text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM

secItem: Item 1C


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are assessed for risk and may additionally be required to adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: The ERC provides updates to the Board quarterly, including on changes to security risks and outcomes. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The S ponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are included in reporting to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally included in reporting to the ERC and Board.


text: Cybersecurity Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the NIST Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate IT systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: Our cybersecurity risk management program includes an incident response plan ("IRP"). Our IRP provides us with a plan for identifying, responding to, reporting and remediating cybersecurity incidents. Our IRP has been established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. Our Information Services Breach Response Team ("ISBRT") takes a central role in developing and maintaining our incident response framework in coordination with our Cybersecurity Response Team ("CRT") that is dedicated to proactively addressing and managing potential breaches and incidents to ensure that our cybersecurity defenses are well designed and managed. Our Incident Management Team ("IMT") handles the response process for all cybersecurity incidents.


text: Our cybersecurity risk management program and strategy also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information protection and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other experienced third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so we can maintain a posture of continual enhancement of our cybersecurity risk management program and strategy; • continuous and updated cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers and vendors that includes due diligence in the selection of third-parties and vendors and the periodic monitoring thereof to ensure that they adhere to applicable cybersecurity standards.


text: Cybersecurity Governance Our Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things. Our CRT is led by the Senior Vice President of Information Services ("SVP, Information Services"), who reports to the Partnership's CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership's cybersecurity governance efforts. The SVP, Information Services has served in this role since 2014, and has more than 28 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance.


text: The ISBRT, CRT, IMT and the Audit Committee of the Board all play a role in the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents through their management and oversight of, and participation in, the cybersecurity risk management and strategy processes described above. As of the date of this Annual Report, we are not aware of any risks of, or actual, cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in the section entitled "Item 1A. Risk Factors" in this Annual Report.


text: Risk Management and Strategy We have dedicated to advance our cybersecurity risk management and integrated it into our overall risk management program, which program manages cybersecurity, financial, operational and compliance risks. To access, identify and manage cybersecurity threats, we implemented a cybersecurity risk management program with oversight by our Board of Directors ("Board"). Our management, led by an experienced information security team, continually monitors cybersecurity risk incidents.

companyName: SemiLEDs Corp

ticker: LEDS


text: Our cybersecurity risk management program sets forth a framework provided by our information security team to identify and mitigate vulnerabilities and risks in our information systems. Elements of the program include, among the other things, penetration tests on our networks and engaging in annual employee cybersecurity training.


text: We have engaged a third-party service provider periodically to review and improve our cybersecurity risk management framework, including by identifying third-parties information systems that could cause cybersecurity incidents to our business.


text: Our information security team, including our system engineering department leader who manages our information technology, is responsible for accessing and managing cybersecurity operations and incident response, reports cybersecurity incidents to management and, if the incidents are material, our audit committee. The members of our information security team each have over 10 years of experience and extensive knowledge in managing cybersecurity programs.


text: Our Audit Committee assists the Board in overseeing cybersecurity risks, including discussing with management and the information security team if cybersecurity threats are identified, and recommends cybersecurity framework improvements to the Board.


text: Risk Management and Strategy We have implemented an information security program to assess, identify, and manage material risks from cybersecurity threats. This program includes policies and procedures that guide the development, implementation, and maintenance of security measures and controls. We utilize industry-standard metrics to evaluate the criticality of software, data assets, and operational technology. We believe that our cybersecurity efforts align with the Center for Internet Security (CIS) Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and we conduct annual assessments to ensure compliance.

companyName: STAR GROUP, L.P.

ticker: SGU


text: Given our reliance on third-party software, service providers, and applications to support various business functions and security measures, we regularly conduct security audits and vendor management reviews. These processes are intended to ensure that third-party systems and services comply with our cybersecurity program.


text: Periodic cyber risk assessments of our operational technology network help us identify risks, which we address using risk-based analysis and judgment. We also conduct internal and external testing of software, hardware, and defensive systems in our efforts to uncover potential vulnerabilities. Third-party security firms are employed for certain controls and technology operations, including vulnerability scans and penetration testing. Our approach to managing third-party cybersecurity threats includes pre-acquisition due diligence, contractual obligations, and ongoing performance monitoring.


text: We employ governance, risk, and compliance (GRC) information technology tools to manage cybersecurity risks and maintain business continuity and disaster recovery plans to prepare for potential disruptions. Our employees receive cybersecurity awareness training upon hiring, with additional training provided on a regular basis.


text: The Vice President of Information Technology (IT) and the Director of IT Security are responsible for overseeing our cybersecurity risk management program and assessing cybersecurity risks. This includes managing internal cybersecurity staff, consulting with external cybersecurity experts, and staying informed through governmental and private sources. They report regularly to executive management on cybersecurity threats, resources, and program updates.


text: Cybersecurity risk management and strategy are integrated into our overall risk management processes. The program monitors the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of IT presents updates on IT projects, including cybersecurity policies and programs, to executive management at least quarterly.


text: The Board of Directors has overall oversight of key risks, with strategic oversight of cybersecurity risk management delegated to the Audit Committee. Annually, the Audit Committee reviews the Company's enterprise risk management, which includes cybersecurity. In fiscal year 2024, the Audit Committee established an IT Audit Subcommittee to enhance focus on IT-related internal controls and cybersecurity. The Board and Audit Committee have appointed one of the members of the Audit Committee to sit on the IT Subcommittee. This subcommittee meets quarterly with key company leaders to review cybersecurity risks and audit findings and reports regularly to the Audit Committee.


