text: Each member of the Risk Management Steering Committee, including the business unit representatives and subject matter experts, has substantial experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats. Through ongoing communications with these teams, the CFO, GC and the rest of the Risk Management Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: As of the date of this report, we have not been materially affected by any cybersecurity threats, including as a result of any previous cybersecurity incidents. For more detailed information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including "Risks Relating to Legal and Regulatory Matters: A breach of the confidentiality or security of information we or our third-party providers hold or of the security of the computer systems used in or for our business could be detrimental to our business, financial condition and results of operations."

companyName: Vizio Holding Corp.

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have implemented processes for our systems taking guidance from recognized cybersecurity frameworks, such as U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") in an effort to mitigate risks. As part of these proactive measures, we maintain a Cybersecurity Incident Response and Escalation Process with defined roles, responsibilities, and reporting protocols that is periodically reviewed, tested, and updated. The Company has an Executive Cyber Response and Disclosure Committee (consisting of senior executives from the business, finance, operations and legal functions), which is responsible for determining what actions are necessary to respond to cybersecurity events, with input from the Chief Information Security Officer and other subject matter experts directly participating in incident response efforts.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Additionally, on a quarterly basis, our Audit Committee receives reports from the Chief Information Officer, Chief Information Security Officer, and other members of management. As part of its annual assessment, the Audit Committee evaluates significant risks related to our business including cybersecurity risks, and provides such information to our Board of Directors. Our Internal Audit Group also reviews our cybersecurity governance and controls annually.


text: Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. More specifically, an independent third-party performs a regular penetration test of Marvell's IT infrastructure. In addition to our penetration testing, an independent third-party security firm is engaged to perform additional security controls testing and provide an independent report to our executive team. This external assessment provides us and our Audit Committee with a comprehensive evaluation of our security posture.


text: Our information security team plays a pivotal role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents—whether they originate internally or from our vendors, suppliers or other third parties that we conduct business with. As part of our vendor selection process, we evaluate cybersecurity risks in appropriate situations. Furthermore, we conduct tabletop exercises periodically. These simulations allow us to test our response strategies across various business functions, allowing preparedness for real-world incidents. When risks are identified through our processes, we analyze their potential impact on the Company and assess the likelihood of occurrence. Our monitoring efforts help us to timely mitigate and remediate risks and incidents. As part of our commitment to security awareness, information security training is mandatory for every employee and contractor. This ongoing compliance program reinforces best practices and helps to foster a security-conscious culture.


text: To safeguard our systems, we regularly install and update anti-malware and endpoint detection and response software across all IT-managed systems and workstations. These measures help detect and prevent malicious code from compromising our infrastructure.


text: We also engage third-party providers to bolster our cybersecurity risk management and strategy. Some provide ongoing assistance, including threat monitoring, mitigation strategies, and updates on emerging trends. Others provide targeted expertise, such as security assessments and forensic analysis.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity and other information technology risk as part of its risk oversight function. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks and risk management program. Our cybersecurity team, led by our CISO, who reports directly to our Executive Vice President and Chief Operations Officer, is responsible for assessing and managing risks from cybersecurity threats. The CISO and his team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and any retained external cybersecurity experts. Our CISO has over 20 years of security experience managing global security organizations including architecture, operations, strategy, applications, infrastructure, support and execution. The information security team collectively have decades of relevant experience in the industry and many hold various cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Further, we invest in regular, ongoing cybersecurity training for our team.


text: The CISO reports such cybersecurity threats and incidents to the Audit Committee. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee. In addition, pursuant to our internal procedures, in the event of a significant cybersecurity incident, members of senior management will report such threats and incidents in a timely manner directly to the Audit Committee and, when appropriate, to the full Board of Directors.


text: We, like other technology companies operating in the current environment, have experienced cybersecurity incidents, but in the last three years we have not experienced an incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have implemented processes for our systems taking guidance from recognized cybersecurity frameworks, such as U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") in an effort to mitigate risks. As part of these proactive measures, we maintain a Cybersecurity Incident Response and Escalation Process with defined roles, responsibilities, and reporting protocols that is periodically reviewed, tested, and updated. The Company has an Executive Cyber Response and Disclosure Committee (consisting of senior executives from the business, finance, operations and legal functions), which is responsible for determining what actions are necessary to respond to cybersecurity events, with input from the Chief Security Officer ("CSO") and other subject matter experts directly participating in incident response efforts. Furthermore, we conduct an annual full board briefing on cybersecurity, ensuring that our Board of Directors is regularly informed of the evolving landscape of cybersecurity risks and mitigation strategies.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Additionally, on a quarterly basis, our Audit Committee receives reports from the Chief Information Officer, CSO, and other members of management. As part of its annual assessment, the Audit Committee evaluates significant risks related to our business including cybersecurity risks, and provides such information to our Board of Directors. Our Internal Audit team also reviews our cybersecurity governance and controls annually.


