text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from Finance, IT, Legal, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Cybersecurity Committee is also informed of our responses to such risks, incidents and threats.


text: Our cybersecurity incident response plan also contains mechanisms to notify executive management of cybersecurity incidents. As part of the plan, an executive-level leadership team may be activated and can act to direct our response efforts, to include mitigation and remediation activities, when appropriate.

companyName: Super Micro Computer, Inc.

ticker: SMCI

secItem: Item 1C


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR ENERGY INC

ticker: CVI


text: Board Oversight of Cybersecurity Matters The Company's board of directors (the "Board") considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Company's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: The Board and Audit Committee are supported in their oversight capacity by the Company's ERM Committee, and internal audit and information technology functions. On a quarterly basis, the ERM Committee evaluates past, existing, and future risks to the Company; the likelihood, severity, and velocity of such risks; and the controls and mitigation tools implemented to address such risk. Several members of the ERM Committee have functional responsibility for the Company's information technology and cybersecurity risk monitoring activities and provide expertise to the ERM Committee in those areas.


text: Likewise, the Company's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Company with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Company assets and information.


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Company's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Company's use of third-party service providers who may have access to sensitive Company data and systems.


text: Material Impact on Company During 2023, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.


text: Management of Cybersecurity Matters At the management level, the Company's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Company's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Company's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and seek to strengthen the Company's defenses against cyber threats. Management also monitors AI usage and has implemented a framework that tracks use and is governed by CVR Energy's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Management also monitors AI usage and has implemented a framework that tracks use and is governed by the Company's Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools. Such governance activities are designed to mitigate the risks presented by AI. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.


text: Material Impact on Company During 2024, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. These processes and response mechanisms are continually assessed for effectiveness, and any new security mechanisms, including several in 2024, are integrated when business needs arise or industry best practices shift.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: We recognize the increasing importance of cybersecurity and its potential impact on our business operations, financial condition, and reputation. We are committed to protecting our information assets and have implemented a comprehensive cybersecurity risk management program to identify, assess, and mitigate cybersecurity risks. We have not experienced any material cybersecurity incidents in the last three years.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Board of Directors Oversight of Cybersecurity Our Board of Directors Audit Committee has ultimate oversight of cybersecurity risks. The Committee is composed of independent directors with cybersecurity expertise. Management briefs the Committee on cybersecurity and information security at least annually.


text: Cybersecurity Risk Management We operate under written cybersecurity policies and procedures, and we use a risk-based approach to information security and periodically assess our cybersecurity risks. Our risk management strategy is based on the following principles:


text: Our business does not require us to collect personal customer information. We minimize other cybersecurity risks by using specialist service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup. We verify our information service providers ' cybersecurity policies.


text: Identify and assess cybersecurity risks through a variety of methods, including audits to information security standards, threat testing, and vulnerability scanning. Prioritize risks based on their potential severity, likelihood, and detectability.


text: Controls to mitigate risks, including access controls, data protection, data backups, redundant systems, and incident response plans. We keep our controls up-to-date. Actions to correct deficiencies and reduce or eliminate vulnerabilities. Written cybersecurity contingency plans.


text: Training and testing for all employees on cybersecurity risks, mitigation, and best practices. New employees are required to complete cybersecurity training and testing, and all employees must complete annual training and testing. Written policies and procedures that govern the use of information technology and the handling of sensitive information. Written incident response plans. Regular cybersecurity reporting to the Audit Committee.


text: Risk Management and Strategy In connection with the operation of the Company's business, we identify, assess and manage key risks that may affect the Company, including material risks from cybersecurity threats through our system security plan. Our system security plan is aligned with the 110 controls detailed in the NIST (SP) 800-171 and Department of Defense CMMC Level 2 guidelines for Cybersecurity. We have company-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures covering our information technology systems, including with respect to the protection of customer data, vendor data and employee information. We have also implemented specialized training and education programs to seek to guard against cybersecurity incidents, including company-wide communications and presentations, phishing simulations, focused training for specific roles and a general cybersecurity training program required for all employees.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: We engage third parties to perform regular reviews of our security controls which includes 24x7x365 security incident and event management (SIEM) as well as vulnerability services and penetration testing. Our processes to identify, assess and manage material risks from cybersecurity threats include risks associated with our use of third-party service providers, including cloud-based platforms. We oversee and identify cybersecurity risks from our third-party service providers in a number of ways, including appropriate due diligence in connection with new third-party service provider onboarding, robust security terms and conditions in our third-party service provider contracts and ongoing risk-based monitoring to ensure compliance with our cybersecurity standards. We believe that these policies and controls provide us with an appropriate assessment of potential cybersecurity threats.


text: As of the date of this Annual Report on Form 10-K (this "Form 10-K"), we are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future.


text: The Company's Board of Directors is responsible for overseeing management's identification, assessment and management of key risks, including cybersecurity risks.


text: Our Director of Information Technology, Mitch Reszczenski, is primarily responsible for assessing and managing our cybersecurity risks. Mr. Reszczenski has over 28 years of extensive information technology experience in highly successful manufacturing, engineering and financial organizations. Mr. Reszczenski provides regular updates on cybersecurity risks and threats and key developments in Company policies, practices and related risk exposures to the Chief Executive Officer and Chief Financial Officer. Additionally, senior management provides an update to the Board of Directors on cybersecurity matters at least once a year, and more often as appropriate. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.


