text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated as primary responsible for oversight of the Company's cybersecurity risk management. As discussed below, management reports to the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks regarding financial statements or financial statements reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise, including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively. Further, certain members of the Board of Directors are National Association of Corporate Directors ("NACD") CERT Certified in cybersecurity oversight.

companyName: Limbach Holdings, Inc.

ticker: LMB

secItem: Item 1C


text: The Board of Directors and the Audit Committee receive briefings from the Company's CFO and CEO on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to their regularly scheduled meetings, members of the Board of Directors, the CIO, CFO and CEO regularly engage in ad hoc conversations regarding emerging or potential cybersecurity risk and developments in the cybersecurity domain. The Board of Directors actively participates in strategic decisions making related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board of Directors conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review is helpful for identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: As of the date hereof, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to have been identified or are anticipated to have a material adverse effect on the Company's business strategy, results of operations, and financial condition. Despite its efforts to maintain processes which mitigate cybersecurity risks, there is no guarantee that such risks may not have a material effect on the Company's business strategy, results of operations, and financial condition in the future. For additional information on cybersecurity risks the Company may face, see Part I, Item 1A. Risk Factors – "Information technology system failures, network disruptions or cybersecurity breaches could adversely affect our business."


text: SoundHound acknowledges the increasing importance of cybersecurity in its operations and recognizes the potential risks and threats associated with cyber incidents. The Company is committed to maintaining the confidentiality, integrity, and availability of its information systems and data. However, no system can be completely immune to cyber threats. We face a number of cybersecurity risks in connection with our business. To date, such risks have not materially affected our business, including threats to and breaches of our data systems, malware and computer virus attacks.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Risk Management and Strategy The following information provides an overview of our approach to managing cybersecurity risks. The Company assesses, identifies and manages cybersecurity related risks. Cybersecurity related risks are evaluated to assess top risks to the enterprise on a bi-annual basis. SoundHound has implemented a comprehensive cybersecurity program designed to identify, assess, and manage cyber risks.


text: This program includes, but is not limited to: • Regular risk assessments and vulnerability assessments. • Implementation of industry-accepted cybersecurity controls and best practices. • Employee training and awareness programs to enhance the company's overall cybersecurity posture. • Continuous monitoring and incident response plans to detect and mitigate potential threats promptly.


text: We have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multi factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an annual internal review process and are approved by appropriate members of management.


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level and by reviewing our operational policies and procedures. We review our operational policies and procedures with third party experts on an annual basis as part of our annual audit process. We also maintain cyber insurance coverage. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Vendor Management Team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: SoundHound will report any cybersecurity incidents determined to be material. Material aspects of the nature, scope and timing of the incident, and the impact or reasonably likely impact of the incident on the Company, including on SoundHound's financial condition and results of operations will be disclosed.


text: The audit committee oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The board recognizes the importance of cybersecurity in safeguarding the company's assets and operations.


text: SoundHound has a dedicated Information Security Management committee responsible for overseeing risks from cybersecurity threats. The committee's charter outlines its specific responsibilities related to cybersecurity risk oversight, and assists senior management in fulfilling its oversight responsibilities by creating, implementing, overseeing and maintaining SoundHound's Information Security Management System. The purpose of the ISMS is to protect the Company's information systems and assets, taking into account the potential for external threats, internal threats, and threats arising from transactions with trusted third parties and vendors. The board of directors is informed of cybersecurity risks, at least annually, through established processes, including periodic briefings, reports, and updates on the evolving landscape of cybersecurity threats.


text: SoundHound designates the Information Security Management Committee as responsible for assessing and managing cybersecurity risks. Committee members possess professional experience or backgrounds presenting relevant experience or capacity to address those matters within the scope of the Committee's responsibility, including senior executives, department leaders, and subject matter experts. Committee members are familiar, or have the ability to quickly gain familiarity, with major technology platforms employed by the Company; have knowledge of technological ecosystems and challenges confronted in current or emerging business environments; have the capacity to understand new or emerging technologies and cyber security threats; are familiar, or have the ability to quickly gain familiarity, with information security principles, privacy regulations, standards, and guidelines; and possess experience relating to enterprise risk management and process.


text: We view cybersecurity as a shared responsibility. All employees are required to complete cybersecurity training as part of onboarding, on an annual basis and have access to more frequent cybersecurity training online. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. The designated persons or committees actively monitor cybersecurity incidents through processes that monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, including continuous assessment and adaptation to emerging threats.


text: Risk Management and Strategy Bioventus maintains a cybersecurity risk management program that is designed to enable us to assess, identify, and manage risk associated with cybersecurity threats (the "Cybersecurity Program"). Our Cybersecurity Program is based on standards promulgated by the National Institute of Standards and Technology ("NIST") and the United States Cybersecurity and Infrastructure Security Agency ("CISA") and includes the following elements: • Identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by CISA. • Technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness. • Processes designed to detect the occurrence of cybersecurity events and to respond to and recover from cybersecurity incidents. • A third-party risk management process designed to manage cybersecurity risks associated with our service providers, suppliers, and vendors.

companyName: Bioventus Inc.

ticker: BVS


text: Our Cybersecurity Program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit and Risk Committee of the Board of Directors. We also actively engage with key vendors, industry participants and threat intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of the Cybersecurity Program.


text: Integration of Risk Management Process Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Cybersecurity Program is integrated into our enterprise risk management program and framework. These programs are designed to foster a company-wide culture of appropriate cybersecurity risk management. Our IT Security team works closely with stakeholders across technology, legal, risk, and business operations to implement and monitor the effectiveness of the Cybersecurity Program.


text: Engagement of Third Parties in Connection with Risk Management The Company engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity consultants and external auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Bioventus in certain circumstances. We have implemented processes for overseeing and managing these risks. Those processes include assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements.


text: Risks from Cybersecurity Threats As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, incidents impacting data processed and systems maintained or operated by us or on our behalf, and incidents otherwise impacting our operations, can and do occur. For example, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our EXOGEN device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. As a result of the Change Healthcare incident, certain of our patient billing and collections processes were disrupted. We have identified an alternative claim processing intermediary and have resumed claims submissions, but this incident caused delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us. As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data. We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows. We continue to evaluate the impact of the Change Healthcare incident on our Company.


text: The oversight of Bioventus' Cybersecurity Program falls under the purview of the Company's Director of IT Security, Risk and Compliance, who has over 25 years of combined technical and leadership experience, with the past 18 years focused on information security and technology risk management, and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.


text: The Audit and Risk Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats, and is regularly briefed on the Company's Cybersecurity Program by the Vice President of Information Technology and/or Director of IT Security, Risk and Compliance. These briefs include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: The Director of IT Security, Risk and Compliance implements and oversees our processes for regularly monitoring our information systems and detecting and reporting cybersecurity incidents. That process includes convening an incident response team composed of the Director of IT Security, Risk and Compliance, Vice President of Information Technology, Chief Compliance Officer, and General Counsel. The incident response team is responsible for overseeing the assessment of and response to any cybersecurity incident and for monitoring the Company's mitigation and remediation efforts. The incident response team is also responsible for informing executive management, the Audit and Risk Committee and, where appropriate, the Board of Directors, regarding the detection, mitigation, and remediation of cybersecurity incidents.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data"). Our information security function is led by our Director of Information Technology, overseen by our Senior Vice President of Finance and Financial Planning, with the support of our third-party specialists. Our information security function helps identify, assess and manage risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including automated tools, domain name system filtering, antivirus protection, vulnerability scanning and penetration testing.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include an incident response policy, encryption of certain data, network security controls, segregation of certain data and system monitoring. Our incident response policy provides the framework for the execution of cybersecurity incident response procedures and internal communications while adhering to applicable legal reporting and disclosure requirements.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our information security function works with management to prioritize risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats. In addition, we use third-party service providers to perform a variety of functions throughout our business, including, for example, hosting and processing data, manufacturing our product candidates and assisting with R&D and clinical trial activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.


text: For a description of our cybersecurity risks, refer to the risk factor in Item 1A. "Risk Factors," to this Annual Report on Form 10-K titled "If our information technology systems or data, or those of the third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."


text: Our board of directors maintains oversight of our most significant risks and our processes to identify, manage and mitigate those risks. The audit committee of our Board of Directors (the "Audit Committee") has responsibility for oversight of our management of cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who reports to our Senior Vice President of Finance and Financial Planning. Our Director of Information Technology is responsible for monitoring third-party specialists, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Senior Vice President of Finance and Financial Planning is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our Incident Response Policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Senior Vice President of Finance and Financial Planning. Our Senior Vice President of Finance and Financial Planning and, if escalated, other senior management, work with our incident response team to help mitigate and remediate cybersecurity incidents. In addition, our Incident Response Policy includes reporting to the Audit Committee for certain cybersecurity incidents. The Incident Response Policy is managed and maintained by our Director of Information Technology, with oversight from our Senior Vice President of Finance and Financial Planning. The Audit Committee receives periodic updates from our Senior Vice President of Finance and Financial Planning regarding the status of our cybersecurity program and our posture to identify and mitigate risks to our information security.


text: Risk management and strategy We rely on information technology and data to operate our business and develop and advance our pipeline of product candidates. Our critical information technology includes computer networks, third-party hosted services, communications systems, software and infrastructure, and our critical data includes confidential, personal, proprietary and sensitive data (collectively, Information Assets). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our Information Assets and mitigate harm to our business.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Risks from cybersecurity threats are among those that we review and address in our general risk management program. We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments to identify vulnerabilities.


text: We rely on a multidisciplinary team (including from our information security function, management and third party service providers, as described further below) to assess how cybersecurity threats could impact our business. We routinely assess the likelihood that such threats could result in a material impact to our Information Assets, business and clinical operations, core business functions, personnel, reputation and identified critical business objectives.


text: Based on our assessment process and depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets, including, for example: policies and procedures designed to address cybersecurity threats, including an incident response plan, disaster recovery and business continuity plans; incident detection and response; internal and/or external audits to assess our exposure to cybersecurity threats, compliance with risk mitigation procedures and effectiveness of relevant controls; documented risk assessments; background checks on our personnel; encryption of data; network security controls; access controls; physical security; asset management; systems monitoring; employee training; penetration testing; and cyber insurance. We prioritize our efforts based on the threats that we believe are more likely to lead to a material impact to our business, such as ransomware, theft of intellectual property and interruption of services and processes on which we rely.


text: We work with third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers and penetration testing firms.


text: To operate our business, we utilize certain third party service providers to perform a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms, managed services, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology and corporate productivity services. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections and requiring their completion of written questionnaires regarding their cybersecurity programs.


text: For additional information about the risks from cybersecurity threats that may materially affect us and how they may do so, see the section entitled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."


text: Our cybersecurity risk management strategy relies on input from management, including our Chief Operating Officer, Mr. Stephen Hill, to help us understand cybersecurity risks, establish priorities and determine the scope and details of our cybersecurity program and to implement it. Mr. Hill has held senior management positions at numerous pharmaceutical companies for over a decade. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy and for communicating key priorities to employees and other stakeholders. Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.


text: Management meets regularly to discuss cybersecurity risk and to review our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports and reporting to our board of directors, testing incident response plans and engaging vendors that provide cybersecurity services. Management participates in cybersecurity incident response efforts by being members of the incident response team and helping direct our response to cybersecurity incidents.


text: Our board of directors has overall responsibility for evaluating key business risks faced by us, including cyber security and information technology. The audit committee of our board of directors assists the board of directors in the oversight and assessment of risks relating to data privacy, technology and information security, including cybersecurity. Our audit committee holds regular meetings to discuss issues including our cybersecurity threats and has a dedicated agenda during such meetings that are designed to assist our board of directors and our audit committee in exercising their oversight function. The meetings involve presentations and reports from our management and specifically includes updates of current cybersecurity threats faced by us and steps we are taking to address them.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Owlet, Inc.

ticker: OWLT


text: Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities; • cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer; • cybersecurity awareness training for employees; • security tools in our system to monitor and detect cybersecurity threats; • cyber liability insurance; • a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and • a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, where it deems appropriate, regarding any significant cybersecurity incidents.


text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.


text: Risk management and strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve and recover from security incidents in a timely manner. Our Board of Directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the by the Risk Management Committee of the Board of Directors. Our Data Breach Response Team performs annual cybersecurity tabletop incident response exercises, pursuant to our Data Breach Response Policy and Plan. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants and other external cybersecurity experts to assist in the identification, verification and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. See our risk factor "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed" in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate- and long-term timeframe. Our Executive Director of Information and Technology Services ("IT Director"), who reports to our Chief Financial Officer, is responsible for the operational oversight of company-wide cybersecurity strategy, policy and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our IT Director has multiple university certifications in advanced cybersecurity with over 30 years' experience in cybersecurity and technology roles, most of which have been held with the Company. Meetings of our Risk Management Committee and Board of Directors include discussions and presentations by management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats and reports from management on our enterprise risk profile on an annual basis. The Board of Directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.


text: Risk Management and Strategy As SandRidge has increasingly relied on information technology systems and networks in connection with our business activities, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: SandRidge has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with IT professionals to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. The underlying controls of our cybersecurity risk management are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").


text: The following is a brief list of some of the cybersecurity risk management tools we employ to identify, assess and manage threat risks: –Third party system and network scanning tools that identify or automatically block potential cybersecurity threats; –Routine review and update of system access; –Multi-factor authentication; –Live 24-hour monitoring of corporate and field operations IT networks for cybersecurity threats; –Mandatory annual employee cybersecurity awareness training program that includes phishing simulations and other microlearning courses; –Monthly IT and cybersecurity meetings with management and IT professionals; –Completion of annual IT network cybersecurity assessment and vulnerability scan;


text: –Segregation of our financial data records, that are stored on remote servers, separate and apart from our corporate office network with backups stored in different geographical regions in the United States.


text: Recognizing the complexity and evolving nature of cybersecurity threats, SandRidge engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes focus on industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Because we are aware of the risks associated with relying on third-party service providers, to, among other things, estimate quantities of oil and natural gas reserves, analyze seismic and drilling information, process and record financial and operating data and communicate with employees and third parties, SandRidge implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes assessments by our internal audit and IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Incidents and Threats We have in the past experienced, and expect to continue to confront, cybersecurity incidents and cybersecurity threats from hackers and other third parties. Although such prior incidents have not had a material adverse impact on our operations or financial performance, there can be no assurance that we will be successful in preventing cybersecurity incidents or successfully mitigating their effect on our Company. Any cybersecurity incident could have a material adverse effect on our reputation, competitive position, business, financial condition and results of operations.


text: Additionally, although out of our control, cybersecurity incidents affecting oil and natural gas distribution systems maintained by third parties, or the networks and infrastructure on which they rely, could delay or prevent delivery of our production to markets, which could, in turn, have a material adverse effect on our business, financial condition and results of operations.


text: For additional information regarding the risks we face from cybersecurity threats, please see the section entitled "Item 1A. Risk Factors—Cybersecurity incidents or other failures in telecommunications or IT systems could result in information theft, data corruption and significant disruption of our business operations."


text: Governance – Board Oversight and the Role of Management The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee ensures effective oversight by reviewing reports on information security and cybersecurity from the Director of Internal Audit at least annually.


text: Primary responsibility for assessing and integrating within enterprise risk management of our cybersecurity risks rests with our Director of Internal Audit, who oversees our governance programs, tests our compliance with standards, remediates known risks, and coordinates our employee training program. The Director of Internal Audit is a Certified Fraud Examiner with over 20 years of planning and managing information technology audits, including information technology general controls for SOX, and cybersecurity breach protocols, policies and assessments.


text: The Director of Internal Audit, in their capacity, regularly informs the Chief Executive Officer ("CEO"), the Chair of the Audit Committee, and other members of management of aspects related to cybersecurity risks and incidents. This ensures that the appropriate levels of management are kept abreast of the cybersecurity posture and potential risks facing SandRidge. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and ensuring the safety and efficacy of our medical devices. Our cybersecurity risk management program, which is based on recognized cybersecurity frameworks established by the National Institute of Standards and Technology ("NIST") and led by our Chief Information Officer (CIO), is fully integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. We are dedicated to maintaining the highest standards of cybersecurity to protect our customers and stakeholders. We will continue to adapt to evolving threats and regulations to ensure the safety and security of our products and information.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: Please see the Item 1A. Risk Factor above entitled "Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations" for more information regarding cybersecurity incident risks associated with InfuSystem.


text: Cybersecurity Risk Management • Risk Assessment: We regularly conduct comprehensive cybersecurity risk assessments, identifying potential vulnerabilities and threats that could impact the confidentiality, integrity, and availability of our medical devices and associated data. • Policies and Procedures: InfuSystem has established and maintains cybersecurity policies and procedures that align with industry best practices and regulatory requirements. These policies address areas such as data protection, access control, incident response, and vulnerability management. • Training and Awareness: We provide ongoing cybersecurity training and awareness programs to our employees and contractors, emphasizing the importance of their role in safeguarding sensitive information and reporting security incidents. • Use of Third-Parties: InfuSystem works with a third-party Cybersecurity risk partner whose systems ingest information regarding the current state of the Company's information and technology environment and using specialized algorithms provide assessments of the company's Cybersecurity risk exposure as well as providing targeted advice to mitigate any risks identified. • Third-Party Risk Management: InfuSystem evaluates the cybersecurity practices of third-party vendors and suppliers, ensuring that they meet our cybersecurity standards and pose no undue risk to our medical devices and data. • Incident Response Plan: We maintain a robust incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. This plan includes procedures for reporting incidents, containing threats, and notifying affected parties as required by law.


text: InfuSystem is committed to continuous improvement in our cybersecurity risk management practices. In the coming fiscal year, we will focus on: 1.Enhancing our threat detection and monitoring capabilities. 2.Conducting regular tabletop exercises to improve incident response readiness. 3.Staying abreast of emerging threats and adjusting our cybersecurity posture accordingly. 4.Collaborating with industry partners and regulatory authorities to enhance overall cybersecurity resilience in the medical device industry.


text: Cybersecurity Governance InfuSystem maintains a dedicated cybersecurity governance framework. While senior management is primarily responsible for assessing and managing the Company's exposure to risk, our Board of Directors oversees our ERM, including cybersecurity risk management, and ultimately approves ERM policies and procedures. Our Board conducts much of its risk oversight activities, including cybersecurity risk oversight, through our Audit Committee. Given the ever-increasing volume of cyber threats and the magnitude of a potential breach, cybersecurity is a standing topic for the Board of Directors and Audit Committee.


text: As noted above, our CIO leads our cybersecurity risk management program. Our CIO has over a decade of executive-level experience managing information systems and cybersecurity programs in the healthcare industry. The CIO serves as an Executive Officer who reports directly to senior management and, at least quarterly, makes reports to the Audit Committee. Senior management reports to the full Board of Directors with respect to cybersecurity matters on at least a quarterly basis.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial conditions.


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. We have developed an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the board of directors and our management. The program is designed to identify and assess risks most critical to our success including through an analysis of the likelihood of occurrence and potential impact of each risk. The executive leadership team, including our Chief Executive Officer, and our management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing, managing and mitigating risks with Board appropriate oversight.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Our cybersecurity risk management includes enterprise-wide monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on our services, systems, resources, or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Our cybersecurity monitoring and identification efforts include the use of a third- party managed detect and response security service to monitor and take action as necessary, with the response ranging from automated processes to immediately block and remove undesired risks to cybersecurity team review and action, depending on the nature and severity of the risk. We have a Cybersecurity Incident Response Plan which provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, and includes activating crisis, or business continuity recovery plans, as appropriate. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.


text: We do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected us. However, the sophistication of cyber threats continues to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Cybersecurity Governance Our Audit Committee and board of directors provide ultimate oversight of our cybersecurity risk management. Our Chief Information Security Officer, who also functions as our Chief Information Officer ("CIO"), provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as our processes, program and initiatives for managing these risks. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity.


text: Our CIO, who reports directly to the CEO, has significant professional experience including senior technical leadership roles at public companies and m aintains the certified information systems security professional (CISSP) certification. Under the direction of the CIO, our information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks and conducts regular enterprise-wide training on cybersecurity threats for all employees. This analysis drives our long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the department and are communicated to the board of directors regularly.


text: Cybersecurity Risk Management and Strategy We have an enterprise-wide information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats. We also use third party security tools to help identify, assess, mitigate, and remediate cybersecurity threats; however, we cannot guarantee that any third-party tools that we utilize will be successful in all circumstances, and whether such tools are appropriate for their level of risk.

companyName: Beauty Health Co

ticker: SKIN


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis (and at least on an annual basis) and utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.


text: Our information technology systems are equipped to detect directed and non-directed attacks such as viruses and malware that can lead to interruptions and delays in the sale and service of our Delivery Systems and Consumables, general business operations, as well as loss, misuse of data, or theft of intellectual property, confidential information, and personal information (of third parties, employees, providers, and end consumers). However, as of the date of this report, these incidents have not had a material impact on our systems or business operations. Any significant disruption to our business operations or access to our systems could lead to a decline in operational effectiveness, result in a loss of our providers, and adversely affect our business and results of operation. In addition, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. For more information about the cybersecurity risks that we face, see the risk factor entitled, "We are increasingly dependent on information technology, and if we are unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program.


text: Management participates in discussions and updates the Audit Committee, as necessary, regarding any material cybersecurity incident as well as incidents with lesser potential impact. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk program on an as-needed basis. Members of our Board of Directors receive presentations on cybersecurity topics from our Chief Information Security Officer, internal staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team (and team personnel who support our information security program) has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity third party vendors and consultants. In addition, our team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external vendors and consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. The team is led by our Vice President of Technology, who also currently serves as our Chief Information and Security Officer, and has over 25 years of industry experience leading IT for organizations of similar sizes. Team personnel who support our information security program have relevant educational and industry experience, including holding similar positions at previous large companies and government entities.


text: The consideration of cybersecurity threats are integrated into our overall risk management program. We engage external consultants who are experts in the field of cybersecurity and meet at regular intervals to evaluate current conditions and address any cybersecurity threats accordingly. We also provide continuous training to our employees regarding the risks related to cybersecurity. We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations, or financial condition. Governance.

companyName: SenesTech, Inc.

ticker: SNES


text: Our board of directors are responsible for the oversight of risks from cybersecurity threats. At least annually management reports to our board of directors about such risks. Our chief financial officer, Thomas Chesterman, has direct management responsibility in assessing and managing such risks. Mr. Chesterman has prior academic and professional experience in cybersecurity.


text: Cybersecurity Risk Management and Strategy We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and reported to our Audit Committee of the Board of Directors, or the Audit Committee, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct periodic tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. Also, we engage certain external cybersecurity firms to enhance our cybersecurity oversight and cybersecurity breach detection over third party service providers. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees and consultants with tools to make employees and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by our assessments, audits and reviews. Such processes include (i) procedural and technical safeguards, (ii) response plans, (iii) periodic tests on our systems, (iv) incident simulations and (v) routine review of our cybersecurity policies and procedures to identify risks and improve our practices. We engage certain external cybersecurity firms to enhance our cybersecurity oversight. We include confidentiality provisions in all contracts with third-party service providers, and data protection provisions in certain contracts with third-party service providers where applicable, to help protect us and our employees and patients from any related vulnerabilities.


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee of our Board of Directors. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee meets annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team.


text: We use an internal management team to run our information technology and cybersecurity functions, which includes our information and cybersecurity team leads who have collectively served in various roles in information technology and information security for over 25 years, including at other public companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee quarterly regarding our cybersecurity threat risk management and strategy programs. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding significant new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factor — Risks Related to our Business and Managing Growth" in Part I, Item 1A of this Form 10-K, cybersecurity threats could pose multiple risks to us. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.

companyName: KKR FS Income Trust


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on FS Investments to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company is also included in the FS Investments risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments' third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the Board of Trustees of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2022 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


companyName: KKR FS Income Trust Select


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2023 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Regulus Therapeutics Inc.


text: Our legal department, a management committee (composed of our Senior Vice President and General Counsel, our Chief Financial Officer, and our Vice President, Finance and Controller) and a third-party service provider (collectively, the "Cybersecurity Risk Management Team") help identify, assess and manage the Company's cybersecurity threats and risks. Our Cybersecurity Risk Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal audits, conducting third party threat assessments, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a cybersecurity incident response plan, incident detection and response, a disaster recovery and business continuity plan, risk assessments, implementation of security standards, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the Cybersecurity Risk Management Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Senior Vice President and General Counsel, our Chief Financial Officer and our Vice President, Finance and Controller evaluate material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, system and organization controls reporting, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, as well as contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President and General Counsel, Chief Financial Officer, and Vice President, Finance and Controller. Our Senior Vice President and General Counsel has expertise as a Life Sciences executive, has had a key role in information technology and cybersecurity oversight for several years and has completed several cybersecurity trainings. Our Chief Financial Officer has several years of expertise performing audits as a public accountant, including audits over information technology controls, and has also completed several cybersecurity trainings. Our Vice President, Finance and Controller has expertise playing a key role with information technology general controls and control testing for the Company for many years, and has several years of expertise leading and performing audits as a public accountant, including audits over information technology controls. He has also completed several cybersecurity trainings.


text: These positions are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for preparing and approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President and General Counsel, Chief Financial Officer and Chief Executive Officer. The Cybersecurity Risk Management Team and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Senior Vice President and General Counsel, Chief Financial Officer, and Vice President, Finance and Controller concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy The Company has implemented information security programs to, among other actions, assess, identify and manage material risks from cybersecurity threats. These programs include periodic risk assessments, company-wide testing initiatives, periodic phishing tests and annual audits. As the Company assesses its risks and determines how to implement risk management programs, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. The Company also utilizes an independent cybersecurity advisor to provide periodic objective assessments of the Company's capabilities and to conduct advanced attack simulations.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Further, as of part of the Company's overall information security program, the Company conducts a security awareness program, which includes training that reinforces the Company's security management policies, standards, and practices, as well as the expectation that employees comply with these policies, standards and practices. The Company's security awareness program engages personnel through mandatory periodic training on identifying potential cybersecurity risks and protecting the Company's resources and information. The Company also annually engages third parties (as well as its internal audit department) to audit the Company's information security programs. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and ongoing monitoring.


text: To date, there has not been any previous cybersecurity incident that has materially affected the Company's business strategy, results of operations or financial condition.


text: See Item 1A. Risk Factors under the heading of "The Company employs information technology systems to support its business, and any material breach, interruption or failure may adversely impact the Company's business." for additional information on cybersecurity threats that could have a material impact on the Company. The Risk Factors section should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board of Directors maintains an active role in the Company's overall enterprise risk oversight to identify and mitigate broader systemic risks. The Audit Committee is responsible for overseeing and reviewing the Company's information security programs, including cybersecurity. The Director of Global Information Systems, who manages information security training and awareness program, updates the Audit Committee periodically regarding information security matters. The findings from the Company's annual third-party and internal information security audits also are reported to the Audit Committee. The Company also actively engages with key vendors and industry participants as part of its efforts, which are reported to the Audit Committee. In addition to the Audit Committee's oversight, the full Board of Directors receives periodic updates relating to information security and cyber security risks. The Board of Directors receives an annual report from its independent cybersecurity advisor.


text: Through October 2024, the Director of Global Information Systems had oversight responsibilities for PLP's information systems and cyber security, a role he held for 15 years. He attended regular education programs regarding enterprise cybersecurity and supporting technologies. The Director of Global Information Systems reported to the CFO and coordinated with the IT resources across all subsidiary operations to discuss risk management initiatives, testing and training, recent trends and technological developments, and periodic reviews of third-party providers. In October 2024, the Director of Global Information Systems left the Company to pursue other opportunities. During the interim period before a replacement was appointed, the CFO provided more active oversight to address the Director of Global Information System's responsibilities, including reporting to the Audit Committee. The vacancy was filled on February 3, 2025 and the new Director of Global Information Systems joined the Company with over 30 years of professional IT experience where he held Director and Chief Information Officer roles at large global companies and provided technology consulting and cybersecurity services to companies across various industries.


text: Risk management and strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and to protect the confidentiality, integrity, and availability of its data.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: The Company has integrated cybersecurity risk management into its broader enterprise risk management ("ERM") through defined training and incident response plans. The incident response plan defines the objectives, roles and responsibilities and scope of our incident response program, is designed to detect actual or potential cybersecurity events and is triggered by Endpoint Detection and Response ("EDR") system behavior monitoring. Once initiated, the incident response plan consists of several phases, which includes i) detecting a significant observable event, ii) examining a security related event with potential negative IT consequences for the company and iii) analyzing the risk of the event and the degree of remediation required. The Company has developed an incident management plan that operates within the incident response plan to help define the objectives, roles, responsibilities, and scope of our incident response plan.


text: In addition, the Company's training and response methodology includes regular end user cybersecurity updates, phishing tests and online trainings. We believe that these measures helps promote a company-wide culture of appropriate cybersecurity risk management, as well as ensure that cybersecurity considerations are an integral part of the Company's ERM decision-making processes at every level. The Company considers industry best practices to continuously evaluate and address cybersecurity risks in alignment with its business objectives and operational needs.


text: The full Board of Directors is responsible for the oversight of the Company's cybersecurity risk management. The Board is updated by the EVP, Global Supply Chain & Import regularly to remain informed on the Company's efforts in managing risks associated with cybersecurity threats.


text: The Company's Infrastructure Director is responsible for managing cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Infrastructure Director has 20 years of experience in the creation and management of enterprise security risk programs. The Infrastructure Director reports to the EVP, Global Supply Chain & Import, who oversees the Company's management of cybersecurity risk. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the appropriate Business Team Member in accordance with the Company's Incident Management Plan.


text: The Company engages with third-party experts, including cybersecurity focused Security Operations Center (SOC) and leading-edge EDR providers, to assist in evaluating and detecting security risk and initiate corrective actions. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain aligned with industry best practices. The collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: The Company uses third-party service providers in various functions throughout its business. The Company has stringent processes to oversee and manage risk with these third parties. The Company's process includes risk assessment activities, such as security assessments of all third-party providers, policies such as "minimum required access" to ensure compliance with current cybersecurity standards and monitoring activities, such as the review of potential cyber breaches announcements made by the third-party service providers.


text: Notwithstanding the approach we take to cybersecurity risk management, we may be unsuccessful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: RISK MANAGEMENT AND STRATEGY We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GrowGeneration Corp.

ticker: GRWG


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage the risk assessment and mitigation process.


text: We engage consultants and other third parties in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We require third-party service providers to certify their ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect the Company.


text: As part of our overall risk management strategies, we also conduct cybersecurity trainings for personnel at all levels and in all departments.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CFO, who oversees the information technology department as led by our Director of Information Technology, provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.


text: Our Director of Information Technology and the Information Technology team are primarily responsible for assessing and managing our material risks from cybersecurity threats. The collective team has extensive experience in information security and cybersecurity risk management, and they monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents on an ongoing basis using a combination of security tooling, automated systems and manual processes, including information technology log reviews from across teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.


text: Cybersecurity Risk Management and Strategy The operation of our businesses is dependent on the secure functioning of our computer infrastructure, digital information systems, and third-party hosted services. We use these systems to maintain sensitive business and customer data, operate record-keeping and accounting functions, process business transactions, and for other key aspects of our business.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: We rely on a multidisciplinary team, including our information technology ("IT") department, management, and third-party service providers to identify, assess, and manage cybersecurity threats and risks. Our information security program utilizes various security tools and strategies, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We also work with third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, and threat intelligence service providers.


text: Our cybersecurity risk management is integrated into our overall risk management system. Our IT department works closely with our management and other relevant teams to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported on at least a quarterly basis to our Executive Compliance Committee, as described further below, to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented.


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risk Factors – We face risks related to our information technology systems, and potential cyber-attacks and security breaches."


text: Cybersecurity Governance Our management leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our information security program is coordinated by our IT department, led by our Senior Vice President of Information Technology, who has 27 years of industry experience in IT, with responsibility for enterprise security, and cyber risk management including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Supporting team members have relevant educational and industry experience, including holding similar technology positions at other companies.


text: Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our incident response processes include reporting to the Executive Compliance Committee, which includes our executive officers and leaders from the IT, compliance and legal teams, as well as to the Board for certain cybersecurity incidents.


text: Our Board holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. Members of the Board receive updates on a quarterly basis from senior management and the Executive Compliance Committee, including the reporting of emerging or existing cybersecurity risks, mitigation strategies employed to manage these risks, any cybersecurity and data privacy incidents, and status on key information security initiatives. In addition, our SVP of IT annually provides an overview of our information security program to the Board, including a summary of key performance indicators.


text: Our Chief Technology Officer ("CTO") is responsible for cybersecurity within our company, including information technology risks, controls, strategies and procedures. The Cybersecurity Subcommittee of the Board of Directors oversees cybersecurity for our company and meets with the CTO at least quarterly to discuss the status of cybersecurity efforts as well as any security incidents. Cybersecurity Subcommittee materials are provided to the Audit Committee as well as the full Board of Directors. The members of the Cybersecurity Subcommittee brings at least 40 years of expertise and executive-level experience in information technology and cybersecurity to successfully support the CTO to maintain strong a cybersecurity strategy within our company. The Board of Directors believes that a strong cyber strategy based on industry accepted best practices is vital to protect our business, customers and assets.

companyName: JOINT Corp

ticker: JYNT


text: Our CTO Leverages more than 20 years of technology experience in the healthcare and financial services industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing within highly regulated global environments. He has managed technology compliance under the regulatory governance of frameworks such as HIPAA, GDPR, FDA, CCPA and TJC Hospital Accreditation. Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CTO leads management's assessment and management of cybersecurity risk. The CTO reports to the Company's Chief Executive Officer. The CTO regularly reviews cybersecurity matters with management.


text: A dedicated team of technology professionals works throughout the year to monitor all matters of risk relating to cybersecurity. We completed our ISO 27001 Information Security Management certification project culminating in a primary and secondary audit against the standard. We expect to complete the final remediation and updates to policies and procedures and achieve our certification in March 2025. Additionally, we operate and are compliant under the following provisions: HIPAA attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.