text: Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. More specifically, an independent third-party performs a regular penetration test of our IT infrastructure. In addition to our penetration testing, an independent t hird-party security firm is engaged to perform additional security controls testing and provide an independent report to our executive team. This external assessment provides us and our Audit Committee with a comprehensive evaluation of our security posture.


text: Our information security team plays a pivotal role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents—whether they originate internally or from our vendors, suppliers or other third parties that we conduct business with. As part of our vendor selection process, we evaluate cybersecurity risks in appropriate situations. Furthermore, we conduct tabletop exercises periodically. These simulations allow us to test our response strategies across various business functions, increasing preparedness for real-world incidents. When risks are identified through our processes, we analyze their potential impact on the Company and assess the likelihood of occurrence. Our monitoring efforts help us to timely mitigate and remediate risks and incidents. As part of our commitment to security awareness, information security training is mandatory for every employee and contractor. This ongoing compliance program reinforces best practices and helps to foster a security-conscious culture.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity and other information technology risk as part of its risk oversight function. The Board of Directors receives an annual briefing, and the Audit Committee receives quarterly reports from our CSO on our cybersecurity risks and risk management program. Our cybersecurity team, led by our CSO, who reports directly to our Executive Vice President and Chief Operations Officer, is responsible for assessing and managing risks from cybersecurity threats. T he CSO and his team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and any retained external cybersecurity experts. Our CSO has over 20 years of security experience managing global security organizations including architecture, operations, strategy, applications, infrastructure, support and execution. The information security team collectively have decades of relevant experience in the industry and many hold various cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Further, we invest in regular, ongoing cybersecurity training for our team.


text: The CSO reports cybersecurity threats and incidents to the Audit Committee. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee. In addition, pursuant to our internal procedures, in the event of a significant cybersecurity incident, members of senior management will report such threats and incidents in a timely manner directly to the Audit Committee and, when appropriate, to the full Board of Directors.


text: We, like other technology companies operating in the current environment, have experienced cybersecurity incidents, but in the last three years we have not experienced an incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a Cybersecurity Working Group ("CWG") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we have a CWG which is responsible for monitoring both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: We have outlined preliminary policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities for preliminary assessment, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our policies and procedures include processes which incorporate regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through an internal reporting channel.


text: Risk Management Process Integration Our risk management processes, including Cybersecurity, are overseen by the Audit Committee of our board of directors. Our processes include ongoing information technology risk assessments, and third-party security risks assessments.


text: Our cybersecurity risk management efforts have also been integrated into the overall risk management process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as business downtime, loss of Company's financial assets or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our risk management process have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated periodically and communicated to our executive leadership.


text: We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, and program enhancements. We also include cybersecurity training as part of our required annual employee training program. In addition, cybersecurity and privacy training and awareness is integrated and continues throughout the year, utilizing various delivery methods such as phishing campaigns, training sessions, and informational articles.


text: Third Party Security Experts We engage third party security experts to supplement our internal CWG team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts provide guidance to support our cybersecurity efforts. We use the findings of these third-party experts to improve our practices, procedures, and technologies. We also engage as necessary third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: Identification of Threats Associated with Third Parties We utilize an internal risk management process to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. We conduct initial risk assessments of key third-party suppliers and service providers based on various factors to classify each into a risk category. Our process is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of key third-party suppliers and service providers that have access to our networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We also require that our key suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.


text: Incidents and Risks Nuvve Holding Corp. has not experienced a material cybersecurity incident. Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Technology, Intellectual Property, and Infrastructure" identified in the "Risk Factors" section of Part 1 of Item 1A herein.


text: Board of Directors Oversight responsibilities for our cybersecurity and digital trust compliance programs and risks lie with the Audit Committee of our board of directors. Our board of directors have the ultimate oversight responsibilities of our cybersecurity program and all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, privacy, and technology.


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our CWG, at our regular meetings, at least once a year or as needed. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our key third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CWG.


text: Our programs are focused on building digital trust through sound oversight of cybersecurity and data privacy protections and the responsible use of data and technology. We operate a CWG, and we have a cross-functional approach to addressing cybersecurity-related risks through the functional compliance structures in our digital technology.


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs, with active participation in the CWG. The CWG is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CWG also develops periodic reports on the Company's cybersecurity program and developments. The CWG members include the Chief Operating Officer, Chief Financial Officer, and Vice President of Technology.


text: The Chief Operating Officer is National Association of Corporate Directors ("NACD") Directorship Certified and has earned the NACD certificate in cyber risk oversight.


text: Our policies and procedures include the establishment of an Incident Response Team ("IRT") that consists primarily of representatives from the CWG, legal, corporate communications, finance, and other relevant stakeholders. The IRT follows the guidance as outlined in the IRP to respond to cybersecurity incidents and escalate as necessary to the CWG based on a defined severity matrix. The senior executive leadership stakeholders are responsible for assessing the materiality of risks in consultation with the IRT, CWG, and external advisors.


text: We have policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities for preliminary assessment, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our policies and procedures include processes which incorporate regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through an internal reporting channel.


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs, with active participation in the CWG. The CWG is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CWG also develops periodic reports on the Company's cybersecurity program and developments. The Company CWG is comprised of Executive team and senior management members, including the Company's President and Chief Operating Officer, Chief Financial Officer, and Vice President of Technology.


text: We believe data privacy and cybersecurity are critical to supporting our vision and enabling our strategy. Our approach to data privacy and cybersecurity is supported by our commitment to preserving the trust our employees and customers place in us and focuses on driving continuous improvement as the threat landscape evolves.

companyName: Symbotic Inc.

ticker: SYM


text: Our board of directors ("Board"), in coordination with each of our committees of our Board, is responsible for oversight of our enterprise risk management activities. The Board oversees risks from cybersecurity threats through periodic reports from the audit committee of the Board ("Audit Committee"), which monitors cybersecurity incidents and management's response to such incidents.


text: Our Audit Committee directly oversees our processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.


text: Our Vice President ("VP") of Security and Controls, who has over 16 years of experience in information technology and security and who holds Certified Information Systems Security Professional and IT Infrastructure Library certifications, has primary responsibility for overseeing our management of cybersecurity risks. Reporting to the Chief Technology Officer ("CTO"), our VP of Security and Controls meets regularly with the CTO, and works cross-functionally with other department leaders, including legal, business, policy, and technical functions, as appropriate, to exchange information related to cybersecurity. Our VP of Security and Controls provides quarterly updates to our Audit Committee on our cybersecurity status, risks, and strategies. These quarterly updates address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, technological trends, and information security considerations arising with respect to our peers and third parties.


text: Our cybersecurity programs and procedures are designed to identify and address threats that are subject to ongoing compliance assessments, certifications, and testing. We conduct assessments of threat models to determine which risks are most likely to impact us. Our security and controls team gathers threat and risk data and updates through various sources, such as systems reviews, security research activities, and internal and external security scans and alerts, as appropriate. As applicable, in certain circumstances, we also collaborate with industry partners in the security community, our peers and law enforcement agencies, to support our cybersecurity threat intelligence capabilities. This information is collected, categorized, and assessed to identify, prioritize, and manage significant cybersecurity risks. As a result, our process is continually evaluated and evolves as the threat landscape changes.


text: We have also incorporated security practices into employee trainings. We have a process for employees to formally acknowledge their review and understanding of security obligations. Additionally, our security and controls team conducts periodic security and data protection training aimed to emphasize the importance of security and data protection. We have also implemented a review process to assess the security profile and data protection practices of certain third-party suppliers and service providers that have exposure to our systems, including, as appropriate, review of vendor security policies and procedures. We do not, however, review security profile and data protection practices of all third-party vendors.


text: In the event of a cybersecurity incident, our response and mitigation efforts are guided by the Incident Response Plan ("IRP"), which provides guidance on how to respond to, and recover from, a material cyber incident requiring an organized response. We conduct tabletop exercises testing the principles and procedures set forth in our IRP based on lessons learned.


text: In addition, we have a cybersecurity disclosure committee ("Cybersecurity Disclosure Committee") which receives updates on an as needed basis from our security organization regarding cybersecurity incidents. The Cybersecurity Disclosure Committee includes our VP of Security and Controls and senior representatives from finance, controllership, internal audit, investor relations, and legal teams. In the event of a cybersecurity incident, the Cybersecurity Disclosure Committee meets to assess the incident for materiality and required disclosure.


