text: Cybersecurity Risk Management and Strategy. Our cybersecurity and data protection strategy is part of our overall enterprise risk management program, and is focused on the identification, detection, management and mitigation of security risks and prompt incident response intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, technology and financial risk. Key elements of our cybersecurity risk management strategy include: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security program; • data protection policies and controls; and • the deployment of technologies designed to mitigate material cybersecurity risks to our critical systems, information, products and services, and our broader enterprise information technology environment.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: As of the date of this report, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, see Item 1A, "Risk Factors".

secItem: Item 1C


text: Cybersecurity Governance. The Audit Committee of our Board of Directors reviews risks related to information technology, including cybersecurity, and receives reports from our executive officers and third parties on cybersecurity matters. Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. Our Chief Technology Officer oversees cybersecurity matters, with support from our internal information technology team and third parties. We expect that our cybersecurity risk management processes and strategy will continue to evolve in response to the evolution of the cybersecurity threat landscape.


text: The Corporation understands the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Corporation is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Corporation collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and Enterprise Risk Management Committee, provide direction and oversight of the enterprise-wide risk management program of the Corporation, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Corporation.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Corporation deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Corporation also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Corporation employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Corporation, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.


text: Cybersecurity Risk Management and Strategy As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Debt Solutions BDC


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board of Trustees, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance Apollo's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of Apollo's Board of Directors ("Apollo's audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Apollo's Board of Directors, Apollo's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, Apollo's Chief Security Officer ("CSO"), the CISO, the AHL CISO. other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, Apollo's Board of Directors and/or Apollo's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full Apollo Board of Directors or Apollo's audit committee receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, as well as from AHL's CISO, at least annually.


text: Apollo's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously Apollo's CISO for nearly eight years. Apollo's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: Apollo's CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to Apollo's audit committee or Apollo's Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Trustees, our audit committee regularly interacts with, and receives reports from, our management, the Adviser, Apollo, and other service providers. The audit committee of our Board of Trustees receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and employees ("Information Systems and Data").

companyName: IN8BIO, INC.

ticker: INAB


text: Our information security function is led by our Director of Information Technology (IT Director), who reports to our Chief Financial Officer (CFO), and is supported by our third party security consultant, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting threat assessments for internal and external threats, engaging third parties for threat assessments, and conducting assessments to identify vulnerabilities. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management processes. For example, our IT Director and certain management, including our CFO, evaluate material risks from cybersecurity threats against our overall business objectives and our CFO periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, encryption of certain data, segregation of certain data, network security controls, physical security controls, asset management, employee training, penetration testing, and cybersecurity insurance. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We utilize certain vendor management processes to help manage cybersecurity risks associated with our use of certain these providers, including, for example, risk assessments and reviews of the provider's written security program documentation. Our vendor management processes may vary depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the rick factor entitled "If our information technology systems or sensitive information, or those of our collaborators or other contractors or consultants, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to, a significant disruption of our product development programs and our ability to operate our business effectively, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CFO, the Chief Operating Officer (COO) and the IT Director having over 30 years of information security experience. The CFO and COO each have over ten years of experience in roles with responsibility for overseeing information technology and security functions.


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CFO, COO and Chief Executive Officer, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The Company's Chief Financial Officer ("CFO"), Information Technology ("IT") manager, legal function and external information technology and cybersecurity service provider help to identify, assess and manage our cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, conducting internal audits, and conducting internal and external threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of data, network security controls, access controls, asset management and disposal, physical security, systems monitoring, employee training, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT manager works with our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our management team evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to the Audit Committee of our board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, managed cybersecurity providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosted services, CROs, and CMOs. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A titled "Risks Related to Our Business Operations, Employee Matters and Managing Growth."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO and IT manager. Our CFO has overseen and been responsible for the Company's information technology and cybersecurity programs since 2018, and before that held equivalent responsibilities at another public company. Our IT manager has approximately seven years of experience with testing, implementing and maintaining our information technology systems and security.


