text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We may collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information, and employee information. Our ability to manage our business functions efficiently and effectively depends significantly on the availability and security of this information. We seek to assess, identify, and manage cybersecurity risks through the processes described below: Risk Assessment

companyName: Enviva, LLC


text: A multi-layered approach and methodology designed to protect and monitor data and manage cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors who specialize in application and network penetration testing, threat emulation, social engineering, and best practice gap assessments. Our IT Risk and Cyber Security department conducts regular audits and assessments to identify, evaluate, and manage cybersecurity risks. As a result of these assessments and audits, we endeavor to update IT infrastructure, technical controls, procedures, policies, and education programs to improve resilience to cybersecurity threats.

secItem: Item 1C


text: Additionally, we assess third-party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable.


text: Incident Identification and Response A cyber incident detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any cybersecurity incident, we have a cross-functional incident response plan that is designed to provide for escalating actions to identify the cause, contain the incident, mitigate the impact, and efficiently restore normal operations. The incident response plan is reviewed annually, and a tabletop exercise testing the incident response plan is periodically conducted.


text: Cybersecurity Training and Awareness We require all employees with access to our systems to complete an annual information and cyber security training and conduct simulated phishing campaigns to measure the effectiveness of the training program.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication requirement has been implemented for employees and third parties accessing sensitive company information.


text: Encryption and Data Protection Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.


text: We engage third-party vendors, such as independent service auditors, consultants, regulatory auditors, law firms, forensic specialists, and other third-party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. Additionally, we endeavor to include cybersecurity requirements in our contracts with service and solution providers and to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management processes. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management processes.


text: Impact of Risks from Cybersecurity Threats We have experienced attempted cybersecurity attacks, but have not suffered any material adverse impacts to our business and operations as a result of such unsuccessful attempts. However, we acknowledge that cybersecurity attacks are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A – "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight and Management's Role Our Vice President, Information Technology oversees the Company's cybersecurity initiatives. The head of the IT Risk & Cyber Security delivers quarterly updates to senior leaders, discussing the effectiveness of our cybersecurity strategy and to communicate our program, health, performance, metrics, and roadmap. In addition, our Vice President, Information Technology is responsible for upward reporting of emerging cybersecurity incidents.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our Cyber Security team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our Cyber Security team is made up of highly experienced professionals with an extensive background in information security and risk management, including disciplines such as security architecture, system security, identity and access management, communication and network security, security operations and software development security. This background includes experience across a variety of industries and various relevant degrees and certifications. The Cyber Security team is supported by managed service providers who bring diverse expertise in areas such as network security, data protection, and threat intelligence.


text: Virtu has established a Global Security team that, together with the Company's Chief Information Security Officer ("CISO"), is responsible for the strategic planning, execution, and enforcement of security initiatives and policies for the Company's business units (the "Security Program"). The CISO reports directly to the Chief Executive Officer, and together with the Global Security team, possesses significant experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. As part of its Security Program, the Company has developed policies and procedures governing cybersecurity (the "Cybersecurity Program").

companyName: Virtu Financial, Inc.

ticker: VIRT


text: Virtu's Cybersecurity Program is driven by a threat analysis, laying out standards and requirements pertaining to, but not limited to, penetration testing, endpoint protection, incident management, access controls, mobile security, data classification, third-party access, encryption, system hardening and patching, vulnerability management, passwords, data destruction, physical security, and vendor risk assessment. We also conduct training and awareness exercises to mitigate employee-related cyber risks. In addition to these elements of the Cybersecurity Program aimed at mitigating risk, the Company has developed an Incident Management procedure that addresses escalation and reporting of security incidents in the event that they do occur and has conducted various cross-functional table top exercises to develop and refine a coordinated response plan. The Company also maintains insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber-related incidents. These processes are intended to identify and remediate cybersecurity incidents, and also provide the framework for our proactive identification, assessment, and management of potentially material risks from a wide range of cybersecurity threats. Risks identified through these processes are identified to and evaluated by our CISO, who periodically reports to our Board and Risk Committee as described below on any such risks determined by the Global Security team to be potentially material.


text: Our Cybersecurity Program is periodically evaluated by internal and external experts through penetration and vulnerability testing and other exercises which help us identify and assess material risks, evaluate the effectiveness of our Security Program in mitigating and managing these risks, and improve our security measures and planning, including by comparison to other companies and to industry standards. The results of these assessments are reviewed by our CISO and other members of management and are shared with the Risk Committee of our Board of Directors (the "Risk Committee").


text: Our Risk Committee assists our Board of Directors (the "Board") in its oversight of cybersecurity risk in accordance with its charter. The Risk Committee receives at least annually, and the Board receives periodically reports from our CISO and other members of senior management, which include updates on the Company's cyber risks and threats, its Cybersecurity Program, the status of projects to augment our information security systems, assessments of the Security Program, and the emerging threat landscape.


text: We face a number of cybersecurity risks in connection with our business. Although we maintain and enforce our Cybersecurity Program, we may not detect or prevent all attempts to compromise our systems or otherwise cause breaches or disruptions, which could result in material impacts to our operations or financial condition. As of the date of the filing of this Annual Report on Form 10-K, we are not aware of any material impact to our results of operations or financial conditions resulting from cyberattacks or other information security breaches. For more information about the cybersecurity risks we face, see the risk factor entitled "We could be the target of a significant cyber-attack, threat or incident that impairs internal systems, results in adverse consequences to information our system process, store or transmit or causes reputation or monetary damages as a consequence" in Item 1A- Risk Factors.


text: Our Risk Committee assists our Board of Directors (the "Board") in its oversight of cybersecurity risk in accordance with its charter. The Risk Committee receives at least annually, and the Board receives periodically, reports from our CISO and other members of senior management, which include updates on the Company's cyber risks and threats, its Cybersecurity Program, the status of projects to augment our information security systems, assessments of the Security Program, and the emerging threat landscape.


text: We face a number of cybersecurity risks in connection with our business. Although we maintain and enforce our Cybersecurity Program, we may not detect or prevent all attempts to compromise our systems or otherwise cause breaches or disruptions, which could result in material impacts to our operations or financial condition. As of the date of the filing of this Annual Report on Form 10-K, we are not aware of any material impact to our results of operations or financial conditions resulting from cyberattacks or other information security breaches. For more information about the cybersecurity risks we face, see the risk factor entitled "We could be the target of a significant cyber-attack, threat or incident that impairs internal systems, results in adverse consequences to information our system process, store or transmit or causes reputation or monetary damages as a consequence" in Item 1A - Risk Factors.


text: The Company has procedures and safeguards designed to detect and/or prevent unauthorized access to confidential information and defend against cyber-attacks, both internally and with the assistance and partnership of cybersecurity experts, with a view toward addressing the ever-evolving threat landscape and changing cybersecurity regulations. As part of its role in risk oversight, the Audit & Finance Committee of the Company's Board (Audit & Finance Committee) reviews the Company's program for managing information security risks, including data privacy and data protection. Our cybersecurity framework, which is based on the National Institute of Standards and Technology Cybersecurity Framework, includes risks and controls embedded into our processes and technology, and measured and monitored by cybersecurity subject matter specialists. All employees and contractors with access to our Company's systems must also complete mandatory comprehensive cybersecurity trainings periodically and participate in simulations which are deployed to educate and prepare users for cyber-attacks and similar risks.

companyName: Endo International plc


text: Under the direction of the Chief Information Officer (CIO), who reports to the Company's Chief Executive Officer, and Chief Information Security Officer (CISO), who reports to the CIO, as well as certain other cybersecurity focused team members (the IT Security team), the IT Security team is responsible for addressing the dynamic threats against our electronic systems and assisting the workforce with handling system incidents, including by centralizing the reporting, detection and response to incidents to one functional team. The CIO and CISO have multiple decades of relevant IT experience. Incident management and response processes establish the recommended organization, actions and procedures needed to recognize and respond to an incident; assess the situation quickly and effectively; notify the appropriate individuals and organizations about the incident; organize the Company's response activities, including activating a command center; escalate the Company's response efforts based on the severity of the incident; and support the business recovery efforts being made in the aftermath of the incident. Additionally, third-party security experts are regularly engaged to monitor, assess, review and analyze the information technology landscape. The Company's incident response framework also defines the roles with respect to cybersecurity risk oversight and assigns responsibility to the IT Security Team. The IT Security team members have: (i) completed extensive cybersecurity training; (ii) have experience assessing cybersecurity incidents; (iii) actively participate in industry and government forums; and iv) collaborate with our peers to understand and improve cybersecurity intelligence, vulnerability management and defense strategies.


text: Our internal audit team performs audits of our information systems and network security. The audit scope, timing and frequency of our cybersecurity control framework is integrated into the Company's overall risk management process and the planning for, and results of, those audits are reviewed with the Audit and Finance Committee.


text: We regularly assess and monitor our cybersecurity risks and incidents and report them to our senior management and Audit and Finance Committee. Our Audit and Finance Committee oversees our cybersecurity strategy and governance and reviews our cybersecurity policies and practices on a periodic basis. Additionally, and as further discussed above, the Audit and Finance Committee is briefed multiple times a year or as needed by the CISO and/or CIO and, if applicable as determined by the Company's senior leadership, external advisors on the current and emerging cybersecurity threats and trends and the effectiveness of our cybersecurity controls and response capabilities.


text: We conduct due diligence security assessments of certain third-party providers before engagement, have contractual rights to and gather data on the effectiveness of vendor systems and protocols and monitor compliance with our cybersecurity standards. The monitoring includes periodic assessments and ongoing monitoring by the IT Security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect the Company. Refer to "Our operations could be disrupted if our information systems fail or are not upgraded or are subject to cyber-attacks" in Part I, Item 1A of this report for additional information on risks from cybersecurity threats.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: American Strategic Investment Co.

ticker: NYC


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct periodic data handling and use requirement training for our employees; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • Conduct regular phishing email simulations for all employees Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our tenant and employee data or our systems. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.


text: Cybersecurity is a critical aspect of our business. As the world's largest independent omni-channel sell-side advertising platform, we face a multitude of cybersecurity threats, and our customers rely on us to safeguard their data. These challenges make it imperative that we take information security seriously, and we expend considerable resources on cybersecurity. We have implemented a comprehensive cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: MAGNITE, INC.

ticker: MGNI


text: Cybersecurity matters are overseen by our board of directors, which meets quarterly to review the measures implemented by the Company to identify and mitigate cybersecurity risks. Our chief information security officer ("CISO") reports to the board quarterly on cybersecurity matters. These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company's cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer and Chief People Officer. In addition, cybersecurity risks and associated mitigation efforts are assessed by senior management as part of the enterprise risk assessment process that includes reporting to and discussion with the audit committee and our board of directors. In addition, cybersecurity controls have been integrated into our disclosure controls and procedures.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from extensive information technology and engineering experience, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The CISO receives reports on cybersecurity threats from other internal information security personnel on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. The CISO also attends meetings of the board of directors to report on any material developments. We have protocols by which certain cybersecurity incidents are reported promptly to management and the legal team.


text: The Company maintains a general security policy, which outlines the relationship between employees and information technologies and systems within the Company, and sets guidelines on how such technologies and systems should and should not be used. This policy is revised regularly by the CISO and reviewed and acknowledged by all Company employees in conjunction with annual cybersecurity training. The Company also has a Systems Security Policy in place, which outlines the requirements for system configuration and administration of systems within the Company, and includes steps for reporting cybersecurity incidents and keeping senior management and other key stakeholders informed and involved as appropriate.


text: With respect to incident response, we have adopted an Incident Response Playbook that applies in the event of a cybersecurity threat or incident (an "IRP") to provide a standardized framework for responding to security incidents, including malware, hacking, data breach (including third-party data breach), and other types of vulnerabilities. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, and provides triage workflows for individuals to follow. Our incident response process is generally based on the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by the Company. Our incident response team includes our CISO and the information security team, along with various business units, as applicable, and undergoes periodic training which includes exercises on monitoring and detection tools.


text: Security incidents are reviewed by the CISO and the information security team as soon as they are discovered or reported. The initial review of a security incident is conducted immediately, in order to appropriately determine the severity and urgency of the event. Key stakeholders and any technical owners of the impacted systems or processes are included in the incident review process and are brought in immediately in the case of potentially critical incidents. All phases of the review process are led by the CISO or another member of the security team, as appropriate.


text: We perform regular vulnerability scanning of our systems in order to ensure appropriate security controls are in place and function in accordance with established policies. We also have ongoing engagements with security consultants and other third parties as required to assist with assessing, identifying, and managing cybersecurity risks. These vendors help us with annual penetration testing and other items as needed. We have a robust internal controls framework and process and issue annual SOC 1 Type 2 reports covering our DV+, Streaming, and SpringServe platforms. In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps ensure compliance with our control framework.


text: As detailed elsewhere in this Annual Report on Form 10-K, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, proprietary and other types of information. We use state of the art systems with respect to the type of information processed, and employ processes designed to oversee, identify, and reduce the potential impact of a security incident with a third-party vendor or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber-attacks, we may not be able to protect all information systems. Any incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.


text: Although we maintain a robust cybersecurity program, due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of having experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. To mitigate against such risks, the company carries information security risk insurance that provides protection against potential losses arising from a cybersecurity incident. Refer to Item 1A. "Risk Factors" for additional information related to cybersecurity risks and the impact they may have on our operations.


text: Cybersecurity matters are overseen by our board of directors, which meets quarterly to review the measures implemented by the Company to identify and mitigate cybersecurity risks. Our Chief Information Security Officer ("CISO") reports to the board quarterly on cybersecurity matters. These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company's cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer, Chief People Officer, and SVP, Engineering. In addition, cybersecurity risks and associated mitigation efforts are assessed by senior management as part of the enterprise risk assessment process that includes reporting to and discussion with the audit committee and our board of directors. In addition, cybersecurity controls have been integrated into our disclosure controls and procedures.


text: Our CISO heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. Our CISO has extensive background, knowledge and skill in cybersecurity, with over 12 years of experience in establishing and maturing cybersecurity programs in the advertising technology space, from small startups to Fortune 500 companies. She holds a bachelors degree, with a certificate in architecture and systems engineering, and a professional education certificate in AI and machine learning.


text: The CISO receives reports on cybersecurity threats from other internal information security personnel on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. The CISO also attends meetings of the board of directors to report on any material developments. We have protocols by which certain cybersecurity incidents are reported promptly to management and the legal team.


text: With respect to incident response, we have adopted an Incident Response Playbook that applies in the event of a cybersecurity threat or incident (an "IRP") to provide a standardized framework for responding to security incidents, including malware, hacking, data breach (including third-party data breach), and other types of vulnerabilities. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, and provides triage workflows for individuals to follow. Our incident response process is generally based on the NIST Cybersecurity Framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by the Company. Our incident response team includes our CISO and the information security team, along with various business units, as applicable, and undergoes periodic training which includes exercises on monitoring and detection tools.


text: We perform regular vulnerability scanning of our systems in order to confirm appropriate security controls are in place and function in accordance with established policies. We also have ongoing engagements with security consultants and other third parties as required to assist with assessing, identifying, and managing cybersecurity risks. These vendors help us with annual penetration testing and other items as needed. We have a robust internal controls framework and process and issue annual SOC 1 Type 2 reports covering our DV+, Streaming, and SpringServe platforms. In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps promote compliance with our control framework.


text: Although we maintain a robust cybersecurity program, due to the evolving cybersecurity threat landscape, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. To mitigate against such risks, the company carries information security risk insurance that provides protection against potential losses arising from a cybersecurity incident. Refer to Item 1A. "Risk Factors" for additional information related to cybersecurity risks and the impact they may have on our operations.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. In addition, our Legal and Information Technology (IT)/Information Security (IS) teams work together to oversee our compliance with applicable laws and regulations and coordinate with subject matter experts throughout our business to identify, monitor and mitigate risk including information security risk management and cyber defense programs.

companyName: Arista Networks, Inc.

ticker: ANET


text: Our cybersecurity risk management program is aligned with our overall enterprise risk management programs and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management programs to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • an information security management systems policy, including a business continuity policy, acceptable use and physical security policies, and an incident response policy and plan for responding to cybersecurity incidents, among others; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of internal audit teams and external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness, data protection, and privacy training of our employees, incident response personnel, and senior management; and • a vetting and management process for third party service providers, suppliers, and vendors Through this program, our IT/IS team identifies and executes improvements based upon its own assessments, public cybersecurity events and the identification of new risks by third parties, including our external cybersecurity consultants. As part of these continuous improvement efforts, there may be times when the IT/IS team prioritizes certain cybersecurity fixes or program improvements over other measures, which could lead to new known or unknown risks being identified on an ongoing basis. Cybersecurity threat actors are often highly sophisticated and nimble in their attacks. Despite these efforts, we cannot guarantee that our priorities and efforts will prevent any cybersecurity incident from happening.


text: We also engage in periodic testing programs, using both internal assets and external consultants, including penetration testing, and incorporate multiple layers of physical, logical and written controls into our cybersecurity risk management program. Our IT/IS team leverages centralized identity management, encryption configurations and technologies on the systems, devices, and third-party connections used in our operations.


text: We also maintain cyber liability insurance coverage. While we currently hold such coverage, we cannot be certain that our insurance coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any future claim will not be excluded or otherwise be denied coverage by any insurer.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us, our business strategy, results of operations, or financial condition. For additional information concerning risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors in the category entitled, "Risks Related to Cybersecurity and Data Privacy".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives quarterly reports from our Vice President and Chief Information Security Officer (CISO), in conjunction with other senior managers, on cybersecurity risks. In addition, these managers update the Committee, as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential. The Committee reports to the full Board on cybersecurity no less frequently than once annually. The full Board also receives briefings from management on our cyber risk management program on a periodic basis.


text: Our cybersecurity program includes an annual funding and forecast process, and we have further established processes to secure additional funding in response to emerging risks, threats and identified improvement opportunities. Our IS team, led by one of our Vice Presidents who also serves as our CISO, is responsible for assessing and managing risks from cybersecurity threats. The IS team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants.


text: Our CISO has over 20 years of experience in the cybersecurity industry and has been instrumental in building several key security technologies, viz. Network Intrusion Prevention Systems (NIPS), Host Intrusion Prevention Systems (HIPS), Web Application Firewalls (WAF), Whitelisting, Endpoint/Server Host Monitoring (EDR) and Virtualization Based Security (VBS). Previously, our CISO served in senior executive and technical leadership roles in several security companies. In addition, our CISO has experience as a pen-tester and has in-depth knowledge of operating system, networking and security products. Our CISO holds a bachelor's degree in computer science and a master's degree in software systems. In addition, our IS team includes over 20 members each with experience in network security related roles, with the two IS leads reporting to our CISO each having more than 20 years of security experience.


text: Our management team, including our CISO in consultation with our Chief Technology Officer and Chief Financial Officer, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. However, as indicated above, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.


text: As part of our IT security program, our Cybersecurity Executive Committee and Information Security Steering Committee meet throughout the year to monitor and assess information security risks. In addition, we perform an enterprise risk assessment that is reviewed by the Committee and our Board of Directors on an annual basis and monitored on a quarterly basis by the Committee. The enterprise risk assessment is an assessment of key risks, including information security risks, data privacy, supply chain, human capital, and other risks.


text: Cybersecurity Risk Management and Strategy We have established an enterprise cybersecurity program to assess, identify, and manage cybersecurity risks with the aim that our information systems, including those of our vendors and other third parties, will be resilient, effective, and capable of safeguarding against emerging risks and cybersecurity threats.

companyName: Catalent, Inc.


text: Our cybersecurity program is aligned with the NIST-Cybersecurity Framework (NIST CSF v2), which provides a structured approach to inform, design, and evaluate our program. Consistent with this framework, we have established cybersecurity policies, standards, and processes designed to manage cybersecurity risks, including risks from cybersecurity threats associated with the Company's use of third-party service providers. Key elements of our cybersecurity program include: employee cybersecurity training, including required annual certification; identification of potential vulnerabilities through external threat intelligence feeds, scanning of our technology environment, and vendor and third-party risk assessments; an incident response plan and team that is intended to allow rapid management, response, and appropriate communication of cybersecurity incidents; and a cybersecurity operations center with support from a third party managed service provider (MSSP) to respond to threats and incidents.


text: When a potential threat or incident is identified, our cybersecurity incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our chief information security officer (CISO) and chief information officer (CIO). Our CISO, CIO, and key leaders will determine whether and what elements of our cybersecurity incident response plan should be activated, including escalation to our Executive Committee and/or members of our Board of Directors as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, please refer to the discussion under the heading, "We use advanced information and communication systems to run our operations, compile and analyze financial and operational data, and communicate among our employees, customers, and counterparties, and the risks generally associated with information and communications systems could adversely affect our results of operations. We continuously work to install new, and upgrade existing, systems and provide employee awareness training around phishing, malware, and other cyber security risks to enhance the protections available to us, but such protections may be inadequate to address malicious attacks or inadvertent compromises affecting data security or the operability of such systems" included in Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: Cybersecurity Governance We are committed to appropriate cybersecurity governance and oversight. Our cybersecurity organization is led by our CISO, who reports directly to our CIO and under the organization of our chief financial officer (CFO). Our CISO is educated in computer information systems and has over 20 years of experience in leadership, management, and engineering roles in the technology and cybersecurity realms. Our CISO also has experience implementing cybersecurity programs in alignment with the NIST Cybersecurity Framework. Our CIO is educated in computer science and has over 25 years of experience in leadership, management, and consulting roles in applications, digitalization, and infrastructure with oversight responsibilities for cybersecurity.


text: Our Board of Directors oversees management's processes for identifying and mitigating enterprise-wide risks, including cybersecurity and related information technology risks. Our Audit Committee receives updates from our CIO and CISO on our technology and cybersecurity program and receives independent external expert evaluations of our program using industry frameworks, including the NIST-Cybersecurity Framework.


text: Our Audit Committee also receives cybersecurity updates and education on a broad range of topics, including: current cybersecurity landscape trends and emerging threats; the status of cybersecurity initiatives; incident reports and learnings from any material cybersecurity events; and any pertinent cybersecurity regulatory requirements and industry expectations.


text: We believe cybersecurity is a critical part of our overall risk management and key to enabling our digital operations. As a company that heavily relies on our website to buy and market powersports, we face a multitude of cybersecurity threats common to most industries, such as phishing/malware, ransomware and denial-of-service, as well as threats common to retailers, such as theft of customer and employee data. Our customers, suppliers, and subcontractors face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats necessitate an appropriate focus on cybersecurity.

companyName: RideNow Group, Inc.

ticker: RDNW


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Senior Director of Information Security, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance to Rumble On. We are finalizing our IT Risk Management Program that will outline the steps to be followed in the event of an incident, from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.


text: Our corporate information security team is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current Senior Director of Information Security has extensive information technology and program management experience. The corporate information security organization manages an enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this effort will be our technical solution that we are implementing that will provide near real time monitoring of our data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.


text: Assessing, identifying, monitoring, and managing cybersecurity-related risks are being included in our overall risk management processes. Cybersecurity-related risks are included in the population of risks that are evaluated to assess top risks to the Company on an annual basis. To the extent a heightened cybersecurity related risk is identified, risk owners will be assigned to develop risk mitigation plans, which are then tracked to completion. The annual risk assessment will be presented to the Board of Directors.


text: We rely heavily on third parties to deliver our products and services to our customers, and a cybersecurity incident at a key supplier or subcontractor could materially adversely impact us. We include security and privacy addenda to our contracts where applicable. In addition, any subcontractors connecting to our network are instructed to report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Rumble On maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition. No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition.


text: The Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership regularly briefs the Board on our cybersecurity and information security posture and the Board is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance to Rumble On.


text: Our corporate information security team is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security organization manages an enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this effort is our technical solution that provides monitoring of our data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.


text: Assessing, identifying, monitoring, and managing cybersecurity-related risks are included in our overall risk management processes. Cybersecurity-related risks are included in the population of risks that are evaluated to assess top risks to the Company on an annual basis. To the extent a heightened cybersecurity related risk is identified, risk owners will be assigned to develop risk mitigation plans, which are then tracked to completion. An annual risk assessment is presented to the Board.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Rumble On maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Cybersecurity Threats, Risk Management and Strategy Our business operations, including our onshore operations and vessel operations, rely on information and operational technology systems, which could be targeted by various cyber threats including computer hackers and cyber terrorists. Reliance on information systems for vessel operations include the steering, navigation and propulsion systems of our vessels, communications and cargo management. Cybersecurity threats are of increased concern in today's world as they can potentially, amongst other things, disrupt operations, compromise sensitive information, and expose us to litigation. Cybersecurity threats are continuously evolving and can vary widely. Some common types of cyber threats are not limited to, but include malware, phishing, social engineering, spoofing, supply-chain attacks, domain name system (DNS) tunneling, insider threats, code injection, identity-based attacks, and other cyber threats.

companyName: DORIAN LPG LTD.

ticker: LPG


text: We have in place safety and security measures on our vessels and onshore operations to secure our vessels against cybersecurity incidents. Our processes for assessing, identifying and managing material risks from cybersecurity threats include, but are not limited to: cybersecurity processes designed in accordance with international standards guidelines including the National Institute of Standards and Technology (NIST) Core Framework, ISO/IEC 27001, ISO/IEC 27002, the Tanker Management Self-Assessment (TMSA) 13 Elements, BIMCO, IMO Guidelines and International Ship and Port Facility Security (ISPS) Code, ISA/IEC 62443 for industrial Operational Technology, IACS UR E26/27, and OCIMF SIRE 2.0;


text: system protection mechanisms such as access procedures, antivirus programs, endpoint detection & response, maintaining a firewall and antispam, anti-phishing and email filtering processes;


text: implementation of internal policies and procedures, including an Information Security and Acceptable Use Policy, Information Security Management System Policy, Cyber Incident Response Procedures and Cyber Security Assessments on Policies and Procedures, to manage cybersecurity risk, implement incident reporting procedures and cybersecurity threat responses and regularly assess and monitor the Company's cybersecurity measures;


text: periodic vulnerability assessment and penetration testing on shore and on vessels to review our cybersecurity weaknesses, using either internal competencies or external firms; a multi-vendor approach to reduce the risk of the compromise of a major cybersecurity vendor;


text: periodic cybersecurity awareness training for both ship and shore personnel; and use of external cybersecurity vendors and threat detection and intelligence services to assist with incidence response and handling.


text: We also have processes to oversee and identify cybersecurity risks from cybersecurity threats associated with our use of suppliers, vendors, third-party service providers and IT support companies. These include the use of cybersecurity questionnaires, the performance of contract reviews to ensure IT-related compliance and the mitigation of identified information security risks and the sharing of our information security and acceptable use policy.


text: We have adopted the internal policies mentioned above to implement reporting procedures for any cybersecurity incident and a cybersecurity management framework to continuously monitor and access risk. These policies are developed and periodically reviewed by our IT department. The processes outlined above have also been integrated into our overall risk management strategy.


text: For the year ended March 31, 2024 and through the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see "Item 1A. Risk Factors - Information technology failures and data security breaches, including as a result of cybersecurity attacks, could negatively impact our results of operations and financial condition, subject us to increased operating costs, and expose us to litigation".


text: Our cybersecurity risk management program is managed by our Chief Information Security and Sustainability Officer (the "CISSO") and IT manager and is overseen by the Chief Executive Officer and the Chief Financial Officer. The CISSO, IT manager, and other members of the IT security team actively participate in cybersecurity groups and seminars, including those that are maritime-specific, for collaboration on cyber resilience, threat intelligence sharing, and best practices exchange. All members of the IT security team regularly undergo new training/certifications on cybersecurity and attend seminars/conferences related to cybersecurity to keep their knowledge and expertise current. At a minimum, the CISSO meets with the Chief Executive Officer and the Chief Financial Officer monthly to provide updates on cybersecurity programs, threats, and incidents, and advises the heads of all departments of any recent threats periodically.


text: The Nominating and Corporate Governance Committee (the "N&CG Committee") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the N&CG Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISSO or IT manager, including updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.


text: periodic vulnerability assessment and penetration testing on shore and on vessels to review our cybersecurity a multi-vendor approach to reduce the risk of the compromise of a major cybersecurity vendor;


text: We are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see "Item 1A. Risk Factors - Information technology failures and data security breaches, including as a result of cybersecurity attacks, could negatively impact our results of operations and financial condition, subject us to increased operating costs, and expose us to litigation".


text: The Nominating and Corporate Governance Committee (the " N&CG Committee ") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the N&CG Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISSO or IT manager, including updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a dedicated cybersecurity risk management function, which is integrated as part of our overall enterprise risk management program. Our key cybersecurity risks include, among others, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; remote working environments; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks.

companyName: Sabre Corp

ticker: SABR


text: To identify and assess material risks from cybersecurity threats, members of our cybersecurity risk management function, which is led by our Chief Information Security Officer ("CISO"), consider cybersecurity threats within the context of our business environment. Cybersecurity risks are managed through technological, process, and administrative controls that are designed to target the mitigation of risk to levels acceptable to the business. Risk assessment and management include processes for managing third-party cybersecurity risk. These processes provide that third-party cybersecurity risk assessments are to be performed prior to a vendor's engagement, upon contract renewal, and as we may otherwise require. Our formal cybersecurity policy program, which includes a collection of security policies and procedures, is in place to establish requirements, standards, and security controls designed to protect Sabre's technology environment.


text: We employ information technology and cybersecurity technologies that are designed to protect Sabre's technology environment, detect threats, respond to threats and help support operational resilience. These technologies facilitate the identification of threats and vulnerabilities that may exist in the Sabre technology environment. Protective measures are employed to counter threats and mitigate risk, supporting operational resilience of our technology products. These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools. Accompanying these tools are various processes such as security education and awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment. We practice data protection techniques and processes that are designed to treat our customer data with care. We also utilize third-parties, consultants, and auditors to regularly assess our security program. These assessments include periodic security maturity assessments in which third-parties assess security program maturity against established standards and industry benchmarks. We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.


text: Our cybersecurity incident response plan describes the activities we take to identify, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to provide appropriate reporting and escalation. The program includes appropriate activities to escalate potentially material security incidents to our disclosure committee for review.


text: Based on the information we have as of the date of this Annual Report with respect to the periods beginning with those covered by this Annual Report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We, like most technology companies, are the target of cybercriminals who attempt to compromise our systems. We describe risks relating to cybersecurity threats, including as a result of previous cybersecurity incidents in "Item 1A. Risk Factors" in this Annual Report on Form 10-K, under the headings "Our success depends on maintaining the integrity of our systems and infrastructure, which may suffer from failures, capacity constraints, business interruptions and forces outside our control." and "Security incidents expose us to liability and could damage our reputation and our business."


text: Cybersecurity Governance The Audit Committee of our Board of Directors has oversight authority to review our plans to mitigate cybersecurity risk. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards risk-management-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity risk profile scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer, our CISO, and our Data Privacy Officer. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Cybersecurity risks are also considered during separate Audit Committee, Technology Committee and Board of Directors meeting discussions of matters such as enterprise risk management, the annual planning process, our technology transformation, corporate development activity, and other relevant matters.


text: We also maintain a Cybersecurity Governance Committee, led by our CISO and comprised of senior cross-functional leaders including product, development, operational, and corporate business leaders. The committee oversees our cybersecurity risk management and strategy processes, which are discussed above. Our CISO has over 25 years of prior work experience in various roles involving managing cybersecurity risk, developing cybersecurity strategy, implementing effective information and cybersecurity programs and leading information technology and cybersecurity teams. He graduated with a Bachelor of Science and Master of Science Degree in Electrical Engineering as well as three additional master's degrees, including a Master of Business Administration, and he is a Certified Information Systems Security Professional (ISC2) as well as a Certified Chief Information Security Officer (EC Council).


text: Members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Audit Committee has oversight authority and receives reports regarding cybersecurity threat risks, as well as other cybersecurity related matters, on at least a quarterly basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a dedicated cybersecurity risk management function, which is integrated as part of our overall enterprise risk management program. Our key cybersecurity risks include, among others, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; remote working environments; third-party risks; technology risks and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks.


text: We employ information technology and cybersecurity technologies that are designed to protect Sabre's technology environment, detect threats, respond to threats and help support operational resilience. These technologies facilitate the identification of threats and vulnerabilities that may exist in the Sabre technology environment. Protective measures are employed to counter threats and mitigate risk, supporting operational resilience of our technology products. These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools. Accompanying these tools are various processes such as annual security education and monthly awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment. We practice data protection techniques and processes that are designed to treat our customer data with care. We also utilize third-parties, consultants, and auditors to regularly assess our security program. These assessments include periodic security maturity assessments in which third-parties assess security program maturity against established standards and industry benchmarks, including NIST Cybersecurity Framework 2.0. We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: Cybersecurity risk management and strategy As one of the elements of the Company's overall risk management program, the Company's cybersecurity program is focused on the following key areas: • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to among other things: Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures; monitor Company networks, servers and endpoints to identify vulnerabilities;


text: perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness; obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure;


text: determine and execute mitigation and remediation options and plans; and ensure ongoing compliance with applicable legal and regulatory requirements, including notification to required individuals and regulatory bodies in the event of the discovery of an information security breach as defined under applicable laws, and timely and adequate disclosure under applicable SEC rules.


text: Education and Awareness: The Company provides annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company maintains an Information Security Committee (the "ISC") which is a cross-functional governance committee comprised of the AVP- Enterprise Information Technology ("IT AVP"), Chief Financial Officer ("CFO") and Chief Executive Officer ("CEO"). The ISC is the focal point for all information security activities throughout the Company and acts as a liaison on security matters throughout our group of affiliates. The ISC, led by the IT AVP works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC is charged with developing and implementing policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC is responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the ISC to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's IT AVP, on behalf of the ISC, reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Internal Audit function also provides quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.


text: Management's Expertise Our IT AVP also ensures he is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents. In addition, the Company's CEO and IT AVP each hold undergraduate degrees and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third party reviews. We rely on industry leading third party service providers to provide the systems required to effectively run our clinical trials and require these third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • Conduct on boarding and cyber security training for all employees on an ongoing basis; • Conduct regular phishing email simulations for all employees; and • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We have business continuity plans that we continuously review and update in line with our evolving applications architecture.


text: Our Board of Directors provides oversight to our Cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our Head of Information Technology, provides periodic updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.


text: We describe whether and how risks from cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies designed to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third-party reviews. We rely on third-party service providers to provide the systems required to effectively run our clinical trials and endeavor to require third-party service providers that have access to personal, confidential or proprietary information to implement and maintain cybersecurity practices. Specific controls that are used in appropriate portions of our environment include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management. Our cybersecurity risk management processes are integrated into our enterprise risk management program.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we endeavor to: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct annual cybersecurity management and incident training for employees that process sensitive data; • Conduct onboarding and cybersecurity training for all employees on an ongoing basis; • Conduct regular phishing email simulations for all employees; and • Carry cybersecurity risk insurance meant to provide protection against the potential losses arising from a cybersecurity incident.


text: In addition, we engage several third-party consultants in connection with our risk assessment and risk management, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments and risk management are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with legal obligations and attempt to mitigate brand and reputational damage. We have business continuity plans that we periodically review and update in line with our evolving applications architecture.


text: Our cybersecurity leadership team is responsible for assessing and managing cybersecurity risks and is made up of experienced professionals with an extensive background in information security, risk management, and incident response. This team is led by our Head of Information Technology. The Head of Information Technology is a senior technology strategist and thought leader with over two decades of experience in the bio pharma, life sciences, and high-tech sectors.


text: Our Board of Directors provides oversight to our cybersecurity efforts to ensure effective governance in assessing and managing risks associated with cybersecurity threats. Our Head of Information Technology provides periodic updates to senior management and quarterly updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance, status updates on various projects intended to enhance the overall cybersecurity posture of the Company, and information about the prevention, detection, mitigation and remediation of any cybersecurity incidents, as appropriate.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. While we devote resources to security measures designed to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. A successful attack on our information technology systems or on the systems of our third-party vendors could have material consequences on our business. We describe whether and how risks from cybersecurity threats have or are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Risks Related to Our Intellectual Property, Cybersecurity and Data Privacy" included as part of Part 1, Item 1A, Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. Our cybersecurity risk management program includes: • annual external and internal penetration tests to help identify material cybersecurity risks to our critical systems, information and our broader enterprise IT environment; • a security team that includes internal IT and data privacy personnel and external managed services partners, principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including: • annual external and internal penetration tests; •24-hour monitoring of our networks and cloud resources to help detect, respond to and recover from cyber-attacks;


text: • IT managed services that includes help desk support and managed infrastructure (networks and servers support); and • a ransomware defense plan. • cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • third-party risk management and reporting process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. In the event we experience a cybersecurity incident we consider to be material, we will disclose such incident consistent with the requirements of Item 1.05 of Form 8-K.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of the board of directors, or the audit committee, oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.


text: The audit committee receives periodic reports from management on our cybersecurity risks. In addition, management alerts the audit committee of any material cybersecurity incidents. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from management and have available to them external resources related to cybersecurity as part of the board of directors' continuing education on topics that impact companies similar to ours.


text: Our cybersecurity function is overseen by Michael MacLean, Chief Financial and Chief Business Officer, who leads a team that is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares reporting channels and governance processes that apply across the risk management program to other legal, compliance, operational and financial risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments to help identify material risks from cybersecurity threats to our critical systems and information; • a security team that includes internal IT and data privacy personnel and external managed services partners, principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including: • annual external and internal penetration tests; •24-hour monitoring of our networks and cloud resources to help detect, respond to and recover from cyber-attacks;


text: • IT managed services that includes help desk support and managed infrastructure (networks and servers support); and • a ransomware defense plan. • cybersecurity awareness training for our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • third-party risk management and reporting process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers and vendors with access to our information systems or data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. In the event we experience a cybersecurity incident we consider to be material, we will disclose such incident consistent with the requirements of Item 1.05 of Form 8-K.


text: Our cybersecurity function is overseen by our Senior Vice President of Information Technology, who leads a team that is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity incidents have the potential to disrupt our business operations, lead to the loss of critical and confidential information, and damage our reputation and financial performance.

companyName: Japan Food Tech Holdings, Inc.


text: Given our company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data. Currently, the security of our information is managed by Koichi Ishizuka, our sole officer and director.


text: While Koichi believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.


companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Given our company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data.


text: Currently, the security of our information is managed by Levi Jacobson, our sole officer and director. While Mr. Jacobson believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.


companyName: Ultimate Holdings Group, Inc.

ticker: UHGI


text: Given the company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data.


text: Currently, the security of our information is managed by Mr. Ryohei Uetaki, our sole officer and director. While Uetaki believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.


text: Cybersecurity Risk Management and Strategy We maintain basic processes to identify and manage cybersecurity risks. These include regular system updates, employee training, and monitoring for unauthorized access. When needed, we work with external IT consultants to assess our systems.

companyName: Zentrum Holdings, Inc.


text: Our cybersecurity efforts are part of our broader risk management approach. To date, we have not experienced any cybersecurity events that have had a material impact on our business or operations. Our management oversees cybersecurity risks.


text: The board of directors is informed about cybersecurity risks on a periodic basis, especially when significant threats or issues are identified.


companyName: AIS Holdings Group, Inc.

ticker: AIDG


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Our cybersecurity program was developed by integrating a range of relevant concepts and controls derived from established security frameworks. These include the National Institute of Standards and Technology Cybersecurity Framework, the Committee of Sponsoring Organizations of the Treadway Commission and related SOC 2 Control Objectives, as well as the Payment Card Industry Data Security Standard. It is important to note that while these frameworks guide our cybersecurity strategies and help us identify, access, and manage cybersecurity risks relevant to our business, this does not imply certification or that we meet or comply with any specific technical standards, specifications or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: a.risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: b.a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: c.the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; d.cybersecurity awareness training of our employees;


text: e.a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and f.a third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk factors related to information technology and cybersecurity" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Our Board considers cybersecurity risk and other information technology risks as part of its risk oversight function. The full Board oversees management's implementation of our cybersecurity risk management program.