text: While we have experienced cybersecurity incidents in the past, as of the date hereof, none have materially affected us or our business strategy, financial condition, results of operations, and/or cash flows. We continue to invest in cybersecurity and resiliency of our networks to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information which they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A, Risk Factors included in this Annual Report on Form 10-K.


text: Our Chief Information Officer ("CIO"), who has over 25 years of experience in information technology and security and held pivotal leadership roles in Security at several Fortune 100 companies, has primary responsibility for overseeing our management of cybersecurity risks. Reporting to the Chief Technology Officer ("CTO"), our CIO meets regularly with the CTO, and works cross-functionally with other department leaders, including legal, business, policy, and technical functions, as appropriate, to exchange information related to cybersecurity. Our CIO provides quarterly updates to our Audit Committee on our cybersecurity status, risks, and strategies. These quarterly updates address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, technological trends, and information security considerations arising with respect to our peers and third parties.


text: In addition, we have a cybersecurity disclosure committee ("Cybersecurity Disclosure Committee") which receives updates on an as needed basis from our security organization regarding cybersecurity incidents. The Cybersecurity Disclosure Committee includes our CIO and senior representatives from finance, controllership, internal audit, investor relations, and legal teams. In the event of a cybersecurity incident, the Cybersecurity Disclosure Committee meets to assess the incident for materiality and required disclosure.


text: While we have experienced a cybersecurity incident in the past, as of the date hereof, none have materially affected us or our business strategy, financial condition, results of operations, and/or cash flows. We continue to invest in cybersecurity and resiliency of our networks to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information which they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A, Risk Factors included in this Annual Report on Form 10-K.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats and to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: The underlying process and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology ("IT"), including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). We have an annual risk assessment performed by a third-party specialist of our cyber risk management program against the NIST CSF. This assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with our third-party specialists, have developed a risk mitigation plan to address such risks, and where necessary, to remediate potential vulnerabilities identified through the assessment process.


text: We maintain policies and processes over areas such as information security, IT asset lifecycle, data destruction, backup, access provisioning, and maintenance of network accounts, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers and consultants (collectively, "providers") leveraging third-party technology and expertise. These providers are a key part of our cybersecurity risk management strategy and infrastructure. These providers deliver services including systems inventory monitoring, vulnerability testing, user management including restricted access of privileged accounts, capacity monitoring, network protection and monitoring, endpoint protection, managed detection and response, remote monitoring and management, cybersecurity user awareness training, data backup management, incident response, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.


text: Our management team, in conjunction with our third-party IT and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team, in conjunction with our strategic third-party partners, oversees our cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged for strategic cyber risk management, advisory and decision making.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection and onboarding process, review of System and Organization Control (SOC) reports on an annual basis and a regular review of vendor contracts.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information, see the section titled "Risk Factor— Our business and operations would suffer in the event of computer system failures, including but not limited to our information technology systems, infrastructure and data, or those of our third-party vendors, contractors or consultants failing, becoming unavailable, or suffering security breaches, losses or leakages of data and other disruptions, which could result in disruption of our services, compromise sensitive information (including personal information) related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program and cybersecurity risk exposures, and the steps taken by management to monitor and mitigate cybersecurity risks. The Committee is composed of members of our board of directors with diverse expertise, including risk management, biotechnology, chief executive officer and chief financial officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Financial Officer and EVP, Chief Legal Officer, internal security consultants and external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer and EVP, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information, see the section titled " Risk Factor— Our business and operations would suffer in the event of computer system failures, including but not limited to our information technology systems, infrastructure and data, or those of our third-party vendors, contractors or consultants failing, becoming unavailable, or suffering security breaches, losses or leakages of data and other disruptions, which could result in disruption of our services, compromise sensitive information (including personal information) related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Executive Officer and EVP, Chief Legal Officer, internal security consultants and external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Executive Officer and EVP, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: We rely on our technology infrastructure and information systems to perform operational activities as well as to maintain the Trust's business records and financial data. Our internally developed system and processes, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. Many threat actors are well funded.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: We have implemented controls and processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. The Trust's management, including its Principal Executive Officer and Principal Financial Officer, has direct oversight of the management of cybersecurity risks.


text: Management oversees our enterprise risk management process. Under the supervision and with the participation of our management, including our Principal Executive Officer and Principal Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. Management receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry. Management reviews the results of the enterprise risk assessment in detail on a regular basis.


text: We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation and periodic assessments of third-party service providers to assess cyber preparedness of key vendors.


text: We are not aware of any risks from cybersecurity threats, including any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Trust, including its business, results of operations or financial condition. Refer to Item 1A. Risk Factors in this Annual Report on Form 10-K, specifically "Information technology, data security breaches and other similar events could harm the Trust," for additional discussion about cybersecurity-related risks.


text: As an externally managed trust, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager. While w e rely on our Manager's and our Manager's parent company's technology infrastructure and information systems to perform operational activities as well as to maintain the Trust's business records and financial data, we do not possess sensitive personal data for any third parties or employees. The Trust's business is highly dependent on the communications and information systems of the Manager, its affiliates and third-party service providers or employees. The Manager has adopted processes designed to identify, assess and manage material risks from cybersecurity threats to the Trust. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Trust's data and systems along with other material risks to its operations. These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats.


text: Management, including our Principal Executive Officer and Principal Financial Officer, oversees our enterprise risk management process in collaboration with our Manager and our Manager's parent company. Our Principal Executive Officer and Principal Financial Officer bring over 17 and 20 years of experience, respectively, in overseeing IT infrastructure management as part of their executive and audit committee roles across various companies. Additionally, both have completed cybersecurity training to enhance their expertise in risk management and IT security.


text: No less frequently than annually, the Manager completes an assessment to identify potential cybersecurity threats and vulnerabilities and to better prioritize and mitigate the Trust's cybersecurity risk. The Manager maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Trust's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate the Manager's evolving information security policies, standards, processes and practices.


text: We maintain a comprehensive Information Security Management System ("ISMS") program, which is led by a dedicated Chief Information Security Officer ("CISO"), who joined the Company in April 2023 and has 25 years of extensive technical and SaaS experience, having served in roles of increasing responsibility relating to information security at other large public companies. Our CISO has undertaken a comprehensive review of our information security systems and processes, and as a result, we have made significant improvements to our cybersecurity controls and procedures over the last eight months, and expect to see additional incremental improvement in our cybersecurity risk management over the next six to twelve months.

companyName: Vimeo, Inc.


text: Under the CISO, the Information Security Team is responsible for defining and implementing the Company's cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Team oversees the delivery of network, cloud, email and application security, security monitoring, penetration testing, cybersecurity training and incident response. Our ISMS program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards and Technology. Through our ISMS program, we have established a comprehensive collection of policies and standard operating procedures to guide our cybersecurity strategy, which includes an Information Security Policy applicable to all Vimeo personnel, as well as a Supplier Information Security Policy for our third-party software vendors, both of which set forth cybersecurity standards, controls, and training requirements designed to protect corporate and customer data, whether it is processed by Vimeo or a service provider. We also conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action.


text: Our cybersecurity governance framework includes oversight by the Audit Committee of our Board of Directors, which reviews the effectiveness of the Company's management of cybersecurity, data privacy and other data- and technology-related risks, controls and procedures. The CISO reports regularly to our Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our ISMS program is regularly evaluated by external experts with the results of those reviews reported to senior management and the Board. The Audit Committee, and as appropriate, the Board, also receives prompt and timely information regarding any high severity cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed.


text: As of the date of this report, we are not aware of any material risks resulting from any previously reported cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We discuss the risks relating to cybersecurity threats and their potential impact on our business more fully in "Risk Factors" in Part I, Item 1A herein. Continuously enhancing our information security controls to meet the evolving cybersecurity threat landscape remains a top priority.


text: We maintain a comprehensive Information Security Management System ("ISMS") program, which is led by a dedicated Chief Information Security Officer ("CISO"), who joined the Company in October 2024 and has almost 20 years of experience in enterprise grade cybersecurity and global scale systems, having previously served as a CISO of another public company and as a cybersecurity consultant. Our CISO is undertaking a comprehensive review of our information security systems and processes, and as a result, we may make incremental improvements to our cybersecurity controls and procedures and our cybersecurity risk management over the next six to twelve months.


text: Under the CISO, the Information Security Team is responsible for defining and implementing the Company's cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Team oversees the delivery of network, cloud, email and application security, security monitoring, penetration testing, cybersecurity training and incident response. Our ISMS program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not directly or fully comply with all elements of these standards. Through our ISMS program, we have established a comprehensive collection of policies and standard operating procedures to guide our cybersecurity strategy, which includes an Information Security Policy applicable to all Vimeo personnel, as well as a Supplier Information Security Policy for our third-party software vendors, both of which set forth cybersecurity standards, controls, and training requirements designed to protect corporate and customer data, whether it is processed by Vimeo or a service provider. We also conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action.


text: Our cybersecurity governance framework includes oversight by the Audit Committee of the Board, which reviews the effectiveness of the Company's management of cybersecurity, data privacy and other data- and technology-related risks, controls and procedures. The CISO reports regularly to our Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our ISMS program is regularly evaluated by external experts with the results of those reviews reported to senior management and the Board. The Audit Committee and, as appropriate, the Board, also receives prompt and timely information regarding any high severity cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed.


text: As of the date of this report, we are not aware of any material risks resulting from any previously reported cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We discuss the risks relating to cybersecurity threats and their potential impact on our business more fully in "Risk Factors" in Part I, Item 1A herein.


text: Assessment, Identification and Management of Material Risks from Cybersecurity The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.

companyName: HPS Corporate Lending Fund


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to the Company include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to the Company. The assessment of cybersecurity risks, including those which may be applicable to the Company, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and the Company relies on such controls.


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help the Company prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. The Company relies on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.


text: The Adviser's 's cybersecurity risk management and awareness programs, which apply to the Company, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to the Company. The Adviser also completes external reviews of the cybersecurity program and practices applicable to the Company, which may include assessments of relevant data protection practices and targeted attack simulations.


text: The Adviser has developed an incident response plan that provides guidelines for responding to cybersecurity incidents. The incident response plan includes notification to the applicable members of cybersecurity leadership, including the Adviser's Chief Information Security Officer ("CISO"), and, as appropriate, escalation to other relevant individuals. Incidents may also be reported to the audit committee or full board of directors of the Adviser, as well as to the Audit Committee, if appropriate.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO has 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Adviser's CISO works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts. The Company's CCO has been responsible for this monitoring and reporting as CCO to the Company for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain members of the Company update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages our day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to us and our operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact us. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to us include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to us. The assessment of cybersecurity risks, including those which may be applicable to us, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and we rely on such controls.


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help us prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact us. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. We rely on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.


text: The Adviser's cybersecurity risk management and awareness programs, which apply to us, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to us. The Adviser also completes external reviews of the cybersecurity program and practices applicable to us, which may include assessments of relevant data protection practices and targeted attack simulations.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or that are reasonably likely to materially affect us, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to us (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). Our Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and our cybersecurity program. The Adviser's CISO has over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures in both US Government Intelligence agencies and Financial Services firms. The Adviser's CISO reports to the Chief Financial Officer of the Adviser and works closely with our management to administer, assess, discuss, and prioritize our cybersecurity efforts. Our CCO has been responsible for this monitoring and reporting as CCO to us for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain of our members update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by our CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to us, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information and maintaining operational resilience. We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Brand Engagement Network Inc.

ticker: BNAI


text: The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our management is responsible for the day-to-day oversight and management of our enterprise risks, including risks from cybersecurity threats. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Information and Data Officer and dedicated information security team, who develop, prioritize, and execute our cybersecurity strategy in partnership with relevant departments and business units. Our CIDO, who has over 25 years of information technology experience including cybersecurity and information security, oversees our cybersecurity framework and reports to our management-level information technology steering subcommittee and management-level enterprise risk management committee. Our CIDO is assisted in this oversight role by additional members of management.


text: The Company's data security framework integrates technical solutions, policies, controls, data governance, and employee training. Key components of our framework include strong encryption, access control, regular updates, data backup, and endpoint security. The Company is also currently implementing features within its AWS environment, such as Security Hub, and is committed to compliance with HIPAA and SOC 2. The Company continuously researches alternatives to its current framework, recognizing that cybersecurity presents an ever-evolving challenge.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any cyber incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors - Risks Related to Our Business and Industry – If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Risk Management and Strategy To help address cybersecurity threats, we have developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader ERM program. We are committed to a risk-centric, layered information security approach to secure our data, systems, and services. We prioritize our data security initiatives and processes based on our assessment of known and anticipated threats to our data security. Utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, we strive for continuous improvement and utilize a metrics-based approach to identify and mitigate data security risks that could potentially impact our business operations or clients.

companyName: H&R BLOCK INC

ticker: HRB


text: We maintain multiple levels of protection to mitigate data security risks, and we regularly test our systems to discover and address potential vulnerabilities, including without limitation: • using a multi-layered, zero-trust principled approach to secure systems; • systematic monitoring of our sites and services to detect and respond to unauthorized activity; and • regular security audits and vulnerability assessments conducted by our dedicated internal information security team, our internal auditors, and by external third parties.


text: In addition, we engage in a broad range of activities to secure and protect the data that we obtain through our business operations including, but not limited to: • continued development and enhancement of our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access; • security and business controls to appropriately limit access to and use of personal information, including adaptive and multifactor authentication; • comprehensive data protections, including encryption, to facilitate the secure storage, use, and transmission of sensitive data; • annual privacy/data security training to all employees and contractors and regular awareness and testing activities year-round regarding social engineering threats, such as phishing, for employees; • background checks on our employees, as permitted; • due diligence requirements and controls for third parties (e.g., service providers) with access to sensitive data throughout the lifecycle of the relationship; and • a dedicated global information security team that partners with all technology groups to monitor, prioritize, and remediate risks to the enterprise.


text: The Audit Committee of the Board of Directors has the primary responsibility of assisting our Board in the oversight of policies and processes pertaining to the ERM program and specifically considers risks and controls relating to, among other things, data and cybersecurity. Risks associated with cybersecurity threats are a top priority for ongoing oversight by the ERM team and the Enterprise Risk Committee. Our Chief Risk Officer oversees the activities of the Enterprise Risk Committee and, together with the Chief Information Security Officer (CISO), briefs the Audit Committee and the Board of Directors on information security risk matters as a part of regular ERM reports, with a deep dive focused on information security at least annually (or more frequently if appropriate).


text: In addition, the Audit Committee receives regular reports on cybersecurity matters from the Chief Information Officer (CIO) and the CISO. The Board of Directors is also updated by the CIO and CISO on a periodic basis. Our CIO, who reports directly to the President and CEO, has over 30 years of leadership experience in technology-based roles across multiple industries. Our CISO, who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 25 years of information technology experience, with more than 15 years of Information Security specialization. Our CISO is responsible for understanding, managing, and communicating cybersecurity risks internally to our management (including the Enterprise Risk Committee on which he serves), and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our CISO heads the Information Security team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by us to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also periodically engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats, and Incidents We have been, and continue to be, the subject of cybersecurity threats, and we describe how risks from these threats, if realized, are reasonably likely to materially affect us. See further discussion of these items in our Item 1A. Risk Factors of this Form 10-K. As of the date of this report, we have not identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations, or financial condition, in the future.


text: Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: Janus International Group, Inc.

ticker: JBI


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company has established certain controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company's Incident Response Plan: (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures; and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: We have cybersecurity insurance (subject to specified retentions or deductibles) related to cybersecurity incidents that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. Additionally, this cybersecurity insurance may cover certain physical injury to, loss or destruction of tangible property, including loss of use thereof, or loss of use of tangible property which has not been physically injured or destroyed. However, damages, fines, and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable.


text: As part of its cybersecurity program, the Company deploys comprehensive measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, physical security measures, multi-factor authentication, and other tools to detect data exfiltration. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents by assessing current threat intelligence from various sources, including but not limited to, certain key vendors, the United States Cybersecurity & Infrastructure Security Agency ("CISA"), and the open source threat intelligence community via open-source threat intelligence databases. Furthermore, we conduct periodic table top exercises, vulnerability and security testing, and "lessons learned" reviews from internal and industry related cybersecurity incidents. We have a process to report material results of such testing and assessments to the Board and our Audit Committee, and periodically make adjustments to our cybersecurity program based on these exercises and reviews. The Company engages third parties to conduct certain aspects of such testing and to assist with the Managed Detection and Response ("MDR") of security events as well as the collection and reporting of data for cybersecurity key performance indicators (i.e., KPIs). The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective through a vendor management program, including annual reviews of key vendors' adherence to cybersecurity compliance, the monitoring of alerts from CISA, as well as open-source threat intelligence.


text: Some of our IT systems and products operate within a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems and products (including our Nok Smart Entry System) could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we review Service Organization Controls ("SOC") reports describing vendors' compliance with cybersecurity best practices when they are available or an appropriate subset of those controls for vendors who do not have a SOC report. Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, we, and our service providers, may be unable to provide our services and products for the duration of the event and/or a time thereafter.


text: In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee (on no less than a quarterly basis) and the full Board (on no less than an annual basis) receive regular reports from our Information Technology Department on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. We anticipate these reporting activities will be overseen by our newly appointed Chief Information Officer ("CIO") moving forward.


text: The Company's information security and cybersecurity program is managed by a dedicated CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic reports to our Board and Audit Committee as well as our Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, and the emerging threat landscape. Specifically, our management-driven ERM Committee and Incident Response team include executives from key departments across the Company and each work collaboratively to ensure periodic reviews and assessments of the Company's security environment are being observed.


text: In November 2023, the Company appointed its first CIO, Phil Stevens, who served as both a CIO and Chief Technology Officer in previous roles, prior to joining the Company. Mr. Stevens has more than 25 years of experience in privately held and publicly traded companies and has an established track record of developing and overseeing various cybersecurity programs. Mr. Stevens holds a Bachelor of Science (B.S.) in Computer Science from Purdue University, a Master of Science (M.S.) in Information Technology from the Florida Institute of Technology, and specializations in AI Product Management and Machine Learning Operations (MLOps) from Duke University (Online).


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management Protocols and Strategy Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, regulatory fines, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.


text: All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company's security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.


text: Cybersecurity Governance In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests that management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee (on no less than a quarterly basis) and the full Board (on no less than an annual basis) receive regular reports from our Chief Information Officer ("CIO") on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's information security and cybersecurity program is managed by a dedicated CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CIO has more than 25 years of experience in privately held and publicly traded companies and has an established track record of developing and overseeing cybersecurity programs. Additionally, our CIO holds a Bachelor of Science in Computer Science, a Master of Science in Information Technology, and specializations in AI Product Management and Machine Learning Operations. Our CIO provides periodic reports to our Board and Audit Committee as well as our Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, and the emerging threat landscape. Specifically, our management-driven ERM Committee and Incident Response team include executives from key departments across the Company and each work collaboratively to ensure periodic reviews and assessments of the Company's security environment are being observed.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. management and strategy.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks. However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.


text: we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems.


text: responsibility for assessing any cybersecurity risks rests with our chief financial officer, who would report any threat to our board of directors.


text: date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition..


text: As a community bank, we rely heavily on information technology and telecommunications systems to conduct our business activities, such as processing transactions, maintaining records, communicating with customers and vendors, and providing online and mobile banking services. These systems are subject to various cybersecurity threats, such as unauthorized access, hacking, phishing, malware, ransomware, denial-of-service attacks, and other malicious or criminal activities, that could compromise the confidentiality, integrity, or availability of our systems, data, or customer information. Cybersecurity threats may originate from external sources, such as cybercriminals, hackers, terrorists, or foreign governments, or from internal sources, such as employees, contractors, or vendors. Cybersecurity threats may also target our third-party service providers, such as core processors, cloud providers, or payment processors, whose systems and data are interconnected with ours.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: We have implemented various security measures and controls to protect our systems and data from unauthorized access, use, or disclosure, such as firewalls, encryption, authentication, backup, and recovery, both internally and with our third party managed service provider. We also have established policies and procedures to monitor and respond to cybersecurity incidents, and to comply with applicable laws and regulations regarding cybersecurity and data privacy. We regularly review and update our security measures and controls to address the evolving nature and sophistication of cybersecurity threats. We also provide training and education to our employees and customers on cybersecurity awareness and best practices. In addition, we maintain cyber liability insurance coverage to mitigate the potential financial impact of cybersecurity incidents. Furthermore, internal and external auditors and regulators periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity and Incident Response Program that provides a documented framework for responding to actual or potential incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our chief executive officer and board of directors as appropriate.


text: The Business Continuity and Incident Response Program is coordinated by the information security officer and key members of management are embedded into the Plan by its design. The Business Continuity and Incident Response Program facilitates coordination across multiple areas of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. Despite our efforts, we cannot guarantee that our security measures and controls will be sufficient or effective to prevent, detect, or mitigate all cybersecurity incidents or to protect our systems and data from unauthorized access, use, or disclosure. We may experience cybersecurity incidents in the future that could result in operational disruption, reputational damage, customer dissatisfaction, loss of business or revenue, legal liability, regulatory actions, fines, penalties, or remediation costs.


text: Any of these outcomes could have a material adverse effect on our business, operations, and financial condition. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected the Corporation to date.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risks; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage any material risks.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk management process. As part of our overall risk management process, our Vice President of Internal Audit collaborates with subject matter specialists throughout the Company, as necessary, to gather insights for identifying and assessing material risks throughout the Company, including cybersecurity threat risks.