text: Our CFO is responsible for hiring appropriate personnel, retaining third-party information technology service providers, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel and approving budgets. Our IT manager and our third-party information technology service provider are together responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to key members of management depending on the circumstances. Our CFO works with the Company's IT manager and our third-party information technology service provider to help us mitigate and remediate cybersecurity incidents of which our CFO is notified. In addition, our incident response plan includes reporting to the Audit Committee of our board of directors for certain cybersecurity incidents.


text: The Audit Committee receives regular reports from our CFO concerning the Company's significant cybersecurity threats and risks, and the processes the Company has implemented to address them. The board of directors also has access to reports, summaries and presentations related to the Company's cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We have established a risk management framework which provides for the identification, assessment, management, and monitoring of cybersecurity risks. The implementation of this framework includes an iterative and periodically updated risk identification process and will include penetration testing. Identified risks are assessed, managed, monitored, and periodically reassessed to account for new threats, changes in operations, the effectiveness of implemented safeguards, and other factors.


text: Our risk management framework activities include the identification, assessment, and monitoring of reasonably foreseeable internal and external risks, including risks associated with key third-party vendors and service providers. The risk assessment, monitoring, and review process address the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. In this context, under our risk management framework, we periodically work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks, including risks related to third-party vendors and service providers; monitor the effectiveness of our safeguards; and reasonably address any identified gaps in existing safeguards.


text: As part of our risk management framework, we also periodically assign third-party cybersecurity training to our employees on our cybersecurity policies and safeguards.


text: We employ external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, and to identify, assess, manage, and monitor cybersecurity risks. Under the supervision of senior executive management, our Head of Information Technology (IT), supported by external cybersecurity consultants, supervises and directs the implementation of our cybersecurity risk management framework.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled, "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer actual or suspected security or data privacy incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal information, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations, and potentially significant delays in our clinical trials and delivery to market." and "We are subject to stringent and changing privacy, data protection and data security laws, regulations and standards as well as policies, contracts and other obligations related to data privacy, data protection and data security. Our actual or perceived failure to comply with such obligations could lead to enforcement or litigation (that could result in fines or penalties), a disruption or cancellation of clinical trials or commercialization of products, reputational harm, or other adverse business effects."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. The audit committee has primary board responsibility for strategic oversight of our cybersecurity program, including by quarterly reviewing and discussing with management the Company's cybersecurity and other information technology risks, controls and procedures, as well as the Company's plans to mitigate cybersecurity risks and to respond to data breaches.


text: Our Chief Legal Officer, who serves as our Head of Information Technology (IT), with the assistance of and informed by our external consultants, is primarily responsible for overseeing our cybersecurity risk management framework, including assessing and managing our material risks from cybersecurity threats, as well as monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Legal Officer and Head of IT has experience as a senior legal, compliance and operations executive in highly regulated companies, including in roles with executive-level responsibility for overseeing data privacy and security compliance.


text: The processes by which our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular reports from the Chief Legal Officer and Head of IT. Our Chief Legal Officer and Head of IT also provides quarterly briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses as well as the results of our risk management activities. Our audit committee provides updates to the board of directors on such reports.


text: The audit committee of our board of directors is responsible for the general oversight around cybersecurity-related matters, while our management is responsible for the day-to-day operations around the assessment and management of any cybersecurity risks we might face. Our board of directors and the audit committee, in consultation with management, established and maintained robust procedures and internal controls around cybersecurity. These mechanisms are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: At each regularly scheduled audit committee meeting, our chief financial officer provides an update on our cybersecurity position, and where necessary, the audit committee then provides an update to the board of directors. Our incident response process also contemplates that the executive team will notify the audit committee of a material cybersecurity incident.


text: We engage an experienced consultant to oversee the day-to-day functions of cybersecurity management, including proactive reviews of activity logs, regular vulnerability scans, and, where applicable, effective incident response. Our expert consultant has over 30 years of experience in the cybersecurity space, and reports to the chief financial officer. We also engage a highly qualified third-party cybersecurity assessor to conduct annual threat assessments and penetration tests. To date, we have not encountered cybersecurity incidents that have materially impacted our operations or financial standing.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Allakos Inc.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report, including the risk factors entitled "We may experience disruptions and delays or incur financial damages as a result of system failures or security breaches or incidents" and "If we fail to comply with applicable U.S. and foreign privacy and data protection laws and regulations, we may be subject to liabilities that adversely affect our business, operations and financial performance".


