text: The CISO reports on the status of the ISP including relevant risks, cybersecurity threats, program updates, and program reporting to the CRC and the ROC no less than four times per year. Any material cybersecurity information, including strategic program development, is reported by the CISO to appropriate management and Board representatives to ensure timely awareness and escalation as necessary. Should there be a cybersecurity incident, we have a formal Incident Response plan including escalation processes designed to keep relevant management and committees informed of the mitigation and remediation efforts. The identification of incidents may come through internal monitoring and detection resources, external threat intelligence, third-party risk management efforts or various other event escalation methods. We leverage a Managed Security Services Provider ("MSSP") for supplemental expertise and resources with the management and enhancement of critical threat monitoring solutions. The MSSP also provides industry-leading Security Operations Center services that serve as a critical source for event and incident detection.


text: The Board is actively engaged in the oversight and prudent management of risk, including those relating to cybersecurity and regulatory compliance. A comprehensive program update is delivered to the Board annually by the CISO. The Board annually reviews and approves the ISP and related Information Security policies to ensure alignment with the Company's risk appetite and strategic defense amidst the evolving cybersecurity risk landscape.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Vroom, Inc.

ticker: VRM


text: We design and assess our program guided by a number of well-known industry standards, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001, and Center for Internet Security (CIS) Controls V8. This does not imply that we meet all of these standards, specifications, and requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Senior Director, Information Security, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy—If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Vroom's Senior Director, Information Security reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Senior Director, Information Security updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our Senior Director, Information Security, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies. Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief People and Culture Officer, and Head of Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. Our Senior Director of Information Security, reports to the VP of Engineering and is the head of the Company's cybersecurity team. The Senior Director of Information Security is responsible for overseeing the Company's security team and related initiatives. He has twenty-five years of experience in the technology industry with over ten years of experience in cybersecurity.


text: Our management team stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: Cybersecurity risk management and strategy As one of the elements of the Company's overall risk management program, the Company's cybersecurity program is focused on the following key areas: • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to among other things: • Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures; • monitor Company networks, servers and endpoints to identify vulnerabilities; • perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness; • obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; • determine and execute mitigation and remediation options and plans; and • ensure ongoing compliance with applicable legal and regulatory requirements, including notification to required individuals and regulatory bodies in the event of the discovery of an information security breach as defined under applicable laws, and timely and adequate disclosure under applicable SEC rules. • Education and Awareness: The Company provides annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company maintains an Information Security Committee (the "ISC") which is a cross-functional governance committee comprised of the AVP- Enterprise Information Technology ("IT AVP"), Chief Financial Officer ("CFO") and Chief Executive Officer ("CEO"). The ISC is the focal point for all information security activities throughout the Company and acts as a liaison on security matters throughout our group of affiliates. The ISC, led by the IT AVP works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC is charged with developing and implementing policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC is responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the ISC to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's IT AVP, on behalf of the ISC, reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Internal Audit function also provides quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.


text: Management's Expertise Our IT AVP also ensures he is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents. In addition, the Company's CEO and IT AVP each hold undergraduate degrees and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including events perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, which includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including network and endpoint monitoring, audits, vulnerability assessments, penetration testing and threat modeling to inform our risk identification and assessment. We also work with trusted third-party information security providers to deploy technologies designed to detect any unusual activities in our systems, attempts to access our systems, and guard against other security threats. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Head of Information Technology ("IT").


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • leverage incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of our processes, we regularly engage with consultants, auditors and other third parties, including having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our incident response plan requires that suspected cybersecurity incidents are promptly reported to our Controller and Chief Human Resource Officer and includes an escalation path to our Chief Executive Officer, executive leadership team, and board of directors.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our contract research organizations or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs, and could subject us to liability," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: Our audit committee receives updates from management of our cybersecurity threat risk management and strategy processes. The audit committee receives information regarding current and emerging material cybersecurity threat risks and our ability to mitigate those risks. Our board of directors receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Head of IT. This individual has over ten years of information technology and cybersecurity work experience. This risk management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. This risk management team member reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: scPharmaceuticals Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: At this time, our cybersecurity risk management program is undergoing an effort to expand and mature our security controls and documentation. Our ongoing efforts include: • A security risk assessment conducted by an external supplier to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. This assessment is ongoing and will be completed in the third quarter of 2024. • The implementation of revised information security program documentation and policies in the first quarter of 2024, including: o revision and implementation of a revised information security policy; o implementation of a revised incident response plan and policy; o implementation of a third-party risk management program that includes update procedures for third party vendor due diligence; o implementation of additional periodic cybersecurity and awareness training for all of our employees.


text: These efforts complement our current cybersecurity risk management program, which include a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. We also conduct employee cybersecurity awareness training upon onboarding to the company. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President Legal Affairs and Chief Compliance Officer, our Chief Financial Officer and internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Director of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes security program development and review, implementation of security tools and software, security risk identification and remediation, incident identification and remediation, as well as managing enterprise risk. In addition, we rely on third party cyber security consultants and legal counsel to supplement our expertise.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BCP Investment Corp

ticker: BCIC


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program, overseen by the Adviser's Global Head of Infrastructure & Cybersecurity ("GHIC"), which is designed to assess, identify, and manage material cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and other specialists as appropriate to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments. The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company takes steps to identify and oversee risks from cybersecurity threats associated with our use of such entities and the Chief Compliance Officer ("CCO") of the Company reviews cybersecurity-related reports provided by key service providers.


text: Board Oversight of Cybersecurity Risks The Board would be made aware of any material risks associated with cybersecurity threats. The Board currently receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser's GHIC. The Adviser's GHIC has extensive experience in managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since 2021 and has worked in the financial services industry for more than 15 years, during which the CCO has gained expertise in assessing and managing such risks applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Business Manager to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us and our Business Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us and our Business Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Business Manager and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Business Manager and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Business Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Business Manager's management, and our Board and Audit Committee, as appropriate.


text: Oversight of Cybersecurity Risks The board and our audit committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our board and/or our audit committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Business Manager and the measures we, and the Business Manager are taking to mitigate such risks. In addition to such reports and updates, our board and/or our audit committee receive updates from management as to changes to our and the Business Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the board or audit committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, General Risks" for more information regarding cybersecurity risks.


text: Risk Management and Strategy Talkspace recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats as a vital component to the success of our business. We have established policies and processes for assessing, identifying, and managing the material risk from cybersecurity threats which may include, among other things, operational risks; fraud; extortion; harm to our business, employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: Talkspace, Inc.

ticker: TALK


text: We routinely assess material risks from cybersecurity threats, which include unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing therein. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. We have adopted the HITRUST CSF Assurance Program for Cloud assessment to inform this risk assessment process. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.


text: As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk: • Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • Running simulated cybersecurity drills, which are performed both in-house and by the third-party service provider, including vulnerability scanning, penetration testing and disaster recovery exercises; • background checks prior to hire; • encryption of data at rest and in transit; • logging and event monitoring; • threat detection to monitor for malicious activity and anomalous behavior; • malware protection and restricting connections to malicious websites; • data loss protection mechanisms; • third party penetration testing; • cybersecurity risk assessments of our third-party vendors; • reviews by internal and external audit of the effectiveness of information security-related internal controls; • closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan, as effected by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.


text: We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide system-wide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers and we continually monitor cybersecurity threat risks identified through such diligence.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, and more frequently as relevant, the Audit Committee receives an overview from management covering topics such as security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters. Management or the Audit Committee will provide a comprehensive update to the Board on cybersecurity threats and risk mitigation generally at least annually, and more frequently as relevant.


text: The Company's information security and cybersecurity program is managed by our Chief Information Security Officer (CISO) and our Chief Technology Officer (CTO). The CISO and the Senior Director Information Security are responsible for our overall network security and assessing and managing cybersecurity risks and threats. The CISO has over 20 years of information security, privacy, auditing and compliance experience and holds numerous certifications. The Senior Director of Information Security has over 15 years of experience in information security, and holds numerous certifications. The CTO has over 20 years of experience and has been a leader of our Company's information systems and technological advancements for the past nine (9) years. The SVP of Engineering has over 20 years of experience in IT and has specialized knowledge in systems and network infrastructure. The Director of SRE and Security has eight (8) years of experience and has principal responsibility for our network operations and system administration.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to ensure the security of our information systems and networks and the confidentiality, availability, and integrity of our data.

companyName: Turtle Beach Corp

ticker: TBCH


text: Risk management and strategy Turtle Beach uses a risk-based approach to cybersecurity, utilizing industry-standard frameworks and methodologies to assess and manage risks. The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes have been integrated into the Company's overall risk management processes and include an incident response plan to assess and remediate cybersecurity attacks.


text: The incident response plan provides guidance in identifying, assessing, investigating, remediating, and reporting any confirmed or suspected: (i) compromise of physical, network or system security; (ii) unauthorized access or acquisition of personal information or proprietary information; or (iii) material noncompliance with Company information privacy and security policies and procedures. The plan and associated processes have flexibility to ensure a tailored response based on the circumstances of the incident.


text: From time to time, the Company engages third party experts to assess the Company's cybersecurity controls and processes. For example, in 2021, the Company engaged an information security consultant to conduct and external, design-focused assessment using the National Institute of Standards and Technology framework to evaluate the Company's cybersecurity controls. The Company's management used the assessment to assist them in evaluating the Company's cybersecurity controls, and its Company's policies and procedures to further align them with industry standards.


text: The Company also has processes to identify and oversee cybersecurity threats associated with its use of third-party service providers. These processes include diligence of third-party cybersecurity risk through SOC-2 audits and use of independent vendors who provide cybersecurity ratings. In addition, the Company maintains an insurance policy which specifically provides coverage for qualifying information security breaches.


text: The Company has not experienced a material information security breach in the last five years, nor has it incurred any expenses or penalties or paid any settlements related thereto. The Company is not currently facing any cybersecurity threats reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.


text: Cybersecurity is an important part of the Board's risk oversight. Although the full Board retains responsibility for cybersecurity oversight, the Audit Committee of the Board (the "Audit Committee") has authority to immediately assess and manage a cybersecurity incident if one were to occur. The Company's senior management briefs the Audit Committee and the Board periodically on cybersecurity matters and would promptly brief the Audit Committee if a cybersecurity incident occurred.


text: The Company's management has day-to-day responsibility for managing cybersecurity risks. The management team includes our Chief Financial Officer, who has cybersecurity expertise through prior leadership positions in networking and software businesses, and our Senior Director of Information Technology, who has formal data security training and certifications. In addition to using industry-standard tools to monitor cybersecurity risks, management receives direct reporting of cybersecurity threats from our employees, who are trained annually on cyber security risks and reporting.


text: Risk Management and Strategy We continue to make significant investments in our information technology systems pursuant to our operations. We believe that these investments, including additional technology changes to implement our strategic plan, are essential to enhance our overall customer experience, to support our compliance, internal controls and efficiency initiatives, to expand our capabilities to offer new products, and to provide scale for future growth and acquisitions. Our program ensures that we operate with greater efficiency.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: The Company is actively engaged in identifying and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. The Company has an enterprise-wide Information Security Program ("Security Program"), which is designed to protect the confidentiality, integrity and availability of customer non-public information. The Security Program was also designed to protect our operations and assets through a continuous and comprehensive cybersecurity detection, protection and prevention program. This program includes an information security governance structure and related policies and procedures, security controls, protocols governing data and systems, monitoring processes, and processes to ensure that the information security programs of third-party service providers are adequate. Our Security Program also continuously promotes cybersecurity awareness and culture across the organization.


text: The Company also has a business continuity/disaster recovery plan (the "BCP"), which it actively manages to prepare for any business continuity challenges it may face. Our BCP provides for the resiliency and recovery of our operations and services to our customers. The plan is supported and complemented by a robust business continuity governance framework, a life safety program as well as an enterprise-wide annual exercise and training to keep the program and strategies effective, scalable and understood by all employees. We believe both the Security Program and BCP adhere to industry best practices and are subject to periodic testing and independent audits.


text: Cybersecurity Risk In 2018, the United States Securities and Exchange Commission (the "SEC") published interpretive guidance to assist public companies in preparing disclosures about cybersecurity risks and incidents. These SEC guidelines, and any other regulatory guidance, are in addition to notification and disclosure requirements under state and federal laws and regulations. If we fail to observe this regulatory guidance or standards, we could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many states have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments where our customers are located.


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us.


text: The risks from cybersecurity threats are monitored and managed by the Company's information systems team members who have relevant expertise with such potential threats, and who operate in collaboration with other Company functions. The Company's Audit Committee is responsible for overseeing cybersecurity risk and are informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our vendors, partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach. The Company's cybersecurity standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: Risk Management and Strategy As one of the critical elements of the Company's overall risk management approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading below titled, "Governance", the Board's oversight of cybersecurity risk management is supported by the audit committee's regular interactions with the Company's Head of Information Technology, and other members of management or a subcommittee thereof. • Collaborative Approach: The Company has developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity managed detection and response. • Incident Response and Recovery Planning: The Company has developed a comprehensive incident response and recovery plan that addresses the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company has various controls relating to cybersecurity threats originating from third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with tools to address cybersecurity threats, and to communicate the Company's information technology policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures. The results of such assessments are reported to the audit committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments.


text: The audit committee of the Board oversees the Company's risk management program, including the management of risks arising from cybersecurity threats. The audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. When necessary, the Board receives prompt and timely information regarding any material cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a semi-annual basis, the audit committee of the Board discusses the Company's approach to cybersecurity risk management with the Company's Head of Information Technology.


text: The Company's Head of Information Technology, in coordination with the Board and audit committee, works collaboratively across the Company to implement and execute a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery approach. To facilitate the success of the Company's cybersecurity risk management program, the Company's Head of Information Technology and his team monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and, when necessary, report such threats and incidents to the Board. The Head of Information Technology has served in various roles in information technology and information security for over 20 years, including serving as the Head of Information Technology of another clinical-stage biopharmaceutical company. The Head of Information Technology holds undergraduate and graduate degrees in mathematics and computer information systems, respectively.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We also have a process for newly-hired employees to participate in security awareness training, and we conduct periodic phishing email simulations. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our Head of Information Technology ("IT"), with the support of our third-party information technology service providers and a team of IT professionals, is responsible for the strategic leadership and day-to-day management of our cybersecurity program. The individual serving as Head of IT has more than twenty-five years of experience in information technology and information security.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our Head of IT provides quarterly updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, and provides the Audit Committee with status updates on various projects intended to enhance the overall cybersecurity posture of the Company, as applicable.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including but not limited to cybersecurity assessors, consultants, and auditors to evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaborations with these third-parties includes regular audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all third-party providers before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Executive Director of IT, who oversees the Company's cybersecurity function. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Company's Board of Directors (the "Board"). This ensures that The Board has oversight and effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight The Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Executive Director of IT or the Chief Legal Officer as described below in "Management's Role Managing Risk."


text: Management's Role Managing Risk The Executive Director of IT and the Chief Legal Officer ("CLO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Executive Director of IT and the Associate Director of IT Infrastructure and Security. Our IT Leadership team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Executive Director of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Executive Director of IT, the Associate Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Executive Director of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Executive Director of IT, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues. See Item 1A "Risk Factors" – "Risks Related to Business Operations and Industry."


text: Management's Role Managing Risk Aveanna's cybersecurity program and related policies are managed by a dedicated Assistant Vice President ("AVP") of Cybersecurity who reports to our Chief Information Officer ("CIO"). The AVP of Cybersecurity and his team is responsible for assessing, identifying and managing enterprise-wide cybersecurity needs. The AVP of Cybersecurity and his team monitor breach attempts and other cyber-related incidents, both directed at the Company and those impacting other industry participants, to identify new and emerging risks to be added to our Vulnerability Management Framework, which is discussed below.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: The AVP of Cybersecurity works directly with the CIO to create and maintain cyber policies, standards, and processes that support the Company's overall strategy and the current cyber environment. We believe our cybersecurity program and policies are aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The AVP of Cybersecurity and CIO are experienced technology and cybersecurity professionals, with over 10 and 20 years of experience in information security and technology, respectively. The AVP of Cybersecurity leads periodic meetings of our chartered Cybersecurity Steering Committee, which cover key cyber threats, policy changes, and project updates. The Cybersecurity Steering Committee includes our CIO, other executive-level leaders, and key members of management. Further, the Cybersecurity Steering Committee engages an external expert to prepare a formalized evaluation on the design of, and adherence to, the Company's current cybersecurity policies.


text: Board of Directors Oversight The Audit Committee of the Board of Directors is tasked with providing oversight related to cybersecurity topics. At least quarterly, the Audit Committee receives a report of any cybersecurity incidents and other key monitoring metrics from a representative of the Cybersecurity Steering Committee. For each incident, the Audit Committee is briefed on the nature of the incident, points of vulnerability, scope of the incident, and the Company's response. The Audit Committee will then communicate cyber-related issues with the Board as needed. Our Board is currently reviewing our existing cybersecurity program and related policies, including, among other things, the Board's role within our cybersecurity risk management infrastructure.


text: Risk Management and Strategy Our cybersecurity management process is based on an internally developed Intelligence Policy and a Vulnerability Management Framework. Cybersecurity risk management is currently independent of enterprise risk management. Our Vulnerability Management Framework addresses discovery, risk rating, remediation timeliness required per risk, and obligations on reoccurring third-party security products. Risks that fall outside the required remediation timeline are documented on the risk register, which is discussed during periodic Cybersecurity Steering Committee meetings.


text: We have in place a Security and Privacy Incident Response Plan that specifies incident classifications, reporting requirements, and which person must respond to such incidents. In most cases, cybersecurity management is handled by employees of the Company as described above, though if an incident does occur, external counsel and experts related to impacted systems or data may be engaged to supplement the Company's response.


text: Existing third-party relationships are monitored on a risk-by-risk basis via the Vulnerability Management Framework. Before entering into new third-party provider agreements, third-party providers and related services are subject to scrutinization and a review from the AVP of Cybersecurity's team.


text: We are constantly evolving our cybersecurity strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats with respect to our information systems that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Failure to maintain the security and functionality of our information systems, or to defend against or otherwise prevent a cybersecurity attack or breach, could adversely affect our business, financial position, results of operations and liquidity" described under "Risk Factors" contained in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity risk management is an integral part of the Company's overall enterprise risk management framework. Our technology team, together with third-party information security experts, has designed our cybersecurity risk management program with industry best practices in mind and to provide a roadmap for handling cybersecurity threats and incidents, including threats and incidents associated with our use of third-party service providers, and facilitate cross-functional coordination within the Company. This roadmap includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: Specifically, our technology team relies on third-party information security experts for risk assessment, monitoring, and system enhancements. In addition, our technology team provides training to all employees periodically, on an ongoing basis.


text: Our audit committee of the board of directors is responsible for ensuring that management has processes in place designed to identify and evaluate risks, including cybersecurity risks, to which the company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our board of directors and/or our audit committee receive regular updates throughout the year on cybersecurity risks. At least annually, each of our board of directors and/or our audit committee receives reports on cybersecurity matters and related risk exposures from our Chief Technology Officer, or CTO. When covered during an audit committee meeting, the audit committee reports on its discussion of cybersecurity risks to the full board of directors.


text: Management, together with third-party information security service providers, is responsible for assessing material cybersecurity risks on an ongoing basis, ensuring processes are established to monitor and respond to such potential cybersecurity risks, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CTO, who receives reports from our third-party information security service providers and technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as well as resource levels, technology trends and third-party provider risks. Our CTO and technology team are experienced information systems security professionals and information security managers with many years of experience. Management, including the CTO and our technology team, periodically update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – General Risk Factors – Cyber risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition or results of operations." in this annual report on Form 10-K.


text: We place a high priority on securing confidential business information and the personal information we receive and store about our customers and employees. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, which we use, together with information collected from internal assessments, to develop policies for use of our information assets (for example, mobile phones and personal computers) and protection of personal information. We protect these information assets through techniques such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including restricting access to information based on business need. We utilize an established, nationally recognized cloud-services provider to maintain and manage our data with the exception of certain highly sensitive information, which we maintain in separate designated systems with enhanced security controls. In addition, we contract a third-party IT consultant with over twenty years of experience, who manages the core information technology functions of the business including coordinating with our cloud-services provider, implementing new processes, monitoring of our network for cyber threats, and other information technology administrative responsibilities. Throughout the year, we train our employees on cybersecurity awareness, confidential information protection and perform simulated phishing attacks. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have developed a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure and comply with applicable legal obligations. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. To date, we have not experienced a material cybersecurity or information security breach.

companyName: Heritage Global Inc.

ticker: HGBL


text: Oversight responsibility in this area is shared by management, the Board, and its Corporate Governance Committee. To prevent, detect and respond to information security threats more effectively, the Company has established a Management Cybersecurity Committee (MCC) consisting of the Chief Financial Officer, the Executive Vice President, General Counsel and Secretary, the Chief Marketing Officer, business unit leaders, the third-party IT consultant, and other internal and external IT resources. The MCC regularly reports to the Corporate Governance Committee, which in turn reports to the Audit Committee and the Board. The Board also receives an annual update from our senior leadership on cybersecurity and information security matters. The Corporate Governance Committee regularly briefs the Board on these matters, and the Board also receives periodic briefings on cyber threats to enhance our directors' awareness on cybersecurity and information security issues.


text: At its core, our cybersecurity program is the collection of people, processes and technologies that are designed to protect our networks, computers and data from attack, damage, or unauthorized access. The cybersecurity program is also part of a broader cybersecurity framework, which involves how we assess and manage cybersecurity threat risks and how this integrates into our overall risk management framework. While the foregoing summary is specific to our North America business operations we believe that the cybersecurity programs of our International business operations are consistent with the approach and framework outlined below and are appropriate for the scope and scale of their operations.

companyName: Zumiez Inc

ticker: ZUMZ


text: The Security and Compliance Team, within our IT department, takes the lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. The Security and Compliance Team is led by the Security and Compliance Program Manager and consists of a Lead Security Engineer and a Security Analyst. The Security and Compliance Team works very closely with our team across the IT department and with several different third parties who provide expertise in different areas such as threat hunting and penetration testing.


text: Objectives and Key Principles and Priorities The objective of the Security and Compliance Team is to build practices within the company to define, implement, enforce, and measure our security, compliance and disaster recovery readiness. In doing so, it utilizes some of the following key guiding principles and priorities: • Alignment. Working within the organization to clearly define the need for secure computing practices, gaining buy-in on this need and the development of a mindset across the organization around secure computing. • Measurement and Visibility. Developing measurement and reporting methods which inform our stakeholders both in the business as well as external audit and other outside entities as to compliance with various security frameworks and regulatory obligations. • Protection. Using a commonly accepted industry framework to build and ensure the enforcement of policies and procedures which secure the data and systems of all our stakeholders. • Response. Ensuring that that if a security incident occurs there is a clear and well understood response plan which is followed by all response participants. • Resources and Tools. Identifying the resources needed to run the cybersecurity program commensurate with the size and complexity of our company, including identifying and implementing appropriate tools and systems to help strengthen our security posture.


text: On a day-to-day basis and from a project perspective, the Security and Compliance Team undertakes the following activities: • Builds and reviews reports on newly identified security threats. • Monitors various internal security toolsets including EDR (Endpoint Detection and Response), email security and logging from company firewalls and other security related systems and takes action to prevent or resolve incidents identified by monitoring. • Ensures that appropriate vendor patches/configurations are applied to the various internal systems that operate to maintain a secure environment. • Works with various teams with the IT department to ensure that company servers and data are properly backed up and that compliance requirements and security best practices are following during new system implementations. • Deploys and tunes various security and monitoring platforms. • Manages the North America Annual PCI (Payment Card Industry) review and consults with Zumiez international entities regarding PCI. • Provides evidence gathering for, and conducts walk throughs with, internal and external audit teams for internal control over financial reporting related to Section 404 of the Sarbanes-Oxley Act of 2002 (SOX Controls). • Maintains a system of security policies and procedures within the IT department related to cybersecurity and compliance requirements, primarily related to PCI compliance and SOX Controls.


text: Framework for Cybersecurity Controls We have implemented risk-based controls to protect our networks, computers and data. To this end, we utilize the Center for Internet Security (CIS) version 8.0 framework, which is comprised of eighteen critical security controls. The CIS framework is based on the COSO (Committee of Sponsoring Organizations on the Treadway Commission) and NIST (National Institute of Standards and Technology) frameworks and provides a highly actionable way to implement those frameworks and maps directly to other compliance requirements relevant to us, including PCI compliance and SOX controls (briefly discussed above).


text: Use of Third Parties We work with a third party that provides us with threat hunting services via an Endpoint Detection and Response (EDR) platform. This team proactively searches for newly uncovered threats based on up-to-the-minute intelligence on the cybersecurity threat landscape and their knowledge of the Zumiez environment. Upon discovery of a potential threat, the threat hunting team provides initial remediation guidance.


text: We also conduct periodic penetration testing of our systems. This testing is performed by a qualified third-party testing company and is in alignment with our CIS controls. Penetration testing is meant to provide us with information on the security of a particular system or application. These findings then can be used by us to inform remediation work on a go-forward basis. Cybersecurity Insurance.


text: We maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for the following breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information and computer system security breaches: • Computer expert services (such as a cybersecurity firm to determine the existence and cause of an actual or suspected electronic data breach or a PCI forensic investigator in connection with investigations dealing with credit card data); • Legal services; • Notification services to provide notification to impacted individuals; • Call center services; • Breach resolution and mitigation services, including credit monitoring and identity theft monitoring; and • Public Relations and crisis management expenses.


text: Cybersecurity Incident Response Plan We have a Cybersecurity Incident Response Plan which is maintained by the Security and Compliance Team. The Incident Response Plan establishes what people and organizations need to be engaged in the event of a significant incident. The Incident Response Plan also provides templates for technical resolution, documentation and communication to internal stakeholders as well as insurers and governmental and other regulatory agencies.


text: We also manage cybersecurity risk by limiting our threat landscape. For example, as an omni-channel retailer, we accept credit and debit cards via all sales channels and protecting cardholder data is a critical component of our security practices. Accordingly, PCI compliance (discussed briefly above) is very important and we engage an external qualified assessor to audit our compliance and to provide us with a report on compliance that is also shared with various payment providers. To help reduce our exposure to unauthorized access of cardholder data, we have utilized a strategy of minimizing or eliminating the storage of, and unencrypted transmission of, cardholder information across our various systems.


text: Moreover, our businesses do not involve or represent national infrastructure, the likes of which are common targets of cyber attackers (e.g., energy, oil & gas, transportation, communications, banking and financial systems, etc.). We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority at Zumiez.


text: Like many companies, we face a number of cybersecurity risks in the day-to-day operation of our business. Although to date these risks have not materialized into any instances or series of instances that have had a material adverse effect on our business or otherwise caused material harm to the company, we have, on occasion, experienced cybersecurity threats to our data and information systems, including phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "If we fail to meet the requirements to adequately maintain the privacy and security of personal data and business information, we may be subject to adverse publicity, litigation and significant expenses" in Item 1A Risk Factors.


text: As discussed above, the Security and Compliance team takes a lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. This team is supported by our Zumiez North America Cybersecurity Team, which consists of the Security and Compliance Program Manager, the Director of Infrastructure IT, the Vice President of IT, the Chief Financial Officer and the Chief Legal Officer. Additional support and guidance are provided by the Zumiez North America IT Steering Committee, which consists of the Chief Financial Officer, Chief Legal Officer, the Executive Vice President of North American Consumer Teams, the Vice President of IT, the Director of Infrastructure IT and the Senior Program Manager of Digital Commerce. Together, the Zumiez North America Cybersecurity Team and the Zumiez North America IT Steering Committee provide guidance and oversight to the Security and Compliance Team in alignment with the company's overall risk management and oversight framework.


text: Members of management, including our Chief Legal Officer, regularly report on the company's cybersecurity matters to our board's Audit Committee. The Audit Committee has been assigned the responsibility for reviewing and discussing with management the company's major operational, legal and regulatory risks, including data security and privacy and the company's policies to identify and manage cybersecurity risks.


text: In order to inform the Audit Committee of the planning and execution of our cybersecurity program, several different reports are provided from management.


text: Annual Cybersecurity Plan. This plan is provided for the first quarter Audit Committee meeting and outlines the cybersecurity related strategic initiatives for the fiscal year. It outlines any new investments and projects and their alignment with the cybersecurity framework, as well as the expected timelines for the implementation of these activities.


text: Quarterly Cybersecurity Memos. At the 2nd, 3rd and 4thquarter Audit Committee meetings, an update memo is provided to the Audit Committee that details the progress against the Annual Cybersecurity Plan, any updates on PCI compliance and SOX compliance activities and any emerging threats. The memo also contains a summary of significant cybersecurity threats over the past quarter both within our ecosystem and outside our ecosystem and any impact (if any) they may have had upon the company.


text: Internal Audit Reports. Our internal audit function's reviews of our information security programs and controls are included in quarterly reports to the Audit Committee.


text: The cybersecurity program and related risks are also discussed with the full Board of Directors as part of the review and discussions around the topic of risk management and the risk oversight framework that generally take place at the 3rd quarter Board of Directors meeting.


text: Any potentially significant information security issues that arise during the year are discussed with management and captured in our disclosure controls and procedures and are discussed with our Audit Committee chair between board meetings as appropriate.


text: Risk management and strategy The Company has implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient data ("Information Systems and Data").

companyName: TerrAscend Corp.

ticker: TSNDF


text: The Company's cybersecurity function, led by our Chief Information Officer ("CIO") and Director of IT Operations, helps identify, assess, and manage the Company's cybersecurity threats and risks. The Company's CIO has over twenty-five years of technology leadership experience including infrastructure design and management, software development, system implementation, cybersecurity, and network design administration. The Company's CIO has proven success in data protection for systems and has supported a complex global public enterprise environment with operations in over 200 countries. The Company's Director of IT Operations has over ten years of experience developing and leading healthcare solutions and has led the development in web and infrastructure design, serverless architecture, database integrations, SMS, mass-email and mass phone notification solutions. The Company's Director of IT Operations has dealt directly with numerous cyber security threats, breaches, detection and containment activities and strategies under strict requirements and expectations for HIPAA covered entities. The Company's cybersecurity team works in partnership with our managed security service provider ("MSSP") and managed service provider ("MSP") to help identify, assess, and respond to risks from cybersecurity threats. The Company's Security Incident Response Team leverages a cybersecurity managed detection and response partner, which monitors certain of our endpoints, cloud infrastructure, and networks for irregular activity.


text: Depending on the environment and system, the Company implements and maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, monitoring and response services in certain environments and systems, system access controls for certain systems, an employee cybersecurity training program, asset management and recovery processes, penetration testing, dark web monitoring, monthly environment risk reviews, external threat intelligence reports, regular digital infrastructure scans, internally reported threats, and cybersecurity insurance.


text: The Company's assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is identified in the Company's risk register detailing certain known and potential risk items; the Company's IT operations department works with our MSSP/MSP vendor partners to review certain identified threats and our cybersecurity practices in an effort to prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact on our business; and our CIO regularly presents to senior management, the Board and Audit Committee to evaluate material risks relative to our overall business objectives.


text: The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats including, for example, managed cybersecurity service providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.


text: The Company uses third-party service providers to perform a variety of functions throughout our business, such as enterprise resource planning, point of sale, eCommerce, wholesale sales, and web hosting. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Our vendor management program includes completion of a cybersecurity questionnaire for certain vendors designed to help us evaluate the potential cybersecurity risks associated with our use of the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the risk factors under Item 1A. "Risk Factors" in this Annual Report, including "The Company (and the third parties upon which it relies) faces physical security risks, as well as risks related to its information technology systems, potential cyber-attacks, and security breaches.".


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Company's Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Company's cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, the CIO and the Director of IT Operations. The CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the security management department, CIO, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO") and others. The security management department, CIO, CFO, CEO, and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the Board for certain cybersecurity incidents.


text: The Board receives regular reports from the CIO concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. These reports also include materials related to certain cybersecurity trends we have identified, potential cybersecurity threats and risk, and proposed mitigation measures.