text: Impacts from Cybersecurity Threats Although we have experienced cybersecurity incidents, we do not believe they have, or are likely to have, a material impact on the business. However, we recognize that cybersecurity threats are constantly evolving, and future incidents remain a possibility. Despite our security measures and IT controls, we cannot guarantee that future cybersecurity incidents will be prevented. A successful attack could have significant consequences for the business. For more information on the risks associated with cybersecurity threats, see Item 1A, Risk Factors - "Risk Related to Information Technology and Cybersecurity."


text: Risk Management and Strategy The Company maintains a cybersecurity risk management program that is led by our Chief Information Officer ("CIO") and our Senior Director of IT - Security and Compliance ("Senior Director of IT"). Our CIO has over 25 years of experience in information technology and cybersecurity and reports to our President and CEO. Our Senior Director of IT has over 20 years of experience in information technology and cybersecurity, holds several industry certifications including CISSP and CISA, and reports to the CIO. The Company's CEO, Chief Financial Officer ("CFO") and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: REV Group, Inc.


text: The program is aligned with industry frameworks and controls from the National Institute of Standards and Technology, including NIST Cybersecurity Framework, v2.0. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain and enhance cybersecurity, including threat intelligence, penetration testing, multi-factor authentication, and endpoint detection and response. The Company maintains a cyber incident response plan, which is tested periodically. The Company maintains a cybersecurity insurance policy, which gives us access to expert forensic and legal experts to help manage a major incident or a data breach. We have rolled out a formal cybersecurity awareness training program to our entire workforce as part of our annual ethics and compliance training. Additionally, the Company conducts ongoing phishing and social engineering simulations that are tied to our cybersecurity awareness training program, and our workforce is encouraged to report any suspicious activities to our cybersecurity team. The Company also has processes in place to oversee and identify risks from cybersecurity associated with the use of third-party service providers that could impact our business. We review available data related to our third-party service providers and assess the appropriateness of our service providers' cybersecurity programs and practices to ensure risks are properly mitigated. In fiscal year 2025, we commissioned an independent assessment from an accredited firm to evaluate the effectiveness of our cybersecurity program and plan to make adjustments to address the improvement opportunities identified in the assessment. We intend to perform this assessment on a biennial basis going forward.


text: Assessing, identifying and managing cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") program. Cybersecurity-related risks fall within the scope of risks that the ERM program evaluates to assess top risks to the enterprise. Such risks are directly communicated to the Audit Committee on a bi-annual basis, or more frequently as needed. The Audit Committee reports the results of their bi-annual meetings to the Board of Directors at the succeeding Board meeting. To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. We have a formal process to annually assess the feasibility, validity and effectiveness of our incident response plans including information technology recovery and business continuity procedures.


text: The Company did not experience a material cybersecurity incident in fiscal year 2025. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and, if deemed necessary, the Board of Directors. Additionally, we plan to consult with outside counsel, as appropriate, on our materiality determinations, our disclosure requirements, and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents, as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks applicable to the Company.


text: The Company maintains a formal Information Security Steering Committee comprised of a cross-functional group of business leaders. This committee meets at least quarterly to discuss performance of the prevention, detection, and mitigation plans that are being carried out by the Company's information security function, as well as the identification of any material new or heightened cybersecurity risks or incidents not already communicated by the CIO and Senior Director of IT.


text: The Board of Directors is responsible for the overall oversight of risk at the Company and has delegated to the Audit Committee the oversight of the risk management strategy specific to cybersecurity. Bi-annual reports regarding cybersecurity are provided to the Audit Committee by the CIO. These reports include information about the prevention, detection, mitigation, and remediation activities related to cybersecurity, any updates to internal processes surrounding cybersecurity, and any other relevant topics or information that allow the Audit Committee to provide proper oversight into cybersecurity risks. Additionally, the Board of Directors receives an annual update on cybersecurity from the CIO, which includes updates on any material cybersecurity incidents, and updates on topics related to cybersecurity both on a broad and company-specific level.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our IT Director, who reports to our Chief Financial Officer and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our IT Director leads our information technology team and regularly reports to our Audit Committee.


text: Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our IT Director based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.


text: Our Audit Committee, in connection with management led by our Chief Financial Officer, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our IT Director has served in various roles in technology leadership for more than 20 years, including cybersecurity. With an undergraduate degree in Information Systems, an MBA, and certification as a Certified Information Systems Security Professional (CISSP) from ISC2, the IT Director plays a key role in managing risks at our company. This includes risks arising from cybersecurity threats, drawing on extensive experience gained from similar companies and leadership positions across the technology sector. Although the Company does not have both a Chief Technology Officer or a Vice President of Security, the IT Director's expertise ensures robust risk management practices are in place. Our Chief Executive Officer, Chief Financial Officer and IT Director each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.


text: Cybersecurity Risk Management and Strategy At Genasys, cybersecurity risk management is integrated into our overall risk management program through regular internal risk assessments and continuous monitoring. Under the leadership of the Information Technology ("IT") Director, IT developed, implemented, and maintain a broad range of processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Our protocols include a third-party provided 24/7 Security Operations Center (SOC), which is designed to oversee our Endpoint Detection and Response (EDR) system and a robust Security Information and Event Management (SIEM) system that aggregates logs for real-time threat detection.

companyName: Genasys Inc.

ticker: GNSS


text: Our cybersecurity risk management program applies information and direction from industry-recognized cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-171, the Department of Defense Cybersecurity Maturity Model Certification (CMMC) Level 2, Sarbanes Oxley (SOX), and Services Organization Controls (SOC) 2. Risks from cybersecurity threats associated with the Company's use of third-party service providers are managed through vendor assessments and SOC 2 report requests, designed to ensure that our partners adhere to strict cybersecurity standards.


text: Notwithstanding the foregoing, we have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. See "Risk Factors – Actual or perceived failures or breaches of our information and security systems, or those of our customers, suppliers or business partners, could expose us to losses."


text: Our Board of Directors considers cybersecurity risk as critical to the enterprise and includes it as part of the full Board's oversight function. The full Board is updated on cybersecurity risks and compliance with relevant standards and regulations as part of its overall governance responsibilities, including quarterly Board meeting reports. Our Director of IT, who is responsible for the oversight and implementation of the cybersecurity program, also periodically makes presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company. Additionally, we have an escalation process to inform the Board of high-severity cybersecurity incidents that may occur. Our Board also periodically engages independent third-party technology experts to test our information technology systems, including cybersecurity.


text: The Director of IT leads the day-to-day management of cybersecurity at Genasys, supported by a team of two IT professionals with a combined 45 years of IT and cybersecurity experience. This team handles ongoing risk assessments, manages threat detection through our SOC and Security Information and Event Management (SIEM), ensures compliance with industry regulations, and informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy. Management also ensures that employees and contractors undergo quarterly cybersecurity training and phishing simulations, as part of a comprehensive awareness program.


text: We have implemented and continue to maintain a robust cybersecurity program intended to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Leslie's, Inc.

ticker: LESL


text: Our board of directors, with assistance from the audit committee, oversees the Company's management of risks arising from cybersecurity threats. The audit committee regularly reviews the measures implemented by the Company to help identify and mitigate risks from cybersecurity threats. As part of such reviews, the audit committee receives reports and presentations from the CIO and members of our team responsible for overseeing the Company's cybersecurity risk management, including our legal team, which may address a wide range of topics. This includes recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, compliance, privacy, technological trends and information security considerations arising with respect to the Company's peers and third parties. The audit committee also reports to the board of directors at least annually on cybersecurity matters.


text: We have an incident response plan under which certain cybersecurity incidents are escalated within the Company to senior executives on the cybersecurity risk management committee, and, where appropriate, reported to the board of directors and audit committee in a timely manner. At the management level, our cybersecurity risk management committee, comprised of senior executives representing functional and business areas, including our legal team, has broad oversight of the Company's risk management processes. Members of the Company's cybersecurity risk management committee includes certain IT leadership and the General Counsel. The committee meets regularly to discuss the risk management measures implemented by the Company to help identify and mitigate data protection and cyber security risks. Certain IT leadership and the General Counsel attend each cybersecurity risk management committee meeting to report on ongoing cybersecurity matters. Our IT leadership also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: Our CIO, Vice President of Infrastructure and Security, IT Security Director, and cybersecurity engineers have knowledge and experience to effectively implement, monitor, and maintain our cybersecurity posture. This team receives reports on cybersecurity threats from various business teams, and in conjunction with management, regularly reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly conduct penetration and vulnerability testing, security audits, and tabletop exercises. We conduct regular employee training on cybersecurity and provide management reports to monitor training effectiveness. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer that otherwise implicates third-party technology and systems we use. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Cybersecurity threats continue to evolve. We consider cybersecurity threats along with other significant risks that we face within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us.


text: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our IT systems. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have implemented a process to review risks to our Company in connection with certain third-party providers and vendors, which involves assessments through vendor questionnaires, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party IT service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report.


text: Cybersecurity Governance Our cybersecurity program is managed and directed by our Vice President, Information Technology, or IT, who has approximately 20 years of experience in information technology and information systems management. Our Vice President, IT reports to our Chief Financial Officer.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process. Our Board of Directors does not have a standing risk management committee, and administers this oversight function both directly as a whole, and through various standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee is responsible for overseeing the Company's enterprise risk management processes as well as our policies with respect to risk assessment and risk management, which includes cybersecurity risk. A cybersecurity update is provided at least annually, or more frequently as needed, to the Audit Committee by members of management responsible for managing cybersecurity risks.


text: Maintaining a robust cybersecurity strategy to safeguard and protect the confidentiality, integrity and availability of our critical infrastructure assets as well as all other information systems and the information residing in them is critically important to our business. We face various cyber threats, including malware intrusion, computer viruses, unauthorized access attempts, ransomware attacks, social engineering attacks, hacktivism and insider threats. In addition to the cybersecurity threats faced by any business with a cyber presence, as an owner and operator of critical infrastructure assets, we are subject to cybersecurity threats from domestic and foreign threat actors who wish to disrupt our electricity delivery operations and/or the ERCOT bulk power grid. With an ever-increasing share of our operational and administrative activity being dependent on our information systems, we strive to create a company-wide culture of cyber safety that continually monitors risk.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Our Cybersecurity Strategy Our cybersecurity strategy is built on "defense-in-depth" as recommended by the National Institute of Standards and Technology. We have processes in place to identify, assess, and manage material risks from cybersecurity threats. We have developed and implemented, and we continue to develop and implement, protective measures to reduce risk, manage incidents, and sustain our security posture. For example, in our efforts to lower the risk of ransomware attacks, we have increased our cybersecurity operations by strengthening our defense-in-depth approach to protections and controls, operational resiliency, cyber hygiene and monitoring. Specific steps include tool deployments to mitigate ransomware threats and impacts, as well as implementation of practices and enhancements to minimize the risk of ransomware launching and spreading across the organization. An additional protective measure to reduce risk with respect to the unauthorized access to confidential and sensitive data in Oncor's possession includes our data risk management (DRM) program. Our DRM program focuses on data loss prevention, including as the result of unauthorized access or acquisition, by taking proactive steps to limit confidential and sensitive information from being managed or distributed electronically in an unsecure manner. Led by our executive leadership team, as well as a governance committee and operational stakeholders, our DRM group provides formal guidance, including policies and standards, to reduce our data risk. We continue to participate, review, assess and adjust our mix of activities to improve our grid operations, digital perimeter security and information security.


text: We have policies and procedures in place to identify, protect, detect, respond and recover from cybersecurity incidents. The life cycle of our incident response includes: (i) preparation through employee training and drills, including regular simulation exercises that include management from various departments in addition to representatives from our information technology security team; (ii) detection and analysis of the cybersecurity incident; (iii) assembling the appropriate response team and escalating the incident to the appropriate parties internally and externally; (iv) containment, eradication, recovery and monitoring; and (v) post incident activity to document the root cause and discuss areas of improvement.


text: In accordance with our policies and procedures, we investigate any technological, computer, or network security event or incident within our networks or involving confidential and sensitive data maintained by Oncor, including events or incidents involving third-party vendors that interface with our networks or otherwise hold confidential and sensitive data maintained by Oncor. With respect to certain of our third-party vendors, we may also require such third-party vendors to notify us of any cybersecurity incident that may impact our operations or involve confidential and sensitive data maintained by Oncor. Multiple security operations centers monitor our digital environment at all times for anomalies, threats, and indicators of compromise. We have a variety of tests performed by internal and external parties related to the integrity of our networks, cyber protections and policies and procedures. Third-party security tests of our network, applications, perimeter, physical equipment and other areas of security are used to test cybersecurity readiness. When a cybersecurity threat either newly materializes or escalates, we elevate communication both internally and externally to ensure situational intelligence is both known and shared to help in defending against that threat.


text: We are also subject to mandatory and enforceable regulatory standards for critical infrastructure protection, which include cybersecurity-related standards. We are subject to periodic audits by Texas RE of our compliance with critical infrastructure protection standards.


text: We also participate in, and work with, multiple federal, state, industry, and academic groups dedicated to cybersecurity, such as the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency, the Federal Bureau of Investigations' InfraGard, an ERCOT critical infrastructure protection working group, the Electricity Information Sharing and Analysis Center, and the Texas Information Sharing and Analysis Organization. This includes information-sharing and coordination with ERCOT, the PUCT, and other ERCOT market participants with a view toward protecting and enhancing the ERCOT grid from cyber and physical attacks and response preparation. In addition, we participate on various technical and advisory boards, such as the advisory board of the Energy Sector Security Consortium, Inc., a nonprofit organization that supports energy sector organizations with the security of their critical technology infrastructures, and the Electricity Subsector Coordinating Council. We believe that our participation and membership within these groups and organizations contributes to security improvements that directly impact our cyber operations.


text: We believe that cyber safety is everyone's responsibility at Oncor. We take proactive steps to train, re-train, educate and test our workforce on cyber safety practices and work to strengthen the cyber community within our company. We require an annual cybersecurity training of all credentialled individuals and in October 2023 we held our 2nd annual cyber awareness month, which included informational events, speakers and additional training resources to increase our workforce's engagement in cyber safety.


text: While we have not experienced a cybersecurity incident to date that has had a material impact on Oncor, we have experienced, and expect to continue to experience, threats and attempted intrusions into our technology systems and platforms. Our third-party vendors have been subject, and will likely continue to be subject, to acts that disrupt or attempt to disrupt the services they provide to us. Threat actors could also attempt to use our third-party vendors as a conduit to attack us. We are subject to evolving cyber risks related to adversaries attacking our technology infrastructure and platforms and the technology infrastructure and platforms of third-party vendors. See "Item 1A. Risk Factors—Cyber-attacks on us or our third-party vendors could disrupt business operations, initiate the loss or disclosure of critical operating or confidential data, have an adverse impact on our reputation, and expose us to significant liabilities." A future cybersecurity incident could potentially have a material impact on our business, operations and financial condition. In addition, non-compliance with electric industry specific regulations or violation of laws could have financial penalties, as well as impact our reputation, which could materially impact our results of operations or financial condition. Cybersecurity risk has also contributed to, and is expected to continue to contribute to, increased capital expenditures and operation and maintenance expenses, including as a result of the need for additional hardware, software, equipment, personnel, training and third-party service providers, as well as increased cyber insurance costs.


text: Our Cybersecurity Team Our management is responsible for assessing, managing and mitigating all risks relative to our business, including material risks from cybersecurity threats. Within our management team, assessment, management, and mitigation of cybersecurity threats is primarily overseen by our technology group, which has extensive experience in cybersecurity, technology, and digital grid operations. Our technology group is led by Joel Austin, our senior vice president and chief digital officer, and Malia Hodges, our senior vice president and chief information officer. Mr. Austin has over 34 years of technology operations, utility industry, and leadership experience, including more than 15 years of cybersecurity oversight experience. Ms. Hodges has 25 years of technology operations, utility industry, and leadership experience, including six years as our chief information officer, with responsibility in that role for management of Oncor's technology function, including cybersecurity. Both Mr. Austin and Ms. Hodges are long-time members of the Edison Electric Institute security and technology policy committee, which focuses on working with federal agencies on cybersecurity risks relevant to the electric industry. Mr. Austin has testified on cybersecurity issues facing the State of Texas and the electric utility industry in front of multiple Texas legislative sub-committees and been asked to discuss cybersecurity risks with members of the US Congress. Mr. Austin and Ms. Hodges also work closely and regularly with PUCT staff and PUCT commissioners on cybersecurity risks and mitigations. We also have a designated chief information security officer who has over 42 years of experience in cybersecurity, a master's degree in cybersecurity and a doctorate degree in cybersecurity/information assurance. Within our technology group, we maintain a dedicated cybersecurity group and 24/7/365 team that responds to and protects against cybersecurity risks. Our collective cybersecurity staff consists of a group of employees and contractors located inside and outside the state of Texas with a wide range of specialized skills and experience, including through service in the United States military and federal agencies, cybersecurity-related certifications, membership and advisory and board positions with industry groups and non-profit organizations focused on cybersecurity, and training in the cyber defense tools and methods we deploy, as well as various higher education degrees related to cybersecurity.


text: Cybersecurity risk is considered a significant corporate risk by management. Our technology security team provides our management with a weekly cyber update that discusses cybersecurity threats impacting Oncor. Management of our cybersecurity risks begins at the individual employee level, with each employee having responsibility for operating in a cyber safe manner, and flows up to our board of directors, which has overall oversight over Oncor's corporate risk management efforts. The board of directors has delegated its risk management oversight to the Audit Committee, whose charter provides that it is responsible for discussing with management our major risk exposure, and the steps management takes to monitor and control such exposure, including our risk assessment and risk management process, guidelines, policies and practices.


text: Our senior leadership team, which includes Mr. Austin and Ms. Hodges, has established a risk management framework to actively manage, mitigate and report on the various risks faced by Oncor. Pursuant to that framework, as frequently as necessary, but not less than quarterly, our chief risk officer, members of our senior leadership team and additional members of management meet to review and assess various operational, functional, legal and other types of risks facing the company, including risks related to cybersecurity. Discussions at these risk management forums include mitigation strategies and actions to provide oversight and assign responsibility for ongoing treatment and monitoring each specific risk. Risk management information collected at these meetings is then distributed at least quarterly to the Audit Committee of our board of directors as well as our full board of directors. In addition, our chief risk officer reports on these risk management efforts, including risks related to cybersecurity, to the Audit Committee and/or the full board of directors at least quarterly. In addition, Mr. Austin and Ms. Hodges also provide separate written reports on cybersecurity risks and activities to both the Audit Committee and the full board of directors, with specific discussion time devoted to cybersecurity at the Audit Committee and/or the full board of directors at least quarterly.


text: Maintaining a robust cybersecurity strategy to safeguard and protect the confidentiality, integrity and availability of our critical infrastructure assets as well as all other information systems and the information residing in them is critically important to our business. We face various cyber threats, including malware intrusion, computer viruses, unauthorized access attempts, ransomware attacks, social engineering attacks, hacktivism and potential insider threats. In addition to the cybersecurity threats faced by any business with a cyber presence, as an owner and operator of critical infrastructure assets, we are subject to cybersecurity threats from domestic and foreign threat actors who wish to disrupt our electricity delivery operations and/or the ERCOT bulk power grid. With an ever-increasing share of our operational and administrative activity being dependent on our information systems, we strive to create a company-wide culture of cyber safety that continually monitors risk.


text: Our Cybersecurity Strategy Our cybersecurity strategy is built on "defense-in-depth" as recommended by the National Institute of Standards and Technology. We have processes in place to identify, assess, and manage material risks from cybersecurity threats. We have developed and implemented, and we continue to develop and implement, protective measures to reduce risk, manage incidents, and sustain our security posture. For example, in our efforts to lower the risk of ransomware attacks, we have increased our cybersecurity operations by strengthening our defense-in-depth approach to protections and controls, operational resiliency, cyber hygiene and monitoring. Specific steps include tool deployments to mitigate ransomware threats and impacts, as well as implementation of practices and enhancements to minimize the risk of ransomware launching and spreading across the organization. These efforts also include the ongoing identification, review and mitigation of vulnerabilities to our owned or operated systems. An additional protective measure to reduce risk with respect to the unauthorized access to confidential and sensitive data in Oncor's possession includes our data risk management (DRM) program. Our DRM program focuses on data loss prevention, including as the result of unauthorized access or acquisition, by taking proactive steps to limit confidential and sensitive information from being managed or distributed electronically in an unsecure manner. Led by our executive leadership team, as well as a governance committee and operational stakeholders, our DRM group provides formal guidance, including policies and standards, to reduce our data risk. We continue to participate, review, assess and adjust our mix of activities to improve our grid operations, digital perimeter security and information security. For example, we are evaluating and implementing additional governance focused defensive measures as a result of new National Institute of Standards and Technology guidance.


text: In accordance with our policies and procedures, we investigate any technological, computer, or network security event or incident within our networks or involving confidential and sensitive data maintained by Oncor, including events or incidents involving third-party vendors that interface with our networks or otherwise hold confidential and sensitive data maintained by Oncor. With respect to certain of our third-party vendors, we may also require such third-party vendors to notify us of any cybersecurity incidents and/or vulnerabilities that may impact our operations or involve confidential and sensitive data maintained by Oncor. Multiple security operations centers monitor our digital environment at all times for anomalies, threats, and indicators of compromise. We have a variety of tests performed by internal and external parties related to the integrity of our networks, cyber protections and policies and procedures. Third-party and internal security testing of our network, applications, perimeter, physical equipment and other areas of security are used to test cybersecurity readiness. When a cybersecurity threat either newly materializes or escalates, we elevate communication both internally and externally to ensure situational intelligence is both known and shared to help in defending against that threat.


text: We are also subject to mandatory and enforceable regulatory standards for critical infrastructure protection, which include cybersecurity-related standards. We are subject to periodic audits by Texas RE of our compliance with critical infrastructure protection standards. In addition, we are required to file an emergency operation plan with the PUCT, including our procedures relating to addressing cyber incidents.


text: We believe that cyber safety is everyone's responsibility at Oncor. We take proactive steps to train, re-train, educate and test our workforce on cyber safety practices and work to strengthen the cyber community within our company. We require an annual cybersecurity training of all credentialled individuals, and each year we hold an annual cyber awareness month, which includes informational events, speakers and additional training resources to increase our workforce's engagement in cyber safety.


text: While we have not experienced a cybersecurity incident to date that has had a material impact on Oncor, we have experienced, and expect to continue to experience, threats and attempted intrusions into our technology systems and platforms. Our third-party vendors have been subject, and will likely continue to be subject, to acts that disrupt or attempt to disrupt the services they provide to us. Our technology team works to evaluate third-party solutions purchased, implemented or upgraded to ensure they meet our cybersecurity requirements. Threat actors could also attempt to use our third-party vendors as a conduit to attack us. We are subject to evolving cyber risks related to adversaries attacking our technology infrastructure and platforms and the technology infrastructure and platforms of third-party vendors. See "Item 1A. Risk Factors—Risk Related to Our Business and Operations—Cyber-attacks on us or our third-party vendors could disrupt business operations, initiate the loss or disclosure of critical operating or confidential data, have an adverse impact on our reputation, and expose us to significant liabilities." A future cybersecurity incident could potentially have a material impact on our business, operations and financial condition. In addition, non-compliance with electric industry specific regulations or violation of laws could have financial penalties, as well as impact our reputation, which could materially impact our results of operations or financial condition. Cybersecurity risk has also contributed to, and is expected to continue to contribute to, increased capital expenditures and operation and maintenance expenses, including as a result of the need for additional hardware, software, equipment, personnel, training and third-party service providers, as well as increased cyber insurance costs.


text: Our Cybersecurity Team Our management is responsible for assessing, managing and mitigating all risks relative to our business, including material risks from cybersecurity threats. Within our management team, assessment, management, and mitigation of cybersecurity threats is primarily overseen by our technology group, which has extensive experience in cybersecurity, technology, and digital grid operations. Our technology group is led by Joel Austin, our senior vice president and chief digital officer, and Malia Hodges, our senior vice president and chief information officer. Mr. Austin has over 35 years of technology operations, utility industry, and leadership experience, including more than 16 years of cybersecurity oversight experience. Ms. Hodges has 26 years of technology operations, utility industry, and leadership experience, including seven years as our chief information officer, with responsibility in that role for management of Oncor's technology function, including cybersecurity. Both Mr. Austin and Ms. Hodges are long-time members of the Edison Electric Institute security and technology policy committee, which focuses on working with federal agencies on cybersecurity risks relevant to the electric industry. Mr. Austin has testified on cybersecurity issues facing the State of Texas and the electric utility industry in front of multiple Texas legislative sub-committees and been asked to discuss cybersecurity risks with members of the U.S. Congress. Mr. Austin and Ms. Hodges also work closely and regularly with PUCT staff and PUCT commissioners on cybersecurity risks and mitigations. We also have a designated chief information security officer who has over 43 years of experience in cybersecurity, a master's degree in cybersecurity and a doctorate degree in cybersecurity/information assurance. Within our technology group, we maintain a dedicated cybersecurity group and 24/7/365 team that responds to and protects against cybersecurity risks. Our collective cybersecurity staff consists of a group of employees and contractors located inside and outside the state of Texas with a wide range of specialized skills and experience, including through service in the U.S. military and federal agencies, cybersecurity-related certifications, membership and advisory and board positions with industry groups and non-profit organizations focused on cybersecurity, and training in the cyber defense tools and methods we deploy, as well as various higher education degrees related to cybersecurity.


text: Our senior leadership team, which includes Mr. Austin and Ms. Hodges, has established a risk management framework to actively manage, mitigate and report on the various risks faced by Oncor. Pursuant to that framework, as frequently as necessary, but not less than quarterly, members of our senior leadership team and additional members of management meet to review and assess various operational, functional, legal and other types of risks facing the company, including risks related to cybersecurity. Discussions at these risk management forums include mitigation strategies and actions to provide oversight and assign responsibility for ongoing treatment and monitoring each specific risk. Risk management information collected at these meetings is then distributed at least quarterly to the Audit Committee of our board of directors and/or our full board of directors. Our risk management efforts, including risks related to cybersecurity, are reported on to the Audit Committee and/or the full board of directors at least quarterly. Mr. Austin and Ms. Hodges also provide separate written reports on cybersecurity risks and activities to both the Audit Committee and the full board of directors, with specific discussion time devoted to cybersecurity at the Audit Committee and/or the full board of directors at least quarterly.


text: associated with cybersecurity. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors - The occurrence of security breaches and cyber-attacks could negatively impact our business." and "- If the Chinese government chooses to exert more oversight and control over offerings that are conducted overseas and/or foreign investment in China-based issuers, such action could significantly limit or completely hinder our ability to offer or continue to offer securities to investors and cause the value of such securities to significantly decline or be worthless. "

companyName: GULF RESOURCES, INC.

ticker: GURE


text: of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives. Under our comprehensive risk management program, the Board of Directors of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program.


text: The full Board of Directors retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, our Board of Directors receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.


text: cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.


text: of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity.


text: >From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the trust and confidence of our customers, franchisees and employees. Consequently, our cybersecurity policies, standards, processes and practices are contained within our Corporate Security Policy. Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise risk management program.

companyName: POTBELLY CORP

ticker: PBPB


text: We utilize multiple information systems, including accounting software, customer relationship management solutions, our mobile app, online ordering platforms, point-of-sale software and data warehouse. In the ordinary course of business, we collect, and our franchisees may collect confidential information.


text: To protect the information that we gather and the availability of our IT systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide constant monitoring of our systems. A cybersecurity threat is any potential unauthorized occurrence on or conducted through our information systems or the information systems of a third party that we utilize in our business which may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes and practices are based on the Center for Internet Security Critical Security Controls and include the following components:


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Deployment of Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We identify and address information security risks by employing a defense-in-depth methodology that provides multiple, redundant defensive measures in case of security control fails or a vulnerability is exploited.


text: Development and Periodic Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity threat, and such plans are tested and evaluated on a regular basis. Our periodic testing of these plans include a wide range of activities, such as audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, internal audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Outside Consultants: The Company engages various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to, among other things, externally audit our systems against top information security standards, including controls for Payment Card Industry Data Security Standard (PCI DSS) and conduct regular testing of our networks and systems to identify vulnerabilities.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct due diligence of third-party vendors that we engage.


text: Implementation of Regular and Mandatory Employee Training and Awareness Programs: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, or that are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee receives timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Officer ("CIO"). The Audit Committee makes regular reports to the full Board regarding our information technology risks. Each member of our Audit Committee is experienced in the area of information security, either as a result of their professional history, their current responsibilities in overseeing processes and controls in this area at the Company, or both. The Audit Committee may discuss such processes and controls with our internal accounting and security teams and independent registered public accounting firm.


text: Our CIO manages our Cyber Security Program, including the management of risks arising from cybersecurity threats. Our management receives quarterly, and more frequently, if necessary, presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our CIO works, in coordination with our senior management, to implement new programs, as needed, and to oversee our current programs which are designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CIO has served in various roles in information technology and information security for over 20 years, including serving in senior leadership roles overseeing information technology systems, including previous service at a company in our industry. Our CIO serves on the board of directors of the Chicago chapter of the Society for Information Management where he has the opportunity to interact with senior IT leaders throughout the technology and business fields, including in the industry, government and academic sectors.


text: Our dedication to maintaining the trust and confidence of our customers, franchisees, and employees is fundamental to our operations. This commitment is reflected in our cybersecurity program, which encompasses policies, standards, processes, and practices and is fully integrated into our Corporate Security Policy and Enterprise Risk Management Program. Our Cybersecurity Program promotes a proactive and resilient approach to protecting the integrity, confidentiality, and availability of our systems and data.


text: To protect the information that we gather and the availability of our IT systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes continuous detection, prevention and monitoring from an external cybersecurity service provider. A cybersecurity threat is any potential unauthorized occurrence, or a series related to unauthorized occurrences, on or conducted through our information systems or the information systems of a third party that we utilize in our business which may adversely affect the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes and practices are based on the Center for Internet Security Critical Security Controls framework and include the following components:


text: Deployment of Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, penetration testing and cybersecurity threat intelligence. We identify and address information security risks by using a defense-in-depth methodology that provides multiple, redundant defensive measures in case if a security control fails or a vulnerability is exploited.


text: Development and Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity threat, and such Plans are tested and evaluated annually. Our annual testing of these plans include a wide range of activities, such as audits, tabletop exercises, threat modeling, vulnerability assessments, penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: We maintain cybersecurity insurance to protect our organization from potential financial losses due to cyber incidents, such as data breaches, ransomware attacks, and other cyber-related events. Our cyber insurance policy is a key part of our risk management strategy. However, it is important to note that this coverage may not completely cover all potential losses or liabilities associated with a cybersecurity incident. We regularly review and update our policy to ensure it aligns with evolving risks and industry standards. By having this insurance in place, we are better prepared to manage the financial consequences of any cyber threats we may face.


text: We engage third parties to asses our cybersecurity measures, including information security maturity assessments, internal audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Outside Consultants: We engage various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to, among other things, externally audit our systems against top information security standards, including controls for Payment Card Industry Data Security Standard (PCI DSS) and conduct regular testing of our networks and systems to evaluate and strengthen our cybersecurity posture.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct due diligence on third-party vendors by performing risk assessments and evaluating their compliance with relevant regulations, such as the Service Organization Control reports (SOC1 and SOC2). We also seek to obtain contractual assurance that our vendors will maintain adequate controls, such as adequate security against data breaches.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected us, or that are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee receives timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Officer ("CIO"). The Audit Committee makes regular reports to the full Board regarding our information technology risks. Each member of our Audit Committee is experienced in the area of information security, either as a result of their professional history, current responsibilities in overseeing processes and controls in this area at the Company, or both. The Audit Committee may discuss such processes and controls with our internal accounting and security teams and independent registered public accounting firm.


text: Our CIO has served in various roles in information technology and information security for over 20 years, including serving in senior leadership roles overseeing information technology systems, including previous service at a company in our industry. Our CIO serves on the Board of Directors of the Chicago chapter of the Society for Information Management where he has the opportunity to interact with senior IT leaders throughout the technology and business fields, including in the industry, government and academic sectors.


text: present the Company has minimal risk related to Cybersecurity as no operational business is conducted on the internet or available through the internet.

companyName: FinTrade Sherpa, Inc.

ticker: FTSP


text: risk management will be an integral part of our overall enterprise risk management efforts once the Company has determined how and what security measures will need to be deployed. No enterprise risk can be eliminated entirely. We will seek to mitigate as much risk as possible and manage the remaining financial risk through a cyber insurance policy. The Company has chosen the National Institute of Standards (NIST) for its base framework because it is compatible with certain risk management business functions required by customers and US Government oversight. Controls in the SP 800-53 catalog will be tailored-in based on governance found in SP 800-171, internally determined IT General Controls and industry best practices to create a balanced approach protecting confidentiality, integrity, and availability.


text: Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.


text: to be newly formed" management positions responsible for assessing and managing cybersecurity risks will be a Director of Cybersecurity and a Chief Information Officer ("CIO"), who will report directly to our CFO. Presently our CFO is undertaking the actions of both the Director of Cybersecurity and CIO. The CIO will be responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy.


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: WILLAMETTE VALLEY VINEYARDS INC

ticker: WVVI


text: identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. The Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that the Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: LSEB Creative Corp.

ticker: LSEB


text: the year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. The Company does not currently engage assessors, consultants, auditors, or other third parties in connection with any such processes. Other than the integration of the Company's cybersecurity processes with the Company's overall risk management systems, the Company does not have specific processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider.

companyName: Next Bridge Hydrocarbons, Inc.


text: of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report.


text: Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Chief Financial Officer will directly inform the Audit Committee about the prevention, detection, mitigation, and remediation of cybersecurity incidents, when applicable, so that the Audit Committee can monitor the same. Updates on cybersecurity matters, including material risks and threats, will be provided to the Company's Audit Committee, and the Audit Committee provides updates to the Company's Board of Directors at regular board meetings.


text: the oversight of the Audit Committee of the Board of Directors, the Company's Chief Financial Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. Although our Chief Financial Officer has extensive and broad expertise in overall accounting and executive management, he does not have any prior work experience, relevant degrees, certifications or other background specific to cybersecurity.


text: Audit Committee of the Company's Board of Directors, with the assistance of the Company's Chief Financial Officer, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.


text: further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factors in this report, titled " We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Company, whether at the board of directors or management level, does not currently have any processes in place for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Point of Care Nano-Technology, Inc.


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full Board has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In the event a cybersecurity incident occurs, the Company's Chief Executive Officer and the Chief Financial Officer are expected to inform the Board of the details of such incident as well as the measures taken in response to such incident. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: the year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Risk Management and Strategy In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We assess and identify cybersecurity risk to such information by maintaining cybersecurity policies that require continuous monitoring and detection programs and network security precautions. Our program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information.

companyName: CODEXIS, INC.

ticker: CDXS


text: We manage cybersecurity risks by maintaining various protections designed to safeguard against cyberattacks, including firewalls and virus detection software, and periodic end user training on common cybersecurity threats (e.g. phishing exercises and interactive trainings). We have established our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess effectiveness of our data security practices. A third party security consultant conducts regular network security reviews, scans and audits, and we may consult with other external experts as warranted by a particular cybersecurity incident or threat. In addition, we maintain insurance that includes cybersecurity coverage.


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by our Vice President of Information Technology ("VP IT") to the Board's Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually. In this way, our program to manage cybersecurity risk integrates with our overall risk management processes.


text: With respect to third parties who provide services affecting critical business management systems, we collect and maintain SOC2 type II reports (attestation of controls at a service organization over a minimum six-month period). For other third-party service providers, cybersecurity risk is addressed as appropriate.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: The Company's Board of Directors has visibility into cybersecurity risks through its Audit Committee and through the process described below. The Audit Committee has oversight of the Company's cybersecurity risk management programs and the design and operating effectiveness thereof, and reviews reports from Company management on cybersecurity, data privacy and other risks relevant to the Company's computerized information system controls and security.


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by the VP IT to the Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually.


text: Senior management has appointed a Cybersecurity Council that is responsible for identifying, escalating, and facilitating the assessment and determination of the materiality of cybersecurity incidents and threats. The Cybersecurity Council is made up of representatives of IT, Legal and Finance, as well as ad hoc additional members depending on the circumstances of the incident or threat. The members of the Cybersecurity Council do not have specific expertise in cybersecurity risk other than the VP IT who has more than 20 years of experience, and engages with trusted third-party experts for support and guidance when additional expertise is required. Prior to joining Codexis, our VP IT has managed cybersecurity functions, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters.


text: An actual or suspected cybersecurity incident that jeopardizes the confidentiality, integrity, or availability of Codexis' information systems or any information residing therein (or threat that presents significant risk to our information systems as identified by IT) is reported to the Cybersecurity Council by our IT Department. The focus of the Cybersecurity Council is on the investigation and facilitation of senior management's assessment and determination of materiality of an incident or threat, and such investigation is separate but contemporaneous with the investigation(s) done under other applicable programs, policies, and plans regarding cybersecurity. The Cybersecurity Council will liaise directly with other investigation(s) and share information and assessments. Along with assistance from the Cybersecurity Council as necessary, senior management reports its materiality determination and analysis, including necessary facts to support its determination, to the Audit Committee of the Board of Directors. Pursuant to its charter, the Audit Committee may, along with senior management, report such determination to the Board of Directors.


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by our Chief Financial Officer to the Board's Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually. In this way, our program to manage cybersecurity risk integrates with our overall risk management processes.


text: With respect to third parties who provide services affecting critical business management systems, we collect and maintain SOC2 or SOC1 type II reports (attestation of controls at a service organization over a minimum six-month period). For other third-party service providers, cybersecurity risk is addressed as appropriate.


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by the Chief Financial Officer to the Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually.