaining the Company's cybersecurity risk management program. Information Security is led by the ISO, who reports directly to the President/Chief Executive Officer. The Company's ISO has over 35 years of experience in IT management, information security, and cybersecurity with the Company. The ISO and CIO are responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the ISO or the CIO through quarterly metric reporting to the Information Services Steering Committee. This Committee establishes and oversees policies, programs, and other guidance to provide specific expectations for managing the Company's cybersecurity risk.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Nuwellis, Inc.

ticker: NUWE


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees from our information technology department, and our board of directors. The board of directors, Audit Committee, and senior and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management protocols are comprised of software programs including antivirus protection, end-point threat detection, remote access, multifactor authentication. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an employee handbook as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to incident response, confidential information and the use of internet, social media, email and wireless.


text: Our Director of Operations is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the board of directors. Nuwellis leverages 3rd party IT service provider and specifically their cybersecurity team's expertise.


text: All employees are required to complete cybersecurity training as part of on-boarding process and on-going training both online and in-person. IT department assigns position specific security level encryption to manage information security.


text: We have continued to expand investments in IT security, including software programs and policies mentioned above. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation.] In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers.


text: The Audit Committee and the full board of directors periodically participate in discussions with management and amongst themselves regarding cybersecurity risks. As of 2024 the Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap.


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages as part of our risk management processes. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. Although the board members are former executives of publicly traded companies, none of them have specific cybersecurity experience.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. Such occurrences could negatively impact our business strategy, reputation and results of operation. For more information about the


text: Risk Management and Strategy We outsource substantially all of our IT functions, including cybersecurity, through BankOnIT, LLC ("BankOnIT"), a third-party banking technology service provider. BankOnIT provides significant resources to identify, assess and manage risks from cybersecurity threats, including: Continuous 24/7/365 monitoring of our information systems; Scanning of our information systems; Continuous updating and testing processes; Performing vulnerability assessments; and Maintaining up-to-date firewall and anti-virus protections.

companyName: Bank7 Corp.

ticker: BSVN


text: BankOnIT leverages certain industry and government associations and threat-intelligence resources to keep up to date on, and respond to, the latest cybersecurity threats.


text: We engage in regular assessments of our infrastructure, software systems, and network architecture utilizing third-party cybersecurity professions, including annual penetration testing and audits of our information technology systems to identify vulnerabilities and areas for additional enhancement.


text: Employees receive regular virtual and in-person security awareness training through simulated tests, company communications, and in-person training. We also maintain a vendor management program to identify and assess risks of our third-party service providers.


text: Due to the type and volume of information that we collect and store to provide banking services to our customers, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our customer's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors. We are exposed to cybersecurity risks associated with our internet-based systems and online commerce security, including 'hacking' and 'identify theft.'"


text: Our cybersecurity function is overseen by our COO/ IT Manager who has over 9 years' experience managing such functions. IT functions are also managed through our IT Committee which is comprised of several senior level executive officers and other Company employees and chaired by our COO/ IT Manager. The IT Committee governs all IT functions at the Company and selects, monitors and manages our third-party IT service providers that implement and maintain our cybersecurity functions.


text: We also maintain a Cyber Incident Response Team, which includes a board representative and an executive officer representative and is chaired by our COO/IT Manager. The Cyber Incident Response Team is charged with developing and implementing incident response and recovery plans to guide our employees, management and the Board in their response to a cybersecurity incident.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, including cybersecurity risks. The full Board receives a network health report at each board meeting from our COO/ IT Manager, which addresses our overall network risk including any relevant cybersecurity threats and incidents.


text: Cybersecurity Risk Management and Strategy The operation of our business depends on our information technology systems. We rely on our information technology systems to effectively manage sales and marketing data, accounting and financial functions, inventory management, product development tasks, clinical data, customer service and technical support functions. Our information technology infrastructure and products are vulnerable to cyber-based attacks. Cyber-based attacks can include computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks and other introduction of malware to computers and networks; unauthorized access through the use of compromised credentials; exploitation of design flaws, bugs or security vulnerabilities; intentional or unintentional acts by employees or other insiders with access privileges; and intentional acts of vandalism by third parties and sabotage.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: We have developed and implemented a risk-based program focused on cybersecurity measures to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management is integrated into our overall risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Audit and Risk Committee periodically reviews and discusses with management the Company's policies and internal controls with respect to cybersecurity. Our Senior Group Technology Manager ("SGTM") (who has over 20 years of experience in information technology roles and holds various industry certifications) reports to the Chief Financial Officer and together report to the Audit and Risk Committee periodically on cyber security matters. The Audit and Risk Committee reports through to the Board. In addition to the annual security assessment and penetration test, the SGTM utilizes an Endpoint Detection and Response system which acts as Anti-virus and intrusion prevention system and reports all abnormalities to the SGTM. Essential Eight and Center for Internet Security Control Strategies including patch applications, multi-factor authentication, administrative privileges, application hardening and backups are performed internally via a security consultant with regular updates provided to the SGTM. Reported findings and action items are recorded and assigned to personnel for action.


text: Any failure to protect our information technology infrastructure and our products against cyber-based attacks, network security breaches, service interruptions or data corruption could materially disrupt our operations and harm our business. Our cybersecurity risk management program includes: periodic risk assessments annual security assessment and penetration testing;


text: A third-party Security Operations Center ("SOC") partner to monitor, manage and respond to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cyber risk management process for service providers, suppliers, and vendors that have access to our critical systems and information managed through the selection of typically larger well-known providers, which is supplemented by review of contractual arrangements, insurance and information requests; cybersecurity awareness training and phishing campaigns for specific employee groups; disaster recovery plans/procedures;


text: access control and CCTV systems (where appropriate) for the physical protection of Anteris systems; and incident response and recovery procedures, for cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors - Risks related to our business - Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."


text: Ohio Valley recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As a result, the Company has devoted significant financial and personnel resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of the Company's Information Security Program; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert us of potential threats;

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in an efficient and effective manner;


text: Collaborating with third-party cybersecurity consultants that perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes; Utilizing a third-party risk management program for purposes of identifying, assessing, and managing risks involved with external service providers;


text: Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices; and Providing regular cybersecurity training for both our employees and our Board of Directors.


text: The Board, through the Information Technology Steering Committee, works with senior management and other employee committees to oversee the development, implementation, maintenance, and administration of the Information Security Program, which is aligned and integrated into Ohio Valley's overall risk management system and processes. The Information Technology Steering Committee itself is comprised of diverse directors and officers of the Bank with vast knowledge and years of banking experience. The Information Security Officer of the committee has 26 years of banking experience including 25 IT related years as well as continuing education including a BA in Management Information Systems and Network+ and A+ certifications. The purpose of the Information Security Program is to: Identify and analyze cybersecurity risks; Provide the Company with direction on effectively managing such risks; Approve information security plans, policies, and programs; Assess whether the Company's current security programs are effective; and Provide recommendations for corrective action.


text: The Company has also implemented an Incident Response Plan which is reviewed and updated at least annually in response to an ever-changing threat landscape. The purpose of the Incident Response Plan is to provide long-term strategies for the remediation and prevention of, and resiliency to, cybersecurity threats and incidents. Our Incident Response Plan is executed through the incident response team comprised of both cybersecurity experts and select members of management, including one or more Information Security Officers, who are responsible for monitoring potential threats and identifying events that may warrant Board notification and/or public disclosure. Additionally, our Information Security Officers are responsible for responding to security events by ordering emergency actions to protect the Company and its customers; managing negative effects on the confidentiality, integrity, and availability of information; and minimizing the disruption and degradation of critical services.


text: Notwithstanding the strength of Ohio Valley's defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, Ohio Valley has not detected a significant compromise, significant data loss, or any material financial losses related to cybersecurity attacks, Ohio Valley's systems and those of its customers and third-party service providers are under constant threat, and it is possible that Ohio Valley could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us and our customers.


text: The federal banking regulators regularly issue new guidance and standards, and update existing guidance and standards, regarding cybersecurity intended to enhance cyber risk management among financial institutions.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Financial institutions are expected to comply with such guidance and standards and to accordingly develop appropriate security controls and risk management processes. If we fail to observe such regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties. In 2023, the SEC issued a final rule that requires disclosure of material cybersecurity incidents, as well as cybersecurity risk management, strategy and governance. Under this rule, banking organizations that are SEC registrants must generally disclose information about a material cybersecurity incident within four business days of determining it is material with periodic updates as to the status of the incident in subsequent filings as necessary.


text: Under a final rule adopted by federal banking agencies in 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization's ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the Board of Directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs, and many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. "Risk Factors" for a further discussion of risks related to cybersecurity.


text: Risk Management and Strategy Information security and cybersecurity risk is the risk that the security, confidentiality, integrity or availability of our information and critical information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Cybersecurity attacks and other security breaches can have material adverse impacts on our business. While no organization can eliminate cybersecurity risk entirely, we devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. The Bank devotes significant resources and management focus to ensuring the integrity of our systems through information security and business continuity programs. However, our facilities and systems, and those of third-party service providers, are still vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. The Company seeks to address cybersecurity risks by implementing a governance structure and processes to assess, identify, manage, remediate, and report cybersecurity risks.


text: Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture. We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable "best practices" and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by have in place a robust incident response process that helps ensure our preparedness for a cybersecurity incident including our ability to detect, analyze, contain, remediate, and recover from a security incident as well as conduct post-incident analysis to avoid future incidents. Incident response process activities are overseen by cross-functional leadership in Risk Management, Operations, Information Security, Compliance, and Information Systems. Security events and incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business, and overall privacy impacts. We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.


text: Our risk management program regularly assesses third party risks (inclusive of fourth-party risk) by conducting activities to identify and mitigate risks from third parties (e.g., vendors, suppliers, and other business partners). Cybersecurity risks are evaluated when selecting and managing applicable third-parties that handle or process employee, business, or customer data, and a review process that includes due diligence over a third-party's information security and technology control environment is conducted at onboarding and periodically throughout the lifecycle of the relationship to ensure that systems of third- parties meet certain security baseline requirements. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.


text: Cybersecurity Gover nance the importance of information security, privacy and data protection to our stakeholders, cybersecurity is a critical part of our risk management program and a key focus area for our Board and Executive Management. The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help manage our risk exposure to meet our strategic objectives. Executive Management and our Information Security Officer ("ISO") regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.


text: The Audit & Risk Committee meets on a monthly basis to receive updates from management, including leaders from Information Systems, Information Security, Risk Management, and Compliance, on matters of cybersecurity risks and mitigation initiatives. The leaders from these areas each bring over 20 years of professional experience and certifications in information technology, information security, information systems audit, compliance, and risk management. This group of leaders provides updates on existing and new cybersecurity risks, status updates on how management is addressing or mitigating cyber risks and cybersecurity or privacy incidents, and progress on key cybersecurity initiatives.


text: The Electronic Data Processing ("EDP") Steering Committee is a senior management level committee that meets at least quarterly to discuss a variety of information technology and cybersecurity matters, which form the basis for providing status reports to the Board of Directors. The committee is responsible for monitoring all Information Systems-related projects and initiatives, facilitating the remediation of issues that could adversely impact the ability of the Information Systems Department to perform its function, and allocating available resources to the highest priority projects and initiatives. The Chief Administrative Officer chairs the EDP Steering Committee and members of Executive Management, Information Systems, Information Security, Treasury Management, Retail and Wholesale Banking departments are represented in the meetings. In addition to project management guidance, the committee provides oversight of and direction for the Information Security Program, monitors cybersecurity risks, and helps ensure prompt remediation of cybersecurity incidents.


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition; however, cybersecurity threats are pervasive. Despite the capabilities, processes and security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, cybersecurity threats are continuously evolving, which may cause cybersecurity threats to be more difficult to detect in the future. See "Risk Factors - Risks Related to Cybersecurity and Information Technology" in Part I, Item 1A of this Form 10-K, for additional information about these and other risks related to cybersecurity and information technology.


text: Cybercriminals, hackers, and threat-actors are becoming more sophisticated and effective every day. To mitigate threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data that our customers and other stakeholders entrust to us a top priority. We are committed to safeguarding the confidentiality, integrity, and availability of all physical and electronic information assets to ensure that regulatory, operational, and contractual requirements are fulfilled. Our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We have not previously experienced a cybersecurity event that was determined to be material, and our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: VirnetX Holding Corp

ticker: VHC


text: Risk Management and Strategy We have developed detailed policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats as a part of our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications or requirements, however, we do use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our own and our customer's information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding such incidents can be made by management, the Board of Directors, and legal counsel in a timely manner.


text: We conduct cybersecurity risk assessments annually, quarterly and upon certain triggering events. Such risk assessments take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., security incidents that have impacted other companies, industry trends, and recommendations from our IT vendors). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board of Directors and members of senior management.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems and infrastructure from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and management plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and management plans address — and guide our employees, management, and Board of Directors on — our response to a cybersecurity incident. In the event of an incident, we intend to follow our incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as the Board of Directors and senior management, as appropriate.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we encourage our providers to meet appropriate security procedures, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through privacy and security trainings to enhance employee awareness of how to detect and report cybersecurity threats and cybersecurity incidents.


text: The Nominating and Corporate Governance Committee (the "Committee") and senior management oversee our cybersecurity risk processes and policies. The Committee receives regular reports from senior management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including security risks and information security vulnerabilities. The Committee also ensures that procedures for safeguarding the Company's information technology ("IT") systems are documented and implemented, monitors the effectiveness of the Company's cybersecurity program for protecting against internal and external threats as well as disaster recovery and disruption mitigation, and addresses deficiencies as the threat and business landscape continues to evolve. The Board of Directors receives regular updates from the Committee based on such oversight and communications with senior management regarding cybersecurity risk resulting from risk and control maturity assessments, progress of risk reduction initiatives, external auditor feedback and relevant internal and industry cybersecurity incidents.


text: Our Board of Directors has technical and industry expertise in risk management, computer security and information technology matters. Specifically, the chairperson of the Committee has 40 years of experience in the cybersecurity field, was a former sub-chairman of the NIST Board of Assessment for Programs/National Research Council and holds CISSP, CRISC and CDPSE certifications.


text: Management's Role Our Chief Technology Officer ("CTO"), Director of IT (Information Technology), and Vice President of Platform Engineering (collectively, the "Security Team") have primary responsibility for assessing and managing cybersecurity risks. The Security Team reviews security performance metrics, identifies security risks, and assesses the status of approved security enhancements. The Security Team also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Our CTO, holding a Doctorate in Strategic Intelligence, has served in various roles in technology research and military intelligence for 27 years. Our Director of IT, holding a degree in Computer Technology, has served in various roles in information technology for 30 years. Our Vice President of Platform Engineering has served in various roles in information technology and information security for over 33 years.


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates for business combination. Therefore, we do not consider that we face significant cybersecurity risks.

companyName: Perceptive Capital Solutions Corp

ticker: PCSC


text: We have not adopted any cybersecurity risk management program or formal procedures for assessing cybersecurity risks. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our Board for further actions, including the implementation of mitigation measures or other response or actions that the Board deems appropriate to take.


text: Since the completion of our Initial Public Offering and as of the date of this Annual Report, we have not experienced any cybersecurity threats that have materially affected, or that we believe are reasonably likely to materially affect, us, including our business strategies, results of operations, or financial condition


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These cybersecurity processes are integrated into the Company's overall compliance, risk management, and oversight procedures as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company's process allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness, incident response, and disclosure procedures as required by the SEC.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: The Company may review System and Organization Controls 1 ("SOC1") or System and Organization Controls 2 ("SOC2") reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cybersecurity and awareness training to our employees to help mitigate the risk of threats posed by bad actors requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.


text: On July 19, 2024, CreditRiskMonitor.com detected unauthorized occurrences within its computer network. Upon detection, the Company immediately activated its incident response plan and took steps to contain, assess and remediate the incident. The incident did not have a material impact on the Company, including its business strategy, results of operations, or financial condition.


text: Board of Directors -- The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee and the full Board of Directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or Chief Technology Officer.


text: Management -- Under the oversight of the Audit Committee of the Company's Board of Directors, the Chief Technology Officer, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Chief Technology Officer are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is everchanging, the Company must make continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup and recovery systems to restore systems and return to normal operations. However, there can be no assurance that the Company's ability to monitor or mitigate cybersecurity risks will be fully effective, and the Company may fail to identify cybersecurity breaches or discover them in a timely way."


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, and for various other aspects of the business.

companyName: AmBase Corp

ticker: ABCP


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies on third party service providers to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to any tenants' and employees' personal data.


text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Risk Management and Strategy The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance," the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee of the Board of Directors (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Vice President of Information Technology, other members of management and relevant management committees and councils, including management's Sarbanes-Oxley & Cybersecurity Steering Committee.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt and appropriate internal reporting of certain cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incidence Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans intended to fully and timely address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to proactively address cybersecurity threats and prevent incursions and to communicate the Company's evolving information security policies, standards, processes and practices. Our awareness program includes assessment of our personnel's preparedness through regular phishing e-mail alerts, highlighted banners that warn about external senders, and tests administered to help the Company's personnel interrogate, navigate around, and avoid clicking suspicious and unfamiliar links from unknown senders.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are periodically reported to the Audit Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by these assessments, audits and reviews.


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board of Directors and Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Sarbanes-Oxley & Cybersecurity Steering Committee, which includes the Company's President and Chief Financial Officer ("CFO") and Vice President of Information Technology.


text: The Sarbanes-Oxley & Cybersecurity Steering Committee, in coordination with the Company's outside legal counsel, works collaboratively across the Company and with various consultants to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Vice President of Information Technology has served in various roles in information technology and information security for over 25 years and holds undergraduate and graduate degrees in computer science. As described in more detail above under the heading "Information about our Executive Officers," the Company's Chief Executive Officer and the President and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 30 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.


text: Risk Management and Strategy The Company's operations rely on the secure processing, storage, and transmission of confidential and personal identifiable information within various technology platforms. Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats. We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers. Such processes and programs are a part of the Company's overall risk management and compliance programs. The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring. The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness training program for all employees. This training is reinforced through periodic simulated phishing tests to assess our employees' responses to suspicious emails.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data centers. It also includes a comprehensive disaster recovery plan that is continually tested and designed to help enable us to resume business in the event of a disaster or cybersecurity incident. Through recurring internal and external audits, controls are regularly reviewed, tested, and enhanced to promote best practices. The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Security Officer (CISO) duties such as counter-threat intelligence.


text: Our information security program also includes a cybersecurity Incident Response Plan ("IRP") that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders. The Company also maintains dedicated cyber liability insurance for breach event costs including: post breach event remediation costs;


text: cybercrime coverage (including financial fraud, telecommunications fraud, and phishing attacks); and coverage for system failure, bricking loss, and physical damage. The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach.


text: We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security threats. Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board has delegated oversight of the Company's information security program and matters of cybersecurity to the Audit Committee of the board of directors. The Company's senior officers, including its Chief Information Officer, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company's risk mitigation efforts related thereto.


text: In addition, the Company's information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for an initial business combination. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing our risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. Since our initial public offering, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy and results of operations.

companyName: Focus Impact BH3 Acquisition Co


text: Risk Management and Strategy We employ a cybersecurity program which we believe is appropriate for the potential of cybersecurity threats faced by us and is built upon a set of policies, procedures and standards supported by training and education. Our information systems employ local and cloud storage and recovery services from various third parties. We have established processes to assess, identify, and manage risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes and engaged third-party consultants to assess and gather threat intelligence and cyber risk trends and conduct assessments and testing of our cybersecurity procedures and protections, which is overseen by our Board of Directors through our Audit Committee, along with our executive management.

companyName: FEMASYS INC

ticker: FEMY


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for unauthorized access to our information technology systems and identify potential security threats through various automated detection solutions. To protect the security of our information infrastructure and protect our systems and information from unauthorized access, we draw on the knowledge and insights of an external information technology consultant who acts as our primary IT administrator and employ an array of third-party tools and technologies.


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "General Risks Governance and Role of Management and the Board Our Chief Operating Officer leads our cybersecurity program and reports, with respect to cybersecurity incidents, to the Company's Chief Financial Officer. Our Chief Financial Officer reports directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversight, including cybersecurity risks. The Chief Financial Officer or Chief Operating Officer briefs the Board and Audit Committee on the effectiveness of our cybersecurity program quarterly. The Chief Operating Officer oversees the operation of our cybersecurity program and has over 20 years of executive experience overseeing risk management and internal controls. The Chief Financial Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Financial Officer's oversight of the Company's information technology function and supervision of the Company's IT administrator. We have not experienced any cybersecurity threats or incidents that have had a material impact on our business to date.


text: Risk Management and assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As we grow, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: cybersecurity program is overseen by our head of human resources, information technology (IT) and facilities, who manages our third-party providers of IT services. We have engaged contractors to provide cybersecurity standards, architecture and processes. As part of our service agreement with our contractors, we receive identification and reporting of risks to our management and board. Our information technology team maintains a security operations center intended to identify anomalous activity.


text: Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. Our business depends on the availability, reliability and security of our and our third-party contractors' information systems, networks and data.


text: Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: "Our business and operations would suffer, and could be negatively affected, in the event of system failures or cyberattack s. "


text: Our management oversees and reviews any reports of cybersecurity risks or breaches provided by our third-party providers of IT services. Additionally, management assesses potential improvements to our cybersecurity policies and procedures based on recommendations from third-party experts, including our providers of IT services, in a matter that's suitable for a company our size and nature.


text: One of our Board's key functions is informed oversight of our risk management process, including risks from cybersecurity threats. The Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board as a whole, as well as through various Board standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee has the responsibility to review and discuss with management and KPMG LLP, the Company's independent auditors, as appropriate, our guidelines and policies with respect to risk assessment and risk management, including our major financial risk exposures and the steps taken by management to monitor and control these exposures, including as it concerns risks from cybersecurity threats. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit Committee (the "Committee"). The Committee has primary responsibility for overseeing our risk management practices, programs, policies, and procedures related to data privacy, data protection, and cybersecurity. The Committee reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect our business. The Committee regularly discusses with management, legal counsel, and the internal audit department our major risk exposures. This includes potential financial impact on us and the steps taken to monitor and control those risks. Reviews with management are done annually, which includes a summary of legal and regulatory compliance matters and risk management activities, and a review of our cybersecurity program. Additionally, the Committee oversees the process by which our Board of Directors is informed regarding the risks facing us and coordinates with our legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Our IT Manager has been designated as our Chief Information Security Officer ("CISO"), who is responsible for identifying, assessing and managing our risks from cybersecurity threats. The CISO has been with the Company for over five years and has many years of experience in technology. The CISO is supported by our outside IT consulting firm and its cybersecurity team that is staffed with personnel experienced in cyber security, security operations and incident management.


text: The CISO reports to the Chief Accounting Officer ("CAO"), who provides the Committee with bi-annual updates about our cybersecurity program and material risks.


text: Risk Management and Strategy Processes for identifying and assessing cybersecurity risks The CISO, with the support of the outside consultant's cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on our critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO.


text: Processes for managing cybersecurity risks The cybersecurity team tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, the cybersecurity team oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps are taken.


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our IT processes. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through this process, cybersecurity risks are presented to the executive leadership team, including the Chief Executive Officer ("CEO") and CAO, as well as reported to the Committee.


text: Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel identify and oversee material risks from cybersecurity threats associated with our use of such entities. CHICAGO ATLANTIC BDC, INC.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN