text: Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes.


text: Third-Party Risk Management. We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments.

companyName: Tectonic Financial, Inc.

ticker: TECTP

secItem: Item 1C


text: Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats.


text: This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.


text: While we maintain teams that specialize in cybersecurity and information technology, we also leverage third-party experts to provide objective feedback on our program and posture. These are accomplished via penetration tests, security posture assessments, and technology consulting. These independent evaluations help validate existing controls, identify potential focus areas, and aid in securely deploying technology in an increasingly complex environment.


text: Our Information Security Program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, the Bankers Electronic Crimes Taskforce Ransomware Self-Assessment Tool, and the Gramm-Leach-Bliley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Office of the Comptroller of the Currency to review our cybersecurity program and discuss the changing threat landscape.


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association, and the Texas Bankers Association. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget, and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities.


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies at least annually.


text: Additionally, the Technology Committee of our board of directors reviews our cyber security risk profile on at least an annual basis.


text: have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: TAITRON COMPONENTS INC

ticker: TAIT


text: elements of our cybersecurity risk management program include but are not limited to, risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment;


text: individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.


text: Our management team takes steps to stay informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Board considers cybersecurity risk as part of its risk oversight function and receives regular updates from the management team on our cybersecurity risks and in addition, management updates the Board where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Company does not have its own cybersecurity policy but relies on the policies and procedures of its Contract Research Organizations (CROs) and Software as a Service (SaaS) contractors that handle its data and software. We are committed to protecting the confidentiality, integrity, and availability of our information assets and complying with applicable laws and regulations regarding cybersecurity.

companyName: Mitesco, Inc.

ticker: MITI


text: Company faces various cybersecurity risks and threats that could potentially affect its operations, reputation, financial condition, and competitive position. These risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our data, systems, or networks; denial of service attacks; malware infections; phishing or social engineering attacks;


text: ransomware attacks; loss or theft of devices or media containing our data; human error or negligence; natural disasters; power outages; or sabotage. Our data and systems may also be subject to cybersecurity breaches or incidents at its CROs, vendors, partners, or other third parties that we interact with or rely on.


text: have not experienced any material cybersecurity breaches or incidents to date, but we cannot guarantee that we will not suffer any such breaches or incidents in the future. We may not be able to detect, prevent, or respond to all cybersecurity risks and threats in a timely or effective manner. We may also incur significant costs and liabilities as a result of any cybersecurity breaches or incidents, such as legal claims, regulatory fines, remediation expenses, reputational damage, loss of business opportunities, or competitive disadvantage.


text: We may also face litigation, investigations, or enforcement actions by governmental authorities, customers, shareholders, or other parties arising from any cybersecurity breaches or incidents.


text: Policies and Procedures The Company does not have its own cybersecurity policy, but it contracts with CROs that handle all of its data and software. Our CRO's data systems are 21 CFR 11 (Part 11) compliant, which means that they have implemented controls to ensure the reliability and integrity of electronic records and signatures. Our CRO also runs industry standard antivirus and antimalware software on their networks and has written procedures for cybersecurity management, incident response, backup and recovery, and employee training. We have reviewed the cybersecurity policies and procedures of our CRO and require them to report any cybersecurity breaches or incidents that may affect our data or systems.


text: of the software that we use is Commercial Off the Shelf Software (COTS) and Microsoft, Dropbox, and Google cloud services. We do not develop, modify, or customize any software for our own use. We rely on the cybersecurity measures and practices of our software and cloud service providers and update our software and systems regularly to address any known vulnerabilities or issues. We also limit the access and use of our software and cloud services to authorized personnel and encourage them to use strong passwords and multifactor authentication.


text: We do not store any sensitive or confidential data on our own devices or media but use password-protected cloud storage.


text: Company's management is responsible for overseeing and managing our cybersecurity risks and activities as part of its overall risk assessment portfolio. Our management regularly evaluates and reviews the Company's cybersecurity posture and performance and reports to the board of directors on any material cybersecurity matters or developments. Our management also coordinates with our CROs, vendors, partners, and other third parties to ensure that they comply with our cybersecurity expectations and requirements and to address any cybersecurity issues or concerns that may arise.


text: Company's board of directors is responsible for overseeing and approving our cybersecurity strategy and policies. Our board of directors receives updates from management on the Company's cybersecurity status and initiatives and provides guidance and feedback on the cybersecurity goals and objectives. Our board of directors also monitors the Company's cybersecurity risks and exposures and ensures that the company has adequate cybersecurity resources and capabilities to protect its data and systems.


text: Company's cybersecurity environment is led by our third-party information technology (IT) contractor, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. The IT contractor is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats.

companyName: Royale Energy, Inc.

ticker: ROYL


text: Company maintains a cybersecurity risk management program that establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems. The program includes general controls for managing changes in and access to the Company's IT environment, cybersecurity awareness and training to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident.


text: Company's IT contractor is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying cybersecurity threats and incidents and managing the material risks associated with the cybersecurity threats. The Company's IT contractor engages third-party vendors and cybersecurity consortiums periodically for cybersecurity-related guidance and certifications.


text: In the event of a cybersecurity incident, the Company's process calls for the IT contractor, our Chief Executive Officer and our Chief Financial Officer, to work to assess and respond to the incident and provide briefings to the Audit Committee of the Board of Directors.


text: Audit Committee is responsible for providing oversight over management's processes to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this risk management process provides visibility and oversight to allow the Board and executive leadership team to make timely, data-driven decisions ensuring that the Company, its employees, investors, and partners are adequately protected.


text: of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with third-party consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry standards and regulatory requirements. Key components of our cybersecurity risk management and strategy include:

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Risk assessments, including vulnerability scans and penetration testing to identify potential system weaknesses. These are performed internally and supported by third-party consultants; Alignment of our cybersecurity framework with industry standards;


text: Employee training and awareness: all employees receive mandatory regular cybersecurity training, with additional specialized sessions for high-risk roles. We also conduct simulated phishing exercises to enhance awareness and preparedness;


text: Continuous monitoring and threat detection: our IT security team uses advanced tools for real-time network and system monitoring, enabling rapid detection and response to potential threats;


text: Comprehensive cyber insurance coverage, including protection against social engineering fraud and other cyber incidents, to further mitigate potential financial losses.


text: We have previously experienced actual or attempted cyber-attacks on our information systems or networks; however, none of these incidents had a material impact on our operations or financial condition. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors on page 12.


text: The board of directors oversees the Company's practice for assessing, identifying and managing material risks from cybersecurity threats. The Audit Committee, consisting of all of the board's independent directors, with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.


text: The Company's VP of enterprise systems and applications leads the overall cybersecurity strategy and risk management program. This role oversees development and execution of risk assessments, implementation of security policies and procedures, regular cybersecurity training for our employees, and leadership of the IT security team and coordination with third-party consultants.


text: Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning. The VP and IT security team provide regular reports to senior management on the Company's identified vulnerabilities, progress on cybersecurity initiatives and remediation efforts, and details of ongoing incidents. Management notifies the board of directors when significant incidents occur and provides the Audit Committee with quarterly updates on the Company's cybersecurity practices.


text: Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assessed our cybersecurity risk based on the Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: assessments that are designed to help identify material cybersecurity risks to our critical systems and information. security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. awareness training of our employees, including our incident response personnel. cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Company's Chief Executive Officer and Chief Financial Officer, who oversee management's implementation of our cybersecurity risk management program and incident response plans.


text: management team and incident response team have overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants that conduct vulnerability scans on a quarterly basis per PCI DSS standards.


text: While cyber-attacks are common threats to all businesses, the Company did not experience a material cyber security incident in either fiscal year 2025 or 2024.


text: management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means. This may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: At IGC, we are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our company's information assets and the personal information of our employees, customers, and stakeholders.

companyName: IGC Pharma, Inc.

ticker: IGC


text: We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements. Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.


text: In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats, although there can be no assurance, that our cybersecurity program will prevent all incidents.


text: We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our company or our stakeholders.


text: During Fiscal year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these Governance


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Lead. Our IT Lead has 5 years of experience in roles that include oversight of cybersecurity risk management programs. In addition, the IT Lead is assisted by an external agency with about 15 years of expertise in cybersecurity.


text: Our IT Lead is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee will receive periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: believe cybersecurity is critical to our mission achievement to ensure uninterrupted business continuity, and enables us to deliver superior services while safeguarding our customers' sensitive information.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: cybersecurity risk management processes are integrated into our overall risk management strategy. As part of our risk management strategy, our cybersecurity framework encompasses the following key processes:


text: Risk-Based Controls for Information Systems: We maintain an Information Technology (IT) infrastructure with physical, administrative, and technical controls tailored to protect the confidentiality, integrity, and availability of our information and systems.


text: Incident Response Plan and Testing: We have an incident response plan supported by a dedicated team to address cybersecurity incidents. This includes vulnerability identification, initial assessment, and engagement of external experts as needed.


text: Initiatives: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at FEI. We also provide additional role-based training to employees based on customer requirements, regulatory obligations and industry risks as needed.


text: Third-Party Assessments: We engage cybersecurity firms to regularly evaluate our cybersecurity posture, helping identify and mitigate risks posed by evolving threats.


text: seek to continually strengthen our cybersecurity defenses through significant investments in resources and maintaining comprehensive cybersecurity insurance coverage. We maintain an insider threat detection program to proactively identify and mitigate both external rely on certain third-party service providers to assist us with the delivery of our products to our customers. A cybersecurity incident at a supplier or subcontractor could materially adversely impact us. Therefore, we evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: adherence to Defense Federal Acquisition Regulation Supplement (DFARS) and Cybersecurity Maturity Model Certification (CMMC) requirements ensures strict protection of Controlled Unclassified Information (CUI), mandated by the U.S. Department of Defense. These efforts underscore our commitment to maintaining the highest cybersecurity resilience standards and regulatory compliance.


text: a U.S. Government defense industry contractor, we have experienced cybersecurity attacks and may be subject to significant cybersecurity attacks in the future. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For additional information, see "Our business could be adversely impacted by significant cybersecurity attacks" in Item 1A. Risk Factors above.


text: full Board of Directors has overall responsibility for overseeing the cybersecurity processes of identifying and mitigating cybersecurity risks. The Board of Directors has not delegated this responsibility to any one Committee, as its structure and size allows for the entire Board of Directors to oversee this responsibility. Periodically, our management provides updates to the Board of Directors regarding our internal control program, including any significant changes to its IT infrastructure and/or cybersecurity program. Management also communicates directly with the Board of Directors to report any material risks from cybersecurity threats.


text: Chief Information Officer (CIO) leads our cybersecurity program and reports directly to our Chief Executive Officer. Our CIO is supported by our internal IT team that assists our CIO in the day-to-day management of the cybersecurity program, including the cybersecurity incident response plan, training initiatives and third-party assessments. Our CIO has over two decades of experience in various cybersecurity functions, including implementing stringent cybersecurity measures to protect sensitive information and meet established security standards, extensive work in IT governance and operations, network intrusion and critical systems protection, Enterprise Resource Planning (ERP) systems, and data analytics.


text: a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in " Item 1A. Risk Factors " of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for the Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in " Item 1A. Risk Factors " of this Annual Report.

companyName: BPGC Acquisition Corp.


text: in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: Digital Brand Media & Marketing Group, Inc.

ticker: DBMM


text: Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology. The Company has established controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company's Incident Response Plan (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity (including artificial intelligence-related) threats and incidents, including by assessing current threat intelligence, and conducting tabletop exercises and vulnerability and security testing. The Company has a process to report material results of such testing and assessments to the board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to conduct part of such testing, including hiring consultants and third parties to conduct our threat assessments and supplement the monitoring of such threats by utilizing online data tools. The Company identifies and oversees cybersecurity risks presented by third parties and their systems from a risk-based perspective. The Company also conducts cybersecurity training for employees (including mandatory training programs for system users).


text: of the Company's IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we obtain reports from our vendors handling sensitive data as to their efficacy and efficiency in managing cybersecurity issues and follow-up with them on any potential or actual issues. Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, the Company, and our service providers, may be unable to provide our products or services for the duration of the event and/or a time thereafter.


text: the pervasive and increasing threat from cyberattacks, the board and the audit committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company to mitigate and prevent cyberattacks. The audit committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the audit committee or the full board regularly on their assessment of the Company's cybersecurity program and risks, including artificial intelligence. Both the audit committee and the full board receive regular reports from senior management on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our board has risk management experience.


text: The Company maintains processes designed to identify, assess, and manage material risks from cybersecurity threats to its information systems. These processes are proportionate to the size and nature of the Company's operations and are integrated into the Company's overall risk management practices.

companyName: REST EZ Inc.

ticker: RTEZ


text: The Company's cybersecurity risk management activities include basic safeguards intended to protect its business information, customer data, and website operations, including access controls, routine monitoring of systems, and the use of third-party service providers for website hosting, e-commerce, and data storage.


text: The Company also considers cybersecurity risks associated with third-party vendors and service providers, including its online sales platforms and other external service providers.


text: The Company's Board of Directors has oversight responsibility for cybersecurity risks and receives information from management regarding cybersecurity matters as appropriate. Management is responsible for day-to-day cybersecurity risk management, including oversight of third-party service providers and responding to potential cybersecurity incidents.


text: the Company has not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company's business, results of operations, or financial condition.


text: As a smaller reporting company with limited business, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. As of the date of this report, we have not adopted an incident response plan as our only access to internet is the use of email account by large websites such as google and yahoo. Our business is managed by only one person, Mr. Umesh Patel, our Chief Executive Office, Chief Financial Officer and director and he is the person oversea our cybersecurity as well. We have a small board with three members including Mr. Patel, who will report and discuss the updates on cybersecurity matters, including material risks and threats to other two non-executive directors of the board.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of business information, result in litigation costs and negatively impact our reputation among customers and partners.


text: of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.


text: In the past two years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND 25 LLC


text: The Management Company's third-party advisor has performed cybersecurity risk assessments of its information technology security processes and implemented technologies to lessen risk. Using third party services, the Management Company monitors, scans, assesses, audits, and remediates identified vulnerabilities across its networks, as appropriate. Furthermore, recognizing that the Management Company's employees are an essential line of defense in cybersecurity, it requires employees to participate in training and testing programs through which it provides education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. The Management Company's policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: The Management Company's cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of its ongoing cybersecurity vulnerability management, and it endeavors to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to its networks and applications, along with detection of potential unusual activity within its networks or applications. Any potential cybersecurity incident is immediately reported to the President and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: The Audit Committee of the Board of Directors oversees the Management Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Entity's cyber risk management program, typically on an annual basis.


text: There have been no cybersecurity incidents which have materially affected the Management Company to date, including its business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect the Management Company, including its execution of business strategy, reputation, results of operations and/or financial condition.


text: We rely heavily on information technology systems to operate our business, including processing and monitoring a large number of transactions across markets and in multiple currencies. To date, we have not experienced a cybersecurity incident that we deemed to be material. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Cybersecurity and Technology Risks," which is incorporated by reference into this Item 1C.

companyName: PRA GROUP INC

ticker: PRAA


text: Risk Management and Strategy We have developed and implemented a comprehensive, written information security program predicated on industry best practices and applicable regulations that is comprised of administrative, physical, and technical safeguards. Through our information security program, we seek to assess, identify, monitor, mitigate, and manage cybersecurity threats and prevent the recurrence of said threats through preventative and remedial measures. Our information security program is integrated as part of our overall risk management system.


text: Our information security program is based on written risk assessments that identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of our information systems and information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of these systems. Our risk assessments are developed from industry best practices and include criteria for evaluating and categorizing identified security risks or threats based on the likelihood and potential impact of the threat. Our information security program continuously assesses the sufficiency of our safeguards to control potential risks. Additionally, as part of our risk assessment system, we regularly measure, analyze, and report security and risk metrics. We have invested and continue to invest in risk management measures in order to protect our information systems and information.


text: Our program also includes a comprehensive incident management process intended to promptly identify, evaluate, respond, remediate, and recover from cybersecurity incidents including the preparation, detection, analysis, communication, eradication, and containment of such incidents including those associated with third-party service providers. The identification, assessment and response functions related to information security are managed by an incident response team, which is responsible for maintaining and operationalizing our incident response plan.


text: To protect against the risk of cybersecurity threats associated with the use of third-party providers in support of our operations, we take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the information at use, requiring our service providers by contract to implement and maintain such safeguards, and periodically assessing our service providers based on the risk they present and the continued adequacy of their safeguards. In addition, we may engage third-party service providers to perform functions associated with our information security program and the assessment of security threats.


text: We regularly evaluate and adjust our information security procedures by integrating emerging technologies, revised frameworks and industry best practices. In addition, we require all employees to undertake mandatory annual training covering information security, social engineering, remote working, phishing and email security and digital threats, among others. Additionally, we maintain internal informational content consisting of educational material on cyber awareness on our Company portals and conduct ongoing simulated phishing exercises.


text: Role of the Board Our Board oversees the Company's enterprise risk management framework, including information security. The Board has delegated responsibility for overseeing enterprise risk to its Risk Committee, which is governed by a formal charter. Consistent with the Risk Committee Charter, management reports regularly to the Risk Committee on key risks to the Company, including cybersecurity risks. The Chief Information Officer ("CIO") and/or Chief Information Security Officer ("CISO") reports regularly to the Risk Committee on the overall status of and any recommended changes to the information security program, compliance with applicable regulations and material matters related to the program, including the annual risk assessment, risk management and control decisions, service provider arrangements, results of testing and information security-related events, if any, and management's responses to the same. After each Risk Committee meeting, the Risk Committee Chair reports to the Board of Directors on the matters reported on during the committee meeting.


text: Role of Management Our information security management team oversees the design, implementation, and maturation of security practices to protect critical business processes, information systems and information technology assets across our enterprise. Management is primarily responsible and accountable for the awareness, oversight and control of enterprise information security and the implementation of cybersecurity policies, procedures, and strategies. Our information security and risk assessment teams regularly communicate to management the effectiveness and efficiency of our information security program's risk management processes. Management reviews such assessments, reports any potential threats and vulnerabilities and responds accordingly, including by providing regularly scheduled reports and escalating items, as necessary, to the Disclosure Committee and the Board's Risk Committee.


text: Our information security management team is led by a global CIO, to whom the CISO and Chief Technology Officer report. The CIO, who reports directly to the CEO, has more than 30 years of experience in information technology and is responsible for information technology, information security, and business applications at a strategic level across the Company's global platform. Moreover, the CIO is also responsible for reporting any information security matters to the Disclosure Committee to support the Company's compliance with applicable disclosure obligations. Our CISO has held various positions in the information security field over the past 18 years including senior level positions across multiple industries with a focus on establishing and executing systems and security strategies to protect corporate data and improve regulatory compliance. The experience of our information security management spans various job practice analysis areas and is underpinned by relevant education and certifications as well as decades of in-field experience in areas such as information security program development, information security governance, risk management and information security incident management. As discussed above, management reports regularly to the Board on our information security program.


text: We rely heavily on IT systems to operate our business, including processing and monitoring a large number of transactions across different markets and multiple currencies. To date, we have not experienced a cybersecurity incident that we deemed to be material. For a discussion of whether and how risks from cybersecurity threats could materially and adversely affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors – "Operational and Industry Risks," which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy We have developed and implemented an information security program predicated on industry practices, frameworks and applicable regulations that are reinforced by policies, processes, procedures, standards, technologies and training designed to protect our IT systems, operations and sensitive business information with administrative, physical and technical safeguards. Through our information security program, we seek to assess, identify, monitor, mitigate and manage cybersecurity incidents and threats, and to prevent the occurrence of a cybersecurity incident through protective and detective technologies that measure and monitor our critical IT systems, which include among others, intrusion detection and protection, email security, endpoint security, third-party security monitoring and proactive security testing. Our information security program is integrated as part of our enterprise risk management framework.


text: We regularly conduct internal risk assessments to identify reasonably foreseeable security risks or threats and to evaluate and categorize those risks or threats based on the likelihood and potential impact to the security, confidentiality and integrity of our IT systems and sensitive business information. Our risk assessments are developed from industry best practices and frameworks, including external third-party maturity assessments. As part of our information security program, we regularly assess the sufficiency of our safeguards to control potential risks. As part of our risk assessment process, we regularly measure, analyze and report security and risk metrics and share those findings with the Board and senior management. We have invested and continue to invest in risk management measures in order to protect our IT systems, operations and sensitive business information.


text: To strengthen our cybersecurity readiness, we have developed a cybersecurity incident management process that incorporates the use of third-party IT resources. Our cybersecurity incident response plan is intended to promptly identify, evaluate, respond, remediate and recover from cybersecurity incidents through the preparation, detection, analysis, communication, eradication and containment of such incidents, including those associated with third-party service providers. The identification, assessment and response functions related to information security are managed by an internal incident response team, which is responsible for maintaining and operationalizing our incident response plan. Key components of our cybersecurity incident management process and response plan include root cause analysis when incidents occur, tabletop exercises and implementation of business continuity and disaster recovery plans.


text: To protect against the risk of cybersecurity threats, we evaluate new and existing third-party service providers through a risk assessment process designed to assess their capabilities for maintaining appropriate safeguards over the information provided to them. Where applicable, we require our third-party service providers, by contract, to implement and maintain such safeguards and periodically evaluate these providers and the continued adequacy of their safeguards based on the risk they present. In addition, we may engage third-party service providers to perform functions associated with our information security program and the assessment of security threats. The third-party risk assessments and reports are shared with internal teams and IT leadership to assist with ongoing risk mitigation actions.


text: We regularly evaluate and adjust our information security procedures by integrating emerging technologies, revised frameworks and industry best practices. We require employees to participate in periodic training covering information security-related topics, maintain informational content on our internal portals and conduct ongoing simulated phishing exercises.


text: Role of our Board of Directors Our Board of Directors oversees the Company's enterprise risk management framework, which includes information security. The Board has delegated responsibility for overseeing enterprise risk to its Risk Committee, which is governed by a formal charter. Consistent with the Risk Committee Charter, management reports regularly to the Risk Committee on key risks to the Company, including cybersecurity risks. Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") report regularly to the Risk Committee on the overall status of, and any recommended changes to, the information security program, compliance with applicable regulations and material matters related to the program. The Risk Committee Chair reports to the Board of Directors on matters discussed during Risk Committee meetings.


text: Role of management Led by our CIO and CISO, our information security management team oversees the design, implementation and evolution of our security practices to protect critical business processes, information systems and IT assets across our business. The information security management team is primarily responsible and accountable for the awareness, oversight and control of enterprise information security and the implementation of cybersecurity policies, procedures and strategies. Our information security management and risk assessment teams regularly communicate to senior management about the effectiveness and efficiency of our information security program's risk management processes. Senior management reviews such assessments, reports any potential threats and vulnerabilities and responds accordingly, including by providing regularly scheduled reports and escalating items, as necessary, to our Disclosure Committee and Risk Committee.


text: Our information security management team is led by a global CIO to whom the CISO reports. The CIO, who reports directly to the Chief Executive Officer ("CEO"), has more than 30 years of related experience and is responsible for IT, information security and business applications at a strategic level across our global platforms. Moreover, the CIO is also responsible for reporting any information security matters to our Disclosure Committee to support compliance with applicable disclosure obligations. Our CISO has held various positions in the information security field over the past 18 years, including senior level positions across multiple industries with a focus on establishing and executing systems and security strategies to protect corporate data and improve regulatory compliance. The experience of our information security management spans various job practice analysis areas and is underpinned by relevant education and certifications as well as decades of in-field experience in areas such as information security program development, information security governance, risk management and information security incident management.


text: Cybersecurity Risk Management Program Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Our cybersecurity risk management program is led by our global Chief Information Security Officer ("CISO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities through our information security office, which is responsible for the day-to-day identification, monitoring and management of cybersecurity risks. Our CISO reports directly to our global Chief Information Officer ("CIO"). Our CISO has significant experience in managing cybersecurity risks at major global companies in the pharmaceutical and defense industries. Our CISO regularly meets with the CIO to provide updates on cybersecurity matters. Our CIO updates our executive management on a regular basis to share cybersecurity related matters and discuss strategies to proactively manage cybersecurity threats. Our CISO and CIO brief our Audit Committee on our cybersecurity and risk management programs.


text: Our information security office is supported by a team consisting of personnel with experience and expertise in cybersecurity risk management strategies, execution and operations, with domain expertise in cloud services security, infrastructure and operational technology security, cybersecurity incident response, and tactical governance risk compliance.


text: Our CISO and CIO are also members of our information and security governance group, led by our CIO, which is comprised of executive and senior leadership from a variety of functions, including information security, corporate security, legal, finance, human resources, internal audit and compliance, as well as members of Teva's global situation room ("GSR"). Additionally, our CISO, CIO and other members of our information security office may, from time to time, consult and coordinate with other Teva departments and members of management to manage cybersecurity risks and implement cybersecurity incident responses.


text: In addition, management has worked, and expects to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. Management also conducts periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it complies with and meets current ISO 27001 standards. In early 2024, our management team performed an exercise tabletop relating to potential cybersecurity risks.


text: As part of its overall risk oversight function, our Audit Committee, which is comprised entirely of independent directors, considers cybersecurity risks in connection with overseeing our overall enterprise risk management system. Management, including our CISO and CIO, provide updates on our cybersecurity risk management program and cybersecurity matters to the Audit Committee, and also reports to the Board of Directors as necessary. During 2023, the Board received dedicated cybersecurity training and performed an exercise tabletop relating to potential cybersecurity risks. As part of our cybersecurity risk management program, we maintain industry standard procedures and policies, which are reviewed and revised frequently, and certified to comply with ISO 27001 standards, to both proactively assess, identify and manage potential cybersecurity risks and respond to any actual cybersecurity threats and incidents. Such procedures and policies include: actively monitoring our information technology systems to ensure compliance with applicable legal and regulatory requirements; engaging third-party consultants and other service providers to monitor and, as appropriate, respond to cybersecurity risks; requiring our service providers and our business partners who connect directly to our information technology systems, to comply with our cybersecurity standards, due diligence processes and be subject to our non-disclosure and other confidentiality agreements that include cybersecurity-related terms; providing and analyzing specialized industry sector intelligence on cybersecurity threats; regularly testing our cybersecurity systems and disaster preparedness, including our back-up information technology systems; developing and updating incident response plans to address potential cybersecurity threats; and maintaining and training our personnel on cybersecurity incident reporting procedures.


text: Cyber Threats and Incident Response In the ordinary course of our business, we collect and store confidential data, including intellectual property, proprietary business information and personally identifiable information (including of our employees, customers, suppliers and business partners). We rely extensively on information technology systems, including some systems that are managed by third-party service providers, to securely process, store and transmit such confidential data in order to conduct our business. These systems include programs and processes relating to internal and external communications, ordering and managing materials from suppliers, collecting, processing and storing data produced by our clinical trials and other research and development initiatives, converting materials to finished products, shipping products to customers, processing transactions, processing payments to employees and vendors, calculating sales receivables, generating our financial results for each reporting period, summarizing and reporting results of operations, and complying with information technology security compliance and other regulatory, legal or tax requirements.


text: We have not been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, our systems and networks have been, and are expected to continue to be, the target of increasingly advanced and evolving cyber-attacks and cybersecurity incidents in the future may adversely impact our business, financial condition and results of operations, and we are continuing to actively monitor such threats. For more information, see "Item 1A, Risk Factors—Risks related to our general business and operations—Significant disruptions of our information technology systems could adversely affect our business" and "Item 1A, Risk Factors—Risks related to our general business and operations—A data security breach could adversely affect our business and reputation."


text: In the event that we experience a cybersecurity incident, we have a cybersecurity incident response playbook that sets forth the applicable processes, roles, engagements, escalations and notifications to be executed in order to promptly respond to such threats. Depending on its nature and scale, a cybersecurity threat may be managed within our information security office, escalated to our CISO and CIO, or escalated to our management, and Board of Directors and Audit Committee, as appropriate. In certain instances, our GSR may be initiated and will collectively manage Teva's response to a crisis on a corporate level. The GSR is comprised of members from our various business units and regions, including senior leadership from a variety of functions, such as information security, legal, finance, human resources, communications and compliance.


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: Risk Management and Strategy City Office REIT recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: City Office REIT, Inc.


text: The Company has integrated cybersecurity risk management into our overall risk assessment framework to identify, evaluate and manage cybersecurity threats and risks. Our CFO works closely with our IT service provider and internal auditors to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with internal auditors and a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our systems and security processes. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes reviews of cybersecurity-related processes and controls in line with current international cybersecurity standards to evaluate the maturity and risks of our current cybersecurity program and consults on security enhancements. The Company further collaborates with these third-parties to conduct threat assessments, penetration testing and social engineering testing to assess the Company's systems, applications and personnel education and awareness regarding cybersecurity threats. As we are aware of the risks associated with third-party service providers, the Company maintains ongoing monitoring to ensure compliance with our service level requirements.


text: As of the date of this filing, we do not believe that our Company, including our business strategy, results of operations, or financial condition, have been materially affected by any cybersecurity incidents for the reporting period covered by this Annual Report on Form 10-K.


text: While we have not experienced any material cybersecurity threats or incidents to our knowledge in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems."


text: The Board of Directors and Audit Committee are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee is composed of Board members with diverse expertise, including in risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.


text: The CFO and CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The CFO, in his capacity, regularly informs the CEO of all aspects related to cybersecurity risks and incidents ensuring the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. They provide briefings to the Audit Committee as needed, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: While we have not had any material cybersecurity breaches to our knowledge in recent years, the CFO is continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The CFO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and system audits as needed to identify potential vulnerabilities. In the event of a cybersecurity incident, the CFO is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risk Management and Strategy We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We regularly conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. As part of our overall cybersecurity program, we engage specialized third-party vendors for certain cybersecurity functions including, but not limited to, incident response, penetration testing, and security operations center monitoring of our information technology environment. Identified risks are documented and communicated to the relevant stakeholders. Upon identification and assessment of risks, we develop and implement what we believe are appropriate measures to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures to mitigate cybersecurity risks and continuously test our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall enterprise risk assessment process.

companyName: WATSCO INC

ticker: WSO


text: A dedicated management team at our corporate headquarters, which is led by our Director of Data Security ("DDS") and composed of the Chief Technology Officer ("CTO") and representatives from risk management, legal, internal audit, and finance departments, is responsible for assessing and managing our cybersecurity risks and data protection practices. The Audit Committee oversees the measures taken by this management team to monitor material risks associated with cybersecurity threats, a role crucial to maintaining a robust and effective cybersecurity risk management approach. The DDS and CTO provide formal briefings to the Audit Committee on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, and other areas of importance at least once a year, with the Board of Directors receiving updates periodically. Regular discussions on enterprise risks are held between the Audit Committee, Board of Directors, and senior management.


text: Our DDS has more than 20 years of expertise in the information technology sector, with 10 years specifically dedicated to cybersecurity. This experience has fostered a thorough comprehension of cyber threat landscapes, defense strategies, and security technologies.


text: The Company recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or the independent commission sales agents and third party capacity providers in our network; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals' risk identification and assessment.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: Landstar maintains an Incident Response Plan that guides the actions the Company is to take in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage. We also maintain a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents that may significantly impact our operations. Our cybersecurity risk management processes incorporate appropriate industry standards and are designed using the frameworks developed by National Institute of Standards and Technology ("NIST") as a guide.


text: Our enterprise risk management program reports at least quarterly to the Management Risk Committee and considers cybersecurity threat risks alongside other types of risks as part of our overall risk assessment process. The Management Risk Committee consists of those members of executive management of the Company with ultimate responsibility for the Company's enterprise risk management practices. Members of the Management Risk Committee regularly engage in discussions and meetings relating to cybersecurity risk management and strategy processes and the prevention, detection, mitigation and remediation of cybersecurity incidents. Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. Our cybersecurity risk management and strategy processes are led by the Chief Information Officer, who is a member of the Management Risk Committee, and the Vice President of Network Services.


text: In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise. The Vice President of Network Services has over 26 years of experience in various roles with the Company as well as with the U.S. Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), Certified Cyber Security Architect (CCSA), EC-Council Certified Ethical Hacker (CEH), GIAC Certified Forensic Examiner (GCFE), SANS Digital Forensics And Incident Response (FOR408), CompTIA Certified PenTest+, Cisco Certified Network Associate (CCNA), and CompTIA Certified Security+.


text: The Company also regularly engages with consultants, auditors, and other third parties, including by having an independent third-party Qualified Security Assessor review our cybersecurity program twice each year to help identify areas for continued focus and enhancement. These third parties analyze data on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity controls, systems and processes.


text: Our cybersecurity risk management processes also address risks associated with our use of third-party service providers, including those who have access to our employee data or our systems that support customers and our network of independent commission sales agents and third party capacity providers. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threats identified through such diligence. Additionally, we may require certain third parties to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: During the period covered by this Annual Report, the Company has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Disruptions or failures in the Company's computer systems; cyber and other information security incidents" included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats. At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receives an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services. These sessions typically cover topics such as data security posture, results from third-party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, internal controls over financial reporting and business continuity planning.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Screaming Eagle Acquisition Corp.


text: We have identified information technology and cybersecurity risk as some of the most significant risk types to our business. Related to these identified risk types, we have classified our top risks and report these risks to both senior management and the risk committee of Genworth Financial's Board of Directors. For additional information regarding the risks associated with these matters, see "Item 1A—Risk Factors."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Genworth's risk management framework recognizes the significant operational risk, including risk of losses, from cyber incidents and the importance of a strong cybersecurity program for effective risk management. As part of our risk management, we have implemented a Data Security and Cybersecurity Program (the "DSCP") which sets policy expectations, ensures broad coverage over information technology risks, integrates the Information Security and Information Technology Risk Management Framework into our broader risk management systems, establishes clear roles and governance, and aligns control expectations to the National Institute of Standards and Technology ("NIST"). Under the DSCP, we have processes for identifying, assessing and managing technology and cybersecurity risk. The DSCP employs various controls and policies to secure our operations and information, which include monitoring, reporting, managing and remediating cybersecurity threats. Key features of the DSCP include access controls, security training, system security testing, dedicated security personnel, security event monitoring, and when necessary, consultation with third-party data security experts. Through a cross-functional team, we assess and mitigate risks associated with our third-party providers and have processes in place to regularly monitor and evaluate cybersecurity risks and threats associated with the use of third-party providers. Our information security team, overseen by our Chief Information Security Officer ("CISO"), conducts annual information security awareness training for employees involved in our systems and processes that handle customer data. We have conducted cybersecurity awareness training with management, including a tabletop exercise to simulate a response to a cybersecurity incident, and used these findings to improve our processes and technologies. In addition, the DSCP includes an incident response plan, which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to assess the materiality of the incident, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal reporting and other obligations and mitigate reputational damage. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Additionally, we have procedures set forth in the DSCP for reporting and responding to potential security incidents as well as determining applicable disclosure requirements, including timely incident reporting. For example, as disclosed in our Form 8-K filed on June 22, 2023, we were notified by PBI, a third-party vendor, that PBI was subject to the widely reported security events involving the MOVEit file transfer system, which PBI uses in the performance of its services. The MOVEit Cybersecurity Incident resulted in the unauthorized acquisition of data by a third party from PBI as well as several organizations and governmental agencies. After being notified of the security event, we, together with PBI, promptly launched an investigation to determine whether and to what extent personal information had been unlawfully accessed. Approximately 2.5 to 2.7 million of our policyholders' or other customers' personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the MOVEit Cybersecurity Incident. We believe that the MOVEit Cybersecurity Incident has not had any impact on any of our information systems, including our financial systems, and that there has not been any material interruption of our business operations. While we are continuing to measure the impact, including certain remediation expenses and other potential liabilities, we do not currently believe this incident or other known risks from cybersecurity threats are reasonably likely to have a material adverse effect on our business, results of operations or financial condition. See "Item 1A—Risk Factors—Our computer systems and those of our third-party service providers have in the past and may in the future fail or be compromised, including through cybersecurity breaches; we may experience issues from new and complex information technology methodologies such as artificial intelligence; and unanticipated problems could materially adversely impact our disaster recovery systems and business continuity plans, any of which could damage our reputation, impair our ability to conduct business effectively, result in enforcement action or litigation, and materially adversely affect our business, financial condition and results of operations."


text: Our Board of Directors recognizes the importance of maintaining the privacy and security of customer information, as well as the availability of our systems, and consequently dedicates meaningful time and attention to oversight of cybersecurity risk. In light of these risks, our Board of Directors is actively engaged in the oversight of the Company's information technology, which includes periodic briefings on cybersecurity threats and participation in cybersecurity preparedness exercises. Furthermore, under its charter, the Board's risk committee has primary responsibility for cybersecurity oversight. In this capacity, the risk committee oversees the Company's processes for identifying, assessing and managing technology and cybersecurity risk. In connection with the MOVEit Cybersecurity Incident, the risk committee was immediately notified by management and regularly briefed on the matter, and worked with management, including Genworth's CISO and Chief Risk Officer ("CRO"), to assess and manage the risk and implement the Company's response to the incident.


text: Genworth's CISO and CRO, both members of management, support the cybersecurity risk oversight responsibilities of the Board and the risk committee and involve applicable management personnel in cybersecurity risk management. The risk committee receives periodic reports from the CISO and CRO on the Company's technology and cybersecurity risk profiles, information security program and key cybersecurity initiatives. Additionally, the CISO and CRO follow a risk-based escalation process to notify the risk committee outside of the regular reporting cycle when they identify potential substantive cybersecurity risks or issues.


text: Genworth's CISO is an information technology and security professional with 23 years of experience and 11 years of service at Genworth. In his 23 years of experience, he has held roles in information technology infrastructure administration, information technology infrastructure, security consulting and security administration. He received a Bachelor of Science Degree in Business Administration from Regent University and is a Certified Information Systems Security Professional (CISSP).


text: Genworth's CRO has served in information technology and risk management leadership roles for over twenty years, including oversight of enterprise risk management and operational risk, as well as oversight for financial reporting systems, operational and technology platforms, and testing and quality assurance programs. He received a Bachelor of Science Degree in Decision Support Systems from Virginia Polytechnic Institute (Virginia Tech) and graduated from the Tuck Global Executive Leadership Program through Dartmouth in 2020. For more information about our CRO, see "Part III—Item 10—Directors, Executive Officers and Corporate Governance."


text: The Trust does not have a board of directors, so the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee's cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See " Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors."


text: Management Committee ("RMC"), which is responsible for the oversight of the Corporation's overall risk framework, and assists the Board in the monitoring, review and approval of the policies that measure, limit and manage the Corporation's risks, including cybersecurity risk. The RMC holds periodic meetings in which management provides overview of Popular's cybersecurity threat risk management incident status.

companyName: POPULAR, INC.

ticker: BPOP


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Trust, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Trust does not have any directors, officers, or employees. The Sponsor, an indirect, wholly owned subsidiary of The Goldman Sachs Group, Inc. ("Goldman Sachs) and an affiliate of Goldman Sachs & Co. LLC, generally oversees the performance of the Trustee and the Trust's principal service providers. The Trustee in turn is generally responsible for the day-to-day administration of the Trust. The Sponsor and the Trust rely on Goldman Sachs' cybersecurity policy, which also applies to the Trust. The Sponsor and the Trust also rely on the systems of GS Group Inc., its third-party service providers, and the Trust's service providers.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within Engineering, and overseen by Goldman Sachs' chief information officer. This program is designed to identify, assess, document, and mitigate threats, establish, and evaluate compliance with information security mandates, adopt and apply the security control framework, and prevent, detect, and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: Training and education, to enable Goldman Sachs' people to recognize information and cybersecurity concerns and respond accordingly; Identity and access management, including entitlement management and production access; Application and software security, including software change management, open source software, and backup and restoration;


text: Infrastructure security, including monitoring Goldman Sachs' network for known vulnerabilities and signs of unauthorized attempts to access the firm's data and systems; Mobile security, including mobile applications; Data security, including cryptography and encryption, database security, data erasure and media disposal; Cloud computing, including governance and security of cloud applications, and software-as-a-service data; Onboarding;


text: Technology operations, including change management, incident management, capacity and resilience; and Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency on vendor assessments.


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Trust). Information security risk management is built into the vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.


text: Cyber Risk Governance GS Group Inc.'s board of directors (the "GS Board") provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The GS Board, both directly and through its committees, including its Risk and Audit Committees, receives periodic reports and updates from an officer of Goldman Sachs regarding the overall state of the cybersecurity program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


text: The chief risk officer, chief information officer and chief technology officer of Goldman Sachs among others, periodically brief the GS Board on operational and technology risks, including cybersecurity risks. The GS Board also receives regular briefings from the chief information security officer of Goldman Sachs ("CISO") on a range of cybersecurity-related topics, including the status of the Cybersecurity Program, emerging cybersecurity threats, mitigation strategies and related regulatory engagements. In addition, these are topics on which various directors maintain an ongoing dialogue with the CISO, chief information officer, and chief technology officer.


text: The CISO is responsible for managing and implementing the Cybersecurity Program and reports directly to the chief information officer. The CISO oversees the Technology Risk team, which assesses and manages material risks from cybersecurity threats, sets firmwide control requirements, assesses adherence to controls, and oversees incident detection and response.