text: Mr. Reszczenski works with senior management to implement and oversee processes for the regular monitoring of our information systems. If a cybersecurity incident involving the Company were to occur, Mr. Reszczenski would engage senior management to initially determine the potential materiality of the incident, the potential need for public disclosure, the timing and extent of the Company's response and whether any future vulnerabilities are expected. As part of this evaluation, senior management would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future cybersecurity incidents. After an initial evaluation by senior management, the relevant information regarding the cybersecurity incident and its materiality would be promptly reported to the Company's Board of Directors for further review and evaluation, including as to whether public disclosure would be required or advisable.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. These policies are found within our Compliance Manual and are the chapters "Cybersecurity, Privacy Protection, and the Prevention of Identity Theft" and "Business Continuity and Succession Planning" (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy is available upon request.

companyName: X1 Capital Inc.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: The Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which is currently James Hickey, regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company. The CCO is responsible for assessing and managing material risks from cybersecurity threats that may impact the Company.


text: Our business does not require us to collect personal customer information. We minimize other cybersecurity risks by using specialized service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup. We verify our information service providers ' cybersecurity policies.


text: Controls to mitigate risks, including access controls, data protection, data backups, redundant systems, and incident response plans. We keep our controls up-to-date. Actions to correct any deficiencies and reduce or eliminate vulnerabilities. Written cybersecurity contingency plans, including plans for various specific scenarios.


text: Training and testing for all employees on cybersecurity risks, mitigation, and best practices. New employees are required to complete cybersecurity training and testing, and annual training and testing is required for all employees. Written policies and procedures that govern the use of information technology and the handling of sensitive information. Written incident response plans. Regular cybersecurity reporting to the Audit Committee.


text: We have a full-time information technology specialist who reports directly to our CEO and is responsible for assessing and managing cybersecurity risks. Both our information technology specialist and our CEO have extensive experience managing our cybersecurity. We have not engaged third-party service providers for cybersecurity, because we believe it is better to have the expertise in-house.


text: Cyber Risk Management and Strategy We understand the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats. To address this, we have established a cybersecurity risk management process that aligns with industry standards and is integrated into the Company's overall risk management systems.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: By strategically embedding cybersecurity risk management within our broader risk management framework, we foster a company-wide culture of cybersecurity awareness. This integration ensures that cybersecurity considerations are a fundamental part of our decision-making processes at all levels. As a holding company, the Company's board of directors and management work closely especially with IT department from our subsidiary Macao E-Media Development Company Limited ("MED"), to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Particularly, we had established a dedicated management standard for information security and cyber-security titled "Aomi APP Production Environment Anomaly Handling Guideline W-OM-CZ-001" ("Guideline") since August 2020. This Guideline provides detailed definitions of incident levels, operational processes, anomaly handling workflows, review requirements, and a list of emergency response personnel. Since its formulation in 2020, we have adhered to these guidelines.


text: On a daily basis, we maintain an efficient communication channel between our customer service department and IT department, through which any anomaly issues are promptly reported and responded to. Any severe anomaly will receive immediate attention. During national holidays, designated personnel from IT department will be responsible to monitor. In the event of the occurrence of any serious anomaly, we will refer to the Guideline for protocols and workflow.


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We, especially MED, has utilized services from AliCloud Hong Kong since its inception, employing the AliCloud WAF firewall to effectively block potential conventional cyber-attacks. We actively cooperate and engage with AliCloud Hong Kong security team, to conduct penetration testing on our entire system regularly, to identify and address any vulnerabilities promptly. Being a key client of AliCloud Hong Kong, we have established and maintained a group chat including account manager and support team of AliCloud, through which any anomaly issues can be immediately responded and resolved.


text: The organizational structure of the IT department of our subsidiary MED includes a specialized cyber-security team. Different levels of anomaly incidents are addressed through different workflows and reporting paths as stipulated in the Guideline, generally led and overseen by the head of the IT department in MED.


text: Our Chief Executive Officer Stanley Chan, with the input and assistance of the management, is responsible for the strategic leadership and direction of the Company's cybersecurity program. Our Chief Executive Officer is also primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Risk Management and Strategy In connection with the operation of the Company's business, we identify, assess and manage key risks that may affect the Company, including material risks from cybersecurity threats, through our system security plan. Our system security plan is aligned with the 110 controls detailed in the NIST (SP) 800-171 and Department of Defense CMMC Level 2 guidelines for Cybersecurity. We have company-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures covering our information technology systems, including the protection of customer data, vendor data and employee information. We have also implemented specialized training and education programs to guard against cybersecurity incidents, including company-wide communications and presentations, phishing simulations, focused training for specific roles and a general cybersecurity training program required for all employees.


text: We engage third parties to perform regular reviews of our security controls which includes 24/7/365 security incident and event management as well as vulnerability services and penetration testing. Our processes to identify, assess and manage material risks from cybersecurity threats include risks associated with our use of third-party service providers, including cloud-based platforms. We oversee and identify cybersecurity risks from our third-party service providers in a number of ways, including appropriate due diligence in connection with service provider onboarding, robust security terms and conditions in our third-party service provider contracts and ongoing risk-based monitoring to ensure compliance with our cybersecurity standards. We believe that these policies and controls provide us with an appropriate assessment of potential cybersecurity threats.


text: As of the date of this Annual Report on Form 10-K (this "Form 10-K"), we are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future.


text: The Company's Board of Directors is responsible for overseeing management's identification, assessment and management of key risks, including cybersecurity risks.


text: Our Director of Information Technology, Mitch Reszczenski, is primarily responsible for assessing and managing our cybersecurity risks. Mr. Reszczenski has over 29 years of extensive information technology experience in highly successful manufacturing, engineering and financial organizations. Mr. Reszczenski provides regular updates on cybersecurity risks and threats and key developments in Company policies, practices and related risk exposures to the Chief Executive Officer and Chief Financial Officer. Additionally, senior management provides an update to the Board of Directors on cybersecurity matters at least once a year, and more often as appropriate. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.


text: Mr. Reszczenski works with senior management to implement and oversee processes for the regular monitoring of our information systems. If a cybersecurity incident involving the Company were to occur, Mr. Reszczenski would engage senior management to initially determine the potential materiality of the incident, the potential need for public disclosure, the timing and extent of the Company's response and whether any future vulnerabilities are expected. As part of this evaluation, senior management would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future cybersecurity incidents. After an initial evaluation by senior management, the relevant information regarding the cybersecurity incident and its materiality would be promptly reported to the Company's Board of Directors for further review and evaluation, including as to whether public disclosure would be required or advisable.


text: TVA's cybersecurity risk management programs and processes exist under a written cybersecurity policy, which provides the foundation for TVA's information security programs. Under the policy, TVA engages assessors, consultants, auditors, and other third parties. All TVA employees, contractors, grantees, other federal agencies, state and local governments, industry partners, and others who possess TVA information or who operate, use, or have access to TVA's information systems are made responsible for complying with TVA's cybersecurity policy and information security-related communications, plans, practices, procedures, and standards issued as part of the information security programs.

companyName: Tennessee Valley Authority

ticker: TVE


text: TVA's cybersecurity risk management framework provides the structure for protecting against cybersecurity threats, including through promoting risk management efforts, situational awareness, and cyber risk modeling and simulations. Within this framework, TVA operates numerous programs under internal written policies and procedures, which are aimed at helping protect TVA's information resources. These include a vulnerability management program to help address cybersecurity threats to TVA digital assets; a patch and remediation management program to help computer systems remain current with software patches or software updates; an offensive threat management program to emulate threat actor activities; a cybersecurity training program to help educate employees and contractors, including by providing scenarios designed to train the workforce on responding to cybersecurity incidents; implementation of standard terms and conditions where appropriate in TVA's supply chain contracts to help mitigate TVA's cybersecurity risk, including through requiring timely notice of vendor cybersecurity incidents and data impacts and compliance with laws, regulations, and TVA's policies on cybersecurity; and a program to accomplish cybersecurity event detection alerting. These programs are based on principles from the National Institute of Standards and Technology and certain regulatory standards that are designed to protect against cybersecurity incidents, including the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Nuclear Regulatory Commission cybersecurity standards, and are periodically assessed by third-party experts.


text: In the last three fiscal years, TVA has not experienced any material cybersecurity incidents. TVA is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents, that may have materially affected or are reasonably likely to materially affect TVA, including its business strategy, results of operations, or financial condition; however, TVA cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material risks. For more information on TVA's cybersecurity related risks, see Item 1A, Risk Factors – Cybersecurity and Information Technology Risks in this Annual Report.


text: The TVA Board is ultimately responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk, and receives reports from the Audit, Risk, and Cybersecurity Committee ("Audit Committee"). The Audit Committee is a standing committee of the TVA Board and advises the TVA Board on a variety of matters, including TVA's processes for identifying, monitoring, and mitigating enterprise risk and reviewing and overseeing strategies for addressing TVA's cybersecurity, data, and privacy policies and response protocols. The Audit Committee meets at least quarterly. Reporting to the Audit Committee and the TVA Board is the risk counsel comprised of TVA's top leaders and the Chief Risk Officer ("CRO"), which is responsible for the highest level of management oversight of risk at TVA. The risk committee's primary purpose is to oversee TVA's management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk committee oversees a subordinate committee that provides comprehensive risk oversight of TVA's security, artificial intelligence, privacy, and technology risks consistent with TVA's mission, strategic imperatives, and approved financial and operational plans.


text: TVA's governance, oversight, execution, and support activities include quarterly Enterprise Risk and Assurance updates to the Audit Committee, an annual alignment with TVA's broader risk management framework and business planning initiatives, and tactical and intentional initiatives focused on reducing risk, increasing maturity, and helping ensure regulatory compliance and adherence. TVA engages in various audits in order to provide assurance of TVA's effective management of cybersecurity risk and risk as a whole and is also subject to required external audits to ensure compliance with certain regulatory standards that are designed to protect against cybersecurity incidents.


text: TVA's current VP, Cybersecurity serves as Chief Information Security Officer ("CISO"). The current CISO is also designated as the Chief Artificial Intelligence Officer and the agency's Federal Senior Intelligence Coordinator. Starting in operational technology as part of nuclear generation, the current CISO has spent his career in public power in various North American Electric Reliability Corporation regions and has been in the industry for over 25 years. He has led Cybersecurity for over 10 years in the sector. He was previously the CISO of the New York Power Authority, and he has experience supporting all verticals of electric operations, from the perspectives of security, resiliency, and recovery. He is a Certified Information Security Manager and has previously held Chair and Co-chair roles in the industry, such as with the Electric Subsector Coordinating Council's Cyber Mutual Aid Committee. He seeks to focus on information sharing and building partnerships to enable understanding of emerging threats. The current CISO remains active in various security organizations and the broader industry. He has a degree in Computer Science and a Master of Business Administration.


text: The TVA Board is ultimately responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk, and receives reports from the Audit, Risk, and Cybersecurity Committee ("Audit Committee"). The Audit Committee is a standing committee of the TVA Board and advises the TVA Board on a variety of matters, including TVA's processes for identifying, monitoring, and mitigating enterprise risk and reviewing and overseeing strategies for addressing TVA's cybersecurity, data, and privacy policies and response protocols. The Audit Committee meets at least quarterly. Reporting to the Audit Committee and the TVA Board is the risk council comprised of TVA's top leaders and the Chief Risk Officer ("CRO"), which is responsible for the highest level of management oversight of risk at TVA. The risk council's primary purpose is to oversee TVA's management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk council oversees a subordinate committee that provides comprehensive risk oversight of TVA's security, artificial intelligence, privacy, and technology risks consistent with TVA's mission, strategic imperatives, and approved financial and operational plans.


text: Risk Management and Strategy We maintain a cybersecurity management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats and incidents. We review our program design on at least a quarterly basis and update as needed to address the risks and threats that our corporate security team has identified. Our team also benchmarks our program to industry recognized frameworks, including the International Organization for Standardization. The Audit Committee of the Board of Directors receives regular reports on cybersecurity risks and evaluates these risks as a part of their enterprise risk review.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Our teams also rely on third-party diagnostic tools and periodic audits to ensure that our program is performing as designed and in-line with applicable standards. Our Chief Information Officer oversees a security committee made up of professionals on our corporate security, and other information technology teams to review the results of these audits and recommend improvements. Prior to engaging a third party to provide services, our information technology team performs a risk assessment to determine the level of review of the vendor needed based on the nature of the services to be provided and type of information that may be shared. The resulting vendor review may include requiring the vendor to provide the results of external audits. We continue to monitor our vendors throughout their engagements with us to ensure they have complied with their contractual obligations, including service level agreements and other contractual standards.


text: We have also established an incident response plan to assess, identify and manage specific potential cybersecurity incidents. This plan requires the corporate security team to notify a response team. The response team assesses the risks of the identified potential incident and determines an appropriate response based on the risks identified. The response team then reports on the incident to senior management and, if necessary, a subset of our financial disclosure committee to determine if the cybersecurity incident should be reported in our public filings.


text: We face cybersecurity risks in connection with our business operations. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to our data and systems, including social engineering threats, denial of service attacks, malware and computer virus attacks. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors.


text: Board Oversight—The Audit Committee of the Board of Directors oversees the Company's cybersecurity program. The cybersecurity team updates the Audit Committee on at least a quarterly basis to discuss the effectiveness of the Company's risk management program, potential and identified threats, remediation and mitigation plans, and other topics as requested by the Audit Committee. The Audit Committee regularly reports to the full Board of Directors and management reports on specific matters as requested by the Board of Directors.


text: Management's Role—The Company's Chief Information Officer is responsible for the Company's cybersecurity team and for reporting to the Audit Committee of the Board of Directors. The Company's corporate security team reports directly to the Chief Information Officer. Our Chief Information Officer has more than thirty years of experience managing communications networks, data centers, information technology teams, systems administration, and cybersecurity in the media and advertising industry. Our corporate security team is similarly composed of seasoned professionals with significant experience in the field. The Chief Information Officer regularly informs the Company's senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The corporate security team has a broad range of experience selecting, deploying, and operating cybersecurity technologies initiatives and seek to ensure that each team stays educated on emerging technologies and threats.


text: At Aviat, cybersecurity processes, controls and technologies have been implemented to help facilitate the Company's efforts to identify, assess and manage material risks associated with cybersecurity threats.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: Risk Management and Strategy The Company has sought to leverage the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for its cybersecurity framework and to help identify, assess and manage cybersecurity risks related to its business. The Company regularly engages third party experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity risk management systems and processes. The Company's partnership with these third-parties include regular audits and threat assessments. The Company requires all of its third-party information technology vendors to undergo evaluations by the Company's internal data privacy and data security team as a part of efforts to assess, document and mitigate potential cybersecurity threats associated with the use of such vendors and the software, applications and services they provide.


text: In addition, we undertake ongoing cyber risk assessments as part of our efforts to detect, evaluate and respond to potential cybersecurity threats, including regular testing by our internal information security team. We require all employees and contractors to participate in cybersecurity training designed to enhance their understanding of cyber threats and their ability to identify and escalate potential incidents. Our vulnerability management program is designed to identify, assess, and remediate cybersecurity threats in our systems, such as through penetration testing.


text: Incident Reporting If cybersecurity incidents occur, certain of the Company's executive leadership team, legal counsel, and Audit Committee would be briefed and a determination would be made as to whether such incident or vulnerability is deemed material to the Company. The Company's incident response plan is tested annually to assess its operational effectiveness. We conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare to respond to a cybersecurity incident and to identify areas for potential improvement.


text: As of the date of this Annual Report on Form 10-K, the Company does not believe it has encountered, and has not identified any risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. See "Item 1A, Risk Factors," for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Aviat's Board of Directors has oversight of the Company's cybersecurity risk as a component of its risk management. This includes prioritization of cybersecurity risks and the allocation of resources. The Board of Directors receives regular updates on the Company's cybersecurity program. The Board of Directors have delegated its responsibility for risk management oversight to the Audit Committee, which regularly reviews Aviat's cybersecurity program with the Company's management. The Company's management, including its Senior Director of Information Technology, Chief Financial Officer, and General Counsel, provide the Board of Directors updates regarding current and emerging cybersecurity threats, status of ongoing cybersecurity initiatives, certain incident reports and events, remediation efforts, and compliance with regulatory and industry standards.


text: The Company's Senior Director of Information Technology is primarily responsible for assessing and managing our material risks from cybersecurity threats, monitoring the effectiveness of our cybersecurity detection and response processes in countering current threats and providing updates to the executive team.


text: Risk Management and Strategy The Company has sought to leverage the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for its cybersecurity framework and to help identify, assess and manage cybersecurity risks related to its business. The Company regularly engages third party experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity risk management systems and processes. The Company's partnership with these third parties include regular audits and threat assessments. The Company requires all of its third-party information technology vendors to undergo evaluations by the Company's internal data privacy and data security team as a part of efforts to assess, document and mitigate potential cybersecurity threats associated with the use of such vendors and the software, applications and services they provide.


text: In 2024, we achieved International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 27001 certification. In 2025, we maintained our accreditation, reflecting our commitment to maintaining a robust information security management system. This internationally recognized standard demonstrates that we implemented risk-based controls to protect confidentiality, integrity and availability of critical data. The certification enhances our ability to manage cybersecurity threats, improve compliance posture and support customer trust in our information technology security practices.


text: Aviat's Board of Directors has oversight of the Company's cybersecurity risk as a component of its risk management. This includes prioritization of cybersecurity risks and the allocation of resources. The Board of Directors receives regular updates on the Company's cybersecurity program. The Board of Directors have delegated its responsibility for risk management oversight to the Audit Committee, which regularly reviews Aviat's cybersecurity program with the Company's management. The Company's management, including its Senior Director of Information Technology, CFO, and General Counsel, provide the Board of Directors updates regarding current and emerging cybersecurity threats, status of ongoing cybersecurity initiatives, certain incident reports and events, remediation efforts, and compliance with regulatory and industry standards.


text: Risk Management and Strategy Because it is essential to our operations and business strategy that our website, app, technology and network infrastructure remain secure, we have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. We have integrated these processes into our cybersecurity risk management program.

companyName: CarParts.com, Inc.

ticker: PRTS


text: The key processes, or components, of our cybersecurity risk management include: conducting periodic risk assessments to assist in identifying cybersecurity threats or risks; cybersecurity strategic roadmap;


text: security and IT infrastructure management team, responsible for managing our cybersecurity processes, implementing security applications and protocols, monitoring and executing security or network controls, and responding to incidents or threats; cybersecurity training programs and cybersecurity awareness event for employees; incident response plan, including assessing and monitoring potential cyber threats; similar processes or applications to mitigate or manage cybersecurity risk from third-party service providers;


text: We sometimes engage external cybersecurity experts, or applications, to enhance our cybersecurity program. These serve to assist our internal cybersecurity team in mitigating cyber threats, in addition to monitoring and responding to potential cyber incidents.


text: As previously disclosed, in June 2020, we were the subject of a ransomware attack on our network that briefly disrupted access to some of our systems. Although we did not pay the ransomware and did not incur any fines or settlements, we did incur out of pocket expenses costs related to this incident of $100,000. We have not encountered any other cybersecurity challenges that have materially impaired our operations or business.


text: Additional information regarding risks from cybersecurity threats is discussed in Part I, Item IA, "Risk Factors," under the heading "Security threats, such as ransomware attacks, to our IT infrastructure could expose us to liability, and damage our reputation and business," which should be read in conjunction with the information herein.


text: Cybersecurity risk management is an important priority integrated into our overall governance structure. Our Board of Directors oversees risks from cybersecurity threats and includes the involvement of the Audit Committee in the governance strategy.


text: Our IT security management team, led by our Chief Technology Officer, reports quarterly in meetings to our Audit Committee and periodically to our Board of Directors regarding updates to our cybersecurity program and related risks. We have a cybersecurity expert on the Board of Directors and its Audit Committee to provide expanded expertise and oversight on our cybersecurity processes and systems. Topics in the meetings include discussion of the company-wide cybersecurity strategic roadmap and risks, protocols to mitigate such rusks, and the progress of initiatives in the cybersecurity program. Specific cybersecurity briefing areas may include topics such as security, infrastructure, cybersecurity tooling/applications, and compliance.


text: Risk Management and Strategy Our operations rely on the secure processing, storage, and transmission of personal, confidential, and other information. Our business, including our ability to adequately price products and services, establish reserves, provide an effective and secure service to our customers and report our financial results in a timely and accurate manner, depends significantly on the integrity, availability, and timeliness of the data we maintain, as well as the data held by third party service providers. The Company manages cybersecurity risk via expectations set by its Information Security and related policies, real-time monitoring of threats, and recovery where needed through incident response plans.

companyName: Employers Holdings, Inc.

ticker: EIG


text: The Company leverages ISO 27005, an international standard for identifying, measuring, and assessing cybersecurity risks, as a model for measuring its cybersecurity risk. An annual baseline is established to guide development of the information security program. The ISO 27005 model is refreshed as new cybersecurity risks are identified.


text: The Company's Chief Information Security Officer (CISO) leverages a model of continuous vulnerability detection to identify new cybersecurity risk as soon as practicable. The information security program is subject to a bi-annual assessment using the ISO 27001 standard for managing cybersecurity. Annually, external security firms conduct penetration tests of the Company's technology surface area internally and externally. The Company's information security program is subject to internal and independent external audits.


text: The Company is not aware of any cybersecurity risks, including as a result of any cybersecurity incidents during 2023, that have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition. Third parties with access to sensitive data or systems are subject to due diligence and ongoing monitoring.


text: Potential new vendors and existing vendors (which are reviewed periodically) that are known to have access to sensitive data or Company systems are subject to a risk assessment process including the review of independent security audits where available. Continuous monitoring of existing vendors occurs via an automated service that rates companies' publicly facing cybersecurity posture and identifies known vulnerabilities.


text: The Company's cybersecurity risks and strategies are overseen by both management, including our CISO, Chief Information Officer (CIO), VP, Enterprise Risk Management, and Executive Risk Committee (ERC), and the Company's Board and relevant Board committees, including the Risk Management, Technology & Innovation Committee (RMTIC). This structure reinforces that the Company's most critical risks are effectively monitored and communicated to the Board, and management, including for purposes of making any required disclosures in a timely manner. Cybersecurity risk assessments, subsequent findings, and response plans, including risks arising in connection with the Company's use of vendors and third parties, are integrated within the Company's Enterprise Risk Management framework.


text: Members of our senior management have specific and relevant cybersecurity expertise and experience, including the following: • The Company's CISO holds a B.S. degree in Computer Science, an M.S. degree in Administration, an M.S. degree in Electrical Engineering, and a Graduate Certificate in Cybersecurity. In addition to the CISO's more than 30 years of experience in technology and cybersecurity, he also holds multiple professional certifications in security, privacy, governance, audit, and technology. • The Company's CIO holds a Master of Liberal Arts (ALM) degree in Information Technology Management and a Graduate Certificate in Project Management. In addition to the CIO's more than 16 years of experience in technology, she has directly managed global privacy, compliance, ethics, and records retention technology, been responsible for addressing global cybersecurity risks, and has also attended multiple training programs in cybersecurity, privacy, governance, and technology. • The Company's VP, Enterprise Risk Management holds a Certificate in Risk and Information Systems Controls (CRISC) certification along with 25 years of experience in managing technology delivery, vendor management, privacy, and governance.


text: Cybersecurity is one of several key risk categories that are evaluated and rated by the ERC on a quarterly basis. Each of our CISO, CIO, and VP, Enterprise Risk Management is a member of the ERC. The ERC reports periodically on its activities, findings, and areas of concern to the RMTIC. The RMTIC in turn reports to the Board on its oversight of cybersecurity risk.


text: Risk Management and Strategy Our operations rely on the secure processing, storage, and transmission of personal, confidential, and other information. Our business, including our ability to adequately price products and services, establish reserves, provide an effective and secure service to our customers and report our financial results in a timely and accurate manner, depends significantly on the integrity, availability, and timeliness of the data we maintain, as well as the data held by our third party service providers. We manage cybersecurity risk via expectations set by our information security and related policies, real-time monitoring of threats, and recovery where needed through incident response plans.


text: We leverage ISO 27005, an international standard for identifying, measuring, and assessing cybersecurity risks, as a model for measuring our cybersecurity risk. The ISO 27005 model is periodically refreshed as new cybersecurity risks are identified.


text: Our Chief Information Security Officer (CISO) leverages vulnerability detection techniques to identify new cybersecurity risks. Our information security program is subject to periodic assessments using the ISO 27001 standard for managing cybersecurity. External security firms conduct penetration tests of our technology surface area internally and externally. Our information security program is also subject to internal and independent external audits.


text: We are not aware of any cybersecurity risks, including as a result of any cybersecurity incidents during 2024, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Third parties with access to sensitive data or systems are subject to due diligence and ongoing monitoring.


text: Potential new vendors and existing vendors that are known to have access to sensitive data or our systems are subject to a risk assessment process including the periodic review of independent security audits where available. Existing vendors are monitored via an automated service that rates companies' publicly facing cybersecurity posture and identifies known vulnerabilities.


text: Our cybersecurity risks and strategies are overseen by both management, including our CISO, Chief Information Officer (CIO), VP, Enterprise Risk Management, Executive Risk Committee (ERC), and the Board and relevant Board committees, including the Risk Management, Technology & Innovation Committee (RMTIC). This structure reinforces that our most critical risks are effectively monitored and communicated to the Board, and management, including for the purposes of making any required disclosures in a timely manner. Cybersecurity risk assessments, subsequent findings, and response plans, including risks arising in connection with our use of vendors and third parties, are integrated within our Enterprise Risk Management framework.


text: Members of our senior management team have specific and relevant cybersecurity expertise and experience, including the following: • Our CISO has more than 30 years of experience in technology and cybersecurity, he also holds multiple professional certifications in security, privacy, governance, audit, and technology. • Our CIO has more than 17 years of experience in technology, she has directly managed global privacy, compliance, ethics, and records retention technology, has been responsible for addressing global cybersecurity risks, and has also attended multiple training programs in cybersecurity, privacy, governance, and technology. • Our VP, Enterprise Risk Management holds a Certificate in Risk and Information Systems Controls certification and has more than 25 years of experience in managing technology delivery, vendor management, privacy, and governance.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Barings BDC, Inc.

ticker: BBDC


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and the Chief Information Security Officer of the Adviser ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CISO of the Adviser, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO and the Adviser's CCO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's CCO has been responsible for this oversight function as CCO to the Company for 1 year and has worked in the regulatory and financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third-party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities. The Company's Chief Compliance Officer ("CCO") also plays an oversight role in the area of cybersecurity preparedness with respect to these entities.


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Adviser's Chief Information Security Officer ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management and the CISO of the Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy In an effort to protect our business against cybersecurity threats, we have implemented a cybersecurity risk management program that is integrated with our internal risk management processes and designed to identify and protect against cyber threats as well as to respond to and recover from cyber incidents, as applicable. Our cybersecurity risk management program is informed by industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and is supported by periodic internal and external information security assessments and testing.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: We have also established incident response policies and procedures, overseen by our Information Technology, or IT, Director, to review and classify cybersecurity incidents and to define roles and responsibilities for response and remediation in the event of a cyber incident. We also have implemented a process to provide cybersecurity awareness training to employees during onboarding and on an annual basis thereafter.


text: In addition, we collaborate with third-party advisory firms to periodically review and evaluate our security measures, which informs our ongoing strategy and execution of our cybersecurity program. We also leverage third-party providers to augment our internal security resources, including to support our ongoing monitoring and threat detection capabilities. We have a process to evaluate certain critical third-party providers before engagement as well as periodically thereafter, which may include a review of available audit reports, security documentation, operating controls, and industry reputation, as well as contractual requirements, as appropriate.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see our Risk Factors.


text: Governance Related to Cybersecurity Risks Our board of directors considers cybersecurity risk as part of its risk oversight and has delegated the Audit Committee of the board of directors oversight of cybersecurity risks. The Audit Committee oversees management's implementation of the cybersecurity program. We have also established a process for escalation of major cyber incidents, if applicable, to be reported to the Executive Leadership Team and the Audit Committee. Additionally, we conduct periodic meetings to keep the Executive Leadership Team and Audit Committee apprised of our risk management and overall cyber strategy, as appropriate.


text: Our IT Director leads day-to-day IT operations across all areas of the business and is responsible for advising on the strategic and operational processes related to our cyber risk management program. Our current IT Director has over 25 years of IT management experience, including over 15 years of experience in cybersecurity management in both public and private companies. In addition, we have assembled an IT Steering Committee, or ITSC, which is comprised of the Executive Leadership Team as well as IT management, to support management and to maintain visibility of the status and ongoing strategy of our cybersecurity program.


text: As part of our overall risk management framework, we have processes in place to identify, assess, and manage material risks from cybersecurity threats.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Cybersecurity Program Overview Our cybersecurity program is designed to identify, assess, and manage cyber risks. The program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. We continually evaluate the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats.


text: We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. Where we engage or rely on third parties, including suppliers, vendors, and service providers, our information security personnel have processes in place to identify and manage risks from cybersecurity threats associated with our use of such third parties.


text: Board Oversight of Cybersecurity Risks Our Board of Directors receives periodic updates on cybersecurity matters from our Chief Executive Officer (based on consultation with our Chief Information Security Officer ("CISO") and other senior members of our Information Security and/or Technology teams). In addition, a member of senior management responsible for the Company's Information Security team provides an annual briefing to our Board of Directors regarding the overall state of our cybersecurity program, information on the current cybersecurity threat landscape, risks from cybersecurity threats and any cybersecurity incidents that are reasonably likely to materially affect, or which have materially affected, the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Information Officer, Executive Vice President of Technology, and CISO, are responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks. Specifically:


text: Dr. Thomas Frank, Executive Vice President and Chief Information Officer: Dr. Frank has been with the Company since 1985 and was instrumental in the development of the Company's early market making systems. Dr. Frank became Chief Information Officer in 2006. Dr. Frank is responsible for the Company's technical infrastructure and operations and information security, among other duties. Dr. Frank is a member of the Board of Directors of OCC. Dr. Frank received an S.B. and a Ph. D. in Physics from the Massachusetts Institute of Technology.


text: Somayajulu (Soma) Bulusu, Executive Vice President of Technology: Mr. Bulusu joined the Company as EVP of Technology in February 2024. Mr. Bulusu has over 25 years of experience in engineering, product, and service delivery. Mr. Bulusu joined the Company from Chewy, Inc., where he led the Information Technology and Engineering teams. His previous roles include leadership positions at Amazon, Nuance, and TouchCommerce.


text: Dr. Boris Kogan, Chief Information Security Officer: Dr. Kogan has served as the Company's Chief Information Security Officer since 2016. Dr. Kogan has over 20 years of cybersecurity management experience in the financial services sector. Earlier in his career, after obtaining a Ph. D. in Computer Science from Princeton University, Dr. Kogan served on the faculty of George Mason University, where he conducted government-sponsored research in cybersecurity.


text: The Company's management, including through its oversight of the Company's policies and procedures regarding cybersecurity, is actively involved in the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company. Management's oversight is augmented through the Company's Enterprise Risk Management Framework, which includes risk and control assessments related to the Company's cybersecurity program. Additionally, the Company's Internal Audit Group periodically audits aspects of the Company's cybersecurity program and provides reports to the Board's Audit Committee, and an external audit firm conducts an annual SOC 2 attestation of the Company's information security controls.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats to the Company is assessed on an ongoing basis. During the reporting period and through the issuance of this Annual Report on Form 10-K, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition. For additional information about cybersecurity risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: We are a global financial services firm, with a longstanding commitment to providing a reliable and secure trading environment for our customers.


text: Technology is at the core of our business, with customers, exchanges, clearing houses, counterparties, and third-party service providers interacting with our systems and applications on an ongoing basis. As a consequence, we are subject to significant cybersecurity risks. Moreover, such risks have been increasing over time, due to the growing sophistication of cyber threat actors, geo-political instability, and advances in technology, such as AI, which are known to have been misused in cyber-attacks.


text: As part of our overall risk management framework, our cybersecurity program is designed to identify, assess, and manage cyber risks. The program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. We continually evaluate the current threat landscape to identify material risks arising from new and evolving cybersecurity threats.


text: Management and Board Oversight of Cybersecurity Risks The Company's management, including the Company's Executive Vice President of Technology and Chief Information Security Officer ("CISO"), are responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks.


text: The Company's management, including through its oversight of the Company's policies and procedures regarding cybersecurity, is actively involved in the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting or with the potential to impact the Company. Management's oversight is augmented through the Company's Enterprise Risk Management Framework, which includes risk and control assessments related to the Company's cybersecurity program. Additionally, the Company's Internal Audit Group periodically audits aspects of the Company's cybersecurity program and reports the results of such audits to the Board's Audit Committee, and an external audit firm conducts an annual SOC 2 attestation of the Company's information security controls.


text: If a cybersecurity incident occurs, incident response procedures are in place to ensure that the occurrence is appropriately reported to the CISO and senior management. Where necessary, business continuity plans are mobilized to minimize disruption to business operations. The Company has established the Cyber Materiality Committee ("CMC"), whose purpose is to review cybersecurity incidents escalated to it by our Threat & Incident Management Team and determine whether they are material and thus require a disclosure on Form 8-K. CMC's membership includes the Chief Executive Officer ("CEO"), the Chief Financial Officer, the Executive Vice President of Technology, the CISO, and other senior leaders.


text: Our Board of Directors receives periodic updates on cybersecurity matters and the overall state of our cybersecurity program from our CEO (based on consultation with our CISO and other senior members of our Information Security and/or Technology teams).


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats to the Company is assessed on an ongoing basis. During the reporting period and through the issuance of this Annual Report on Form 10-K, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, operational results, and financial condition. For additional information about cybersecurity risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy The Company is committed to enacting a cybersecurity strategy that provides the necessary framework to ensure confidentiality, integrity and availability of customer, associate and proprietary information.

companyName: TFS Financial CORP

ticker: TFSL


text: The Company employs a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. In addition to periodic risk assessments, we rely on continuous monitoring of systems and environments, regular vulnerability scanning, external auditing and penetration testing and active participation in industry intelligence sharing partnerships.


text: The Company maintains Cybersecurity Incident Response Guidelines and Procedures to assist in response to real or suspected security incidents. The Incident Response Guidelines prescribe points of escalation and mechanisms for collaboration should the need arise to engage outside partnerships such as external counsel, cybersecurity forensic examiners, cyber insurance vendors and regulatory bodies.


text: The Company has not experienced any material losses relating to cybersecurity threats or incidents to date. We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: Third Party Service Provider Monitoring The Company maintains a robust third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each vendor based on an assessment of the vendor and its access to network, systems, and confidential information. A subject matter expert review is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to the Company's systems or customer data must have appropriate technical and organizational security measures in place, as well as security control principles based on commercially acceptable security standards.


text: Cybersecurity Governance Primary responsibility for managing cyber risk is vested in the Company's Information Security Officer. The ISO reports to the CRO and serves as the primary custodian of the Company's Information Security Program, which quantifies and documents our ability to identify and control risks to information systems and customer information.


text: The Technology Steering Committee meets on at least a quarterly basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Company. The Technology Steering Committee is chaired by the CIO and reports to the Board of Directors through Committee minutes. The Technology Steering Committee is comprised of numerous members of the senior executive team, as well as the ISO.


text: The Director's Risk Committee also shares oversight responsibility for cybersecurity and receives regular reporting from the CRO and ISO on cybersecurity and information technology risks, controls and procedures, and network penetration testing, in addition to providing input on efforts to mitigate cybersecurity risks and potential breaches. The Board's Audit Committee also has oversight responsibility for audits related to information technology security and information technology governance.


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, stockholders, and employees. Our audit committee is involved in direct oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Redfin Corp


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance—Our audit committee oversees our ERM program, including the management of risks arising from cybersecurity threats, and are supported by the Information Security Steering Committee (the "ISSC"), the Cybersecurity Incident Response Team (the "CSIRT"), and our information security ("InfoSec") team. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The ISSC oversees the frameworks the InfoSec team uses to benchmark the controls and maturity of our security program. The ISSC is a cross-functional group that has oversight and input into the roadmap and projects reflecting the maturity benchmarks of the frameworks upon which we base our program, and receives monthly updates as to the status of the roadmap projects. The CSIRT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the ISSC, who then reports up to our audit committee when appropriate. The audit committee is responsible for escalating cybersecurity threats and incidents to the Board if and when appropriate. We have established frameworks so that our ISSC, audit committee, and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: To facilitate the success of our cybersecurity risk management program, the CSIRT is composed of multidisciplinary teams throughout Redfin who are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The audit committee consists of at least three members of the Board. The ISSC includes our chief financial officer ("CFO"), our chief legal officer ("CLO"), and other key leaders across the company. Our chief technology officer ("CTO") oversees our security team. Our CFO has over 30 years of experience managing risks at Redfin, Zappos, Amazon (Home and Garden), Bain & Company and Accenture, including risks arising from cybersecurity threats. Our CLO has 16 years of experience managing risks, including risks arising from cybersecurity threats. Our CTO has over 24 years of experience, including experience managing risks arising from cybersecurity threats across several industries to include health care and business solutions.


text: Collaborative Approach—we have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The ISSC and the CSIRT work collaboratively to build and implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.


text: Technical Safeguards—We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including rate-limiting and web application firewalls, anti-malware functionality, access controls, and threat detection systems including posture management tooling. We ensure the ongoing security and improves these technical safeguards through regular security reviews of components, code, libraries, and environments.


text: Incident Response and Recovery Planning—We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident. These plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management—We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness—We provide mandatory training for our personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the ISSC, the audit committee, and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance—We maintain cyber insurance coverage.


text: Risks from Cybersecurity Threats To date we have not experienced any cybersecurity incidents, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect our business, including our business strategy, results of operations or financial condition.


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, stockholders, and employees. Our audit committee oversees our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.