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer, in conjunction with our information security team and third-party consultants, is primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer provides briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In addition, our Chief Financial Officer provides briefings of any significant cybersecurity matters to the Board as well as an annual update of cybersecurity risks and activities.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, providing multiple layers of security, to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's ("FFIEC"), the National Institute of Standards and Technology ("NIST"), and other agencies providing guidance in this area, as well as by engaging experts to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: • conduct annual customer data handling and use requirements training for our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for employees with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • utilize an incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • maintain multiple layers of controls, including embedding security into our technology investments; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • external reviews of our cybersecurity position to help ensure adherence to best practices and validate risk assessments and response plans.


text: We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal and third-party assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Information Technology Steering Committee of the Board of Directors of the Bank at least quarterly. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence.


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Privacy of Customer Information and "– Cybersecurity" included in Part I. Item 1 – Business of this report.


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future. For additional information regarding the risk the Company faces from cybersecurity threats, please see the risk factors titled "We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers" and "We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action." included in Part I. Item 1A. – Risk Factors of this report.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Information Technology Steering Committee of the Board of Directors of the Bank, which then reports to the entire Board, is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Information Technology Steering Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Information Technology Steering Committee generally receives materials, including materials indicating current and emerging material cybersecurity threat risks and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer, Information Security Officer, and other staff as needed.


text: Members of the Information Technology Steering Committee, and other members of the Board, are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management process, which is discussed in greater detail above, is led by our Chief Information Officer, Information Security Officer, Chief Risk Officer, and other staff as needed. Such individuals have collectively over 90 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and safeguarding corporate and customer information.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. As discussed above, these members of management report to the Information Technology Steering Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly. A summary report is provided to the full Board of Directors at least annually.


text: Cyber Risk Management and Strategy We have implemented and maintain various information security processes designed to manage cybersecurity risks relating to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and products (Information Systems and Data).

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Our Director of Information Technology, assisted by our managed information technology service provider and other third party service providers, lead the Company's cybersecurity risk management processes. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing threat intelligence reports and feeds, conducting scans of certain environments, and other tests.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage risks from cybersecurity threats to our Information Systems and Data, as applicable depending on the environment, including incident detection and response, disaster recovery/business continuity policies, network security controls and data segmentation, access controls, physical security, asset management and tracking, systems monitoring, and employee training.


text: Our assessment and management of risks from cybersecurity threats are part of the Company's overall risk management processes. Our Director of Information Technology works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us to identify, assess, and manage risks from cybersecurity threats. These third-party service providers may include threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We also have established a process to conduct diligence on certain third parties before engaging with those third parties, such as those that support our GxP processes, which may include a security assessment.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see our risk factors under Part 1 Item 1A. Risk Factors.


text: Our board of directors holds oversight responsibility over the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of the Company's processes for monitoring and controlling cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, who has over 10 years of information technology management experience.


text: The Director of Information Technology, along with management, is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security-related reports.


text: We have processes designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President Legal and Compliance, Vice President Finance and Administration, Chief Financial Officer and Director of Information Technology. In addition, the Company's incident response policy includes a process for reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives reports from members of the Company's management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them, as applicable.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data associated with our clinical trials or manufacturing campaigns, and other confidential information that is proprietary, strategic or competitive in nature. We perform periodic assessments of our information security processes, and the results of these assessments are reported to the audit committee of the board of directors (Audit Committee) as part of a cybersecurity update report conducted at least annually.

companyName: aTYR PHARMA INC

ticker: ATYR


text: We also engage vendors from time to time to assist with enterprise managed detection and response, security information and event management, and enterprise vulnerability management. These vendors also assist us from time to time in identifying, assessing and managing material risks from cybersecurity threats. The vendors include threat intelligence service providers, cybersecurity software providers and managed cybersecurity service providers.


text: We have adopted an Incident Response Management Procedure (Procedure) designed to help us respond to cybersecurity incidents and mitigate our risks and impacts. An incident response team is responsible for carrying out the Procedure and is led by our Information & Technology (IT) department, and includes members from our legal and compliance, finance, and human resource departments (Security Management Team). We also manage and maintain business continuity and disaster recovery capabilities to help ensure the availability of business-critical technology resources during adverse conditions.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management process. In addition, we have implemented a cybersecurity third party risk management process designed to assess the cybersecurity practices and monitor certain critical third parties, and to assist the business in making risk-informed technology services decisions. Our practice is to perform due diligence on certain third parties who maintain Sensitive Information, including CROs that manage and administer our clinical trials, and our CDMOs that manufacture our drug product to be used in clinical trials. Additionally, we monitor these third parties through frequent program management meetings as well as joint steering committee meetings in certain cases.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those threats may do so, see our risk factors under Part 1. Item 1A. "Risk Factors - If our information technology systems or data, or those maintained on our behalf, are or were compromised, this could result in a Material Adverse Impact."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing, assessing and considering the overall risk management policies and procedures, including our cybersecurity risk management processes, and oversight of mitigation of risks from cybersecurity threats.


text: Our Security Management Team is responsible for day-to-day management of cybersecurity risk, including hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity risk assessment and management processes are implemented and maintained by the Security Management Team. Our Security Management Team includes our CFO who has more than 15 years of experience in managing IT departments, and certain members of our IT department who have over 25 years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CEO and other members of our executive leadership team (ELT). Our CFO, CEO and ELT work with our Security Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives annual reports from the Security Management Team concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have processes in place for identifying, assessing and managing material risks associated with cybersecurity threats. For a discussion of how risks from cybersecurity threats affect our business, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Risk Management and Strategy Enterprise risk management is the responsibility of our executive management team consisting of our chief executive officer, chief financial officer, chief legal officer and our vice presidents of operations, business development and environmental, health and safety. Our executive management team meets on a weekly basis and discusses cybersecurity on an ad hoc basis when it is relevant. Our director of Information Technology, who reports directly to our chief executive officer, and our director of Internal Audit are primarily responsible for management of cybersecurity risk. Our director of Information Technology is an active ISC2 accredited member with 14 years of information technology experience, namely in developing solutions focused on private and hybrid cloud computing systems for small scale organizations. In accordance with our overall enterprise risk management process, our executive management team supervises our director of Information Technology and director of Internal Audit to assess, identify and manage material risks from cybersecurity threats. As part of this process, we rely significantly on third-party providers to assist us with our cybersecurity risk management and strategy. These providers supply ongoing services including consulting services, access to a virtual CISO, threat monitoring and detection, threat response and mitigation strategies, updates on emerging trends and developments and policy and procedure guidance. Other service providers offer targeted assistance such as security and forensic expertise on an as needed basis. We also maintain cybersecurity insurance.


text: With respect to our employees, we run a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing.


text: As part of our Sarbanes-Oxley controls, our Internal Audit department tests our IT policies including those pertaining to passwords, backup and recovery, user access, change control and hardware and software maintenance. These audits assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of financial reporting systems and data. Additionally, key employees complete a survey containing questions about cybersecurity in connection with the quarterly Sarbanes-Oxley certification process. If any control deficiencies that represent material cybersecurity risks are identified in connection with these audits, those would be reported to the Audit Committee and Board of Directors. We also obtain SOC 2 certifications from certain of our third-party service providers.


text: As of the date of this Annual Report on Form 10-K, we have not implemented formal processes to oversee and identify risks from cybersecurity threats associated with our use of third parties. We are working toward the implementation of a third-party risk management program. We believe that this program will better enable us to identify and manage material risks from cybersecurity threats related to our third-party service providers.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.


text: The Audit Committee is tasked with overseeing our risks related to cybersecurity, including reviewing the state of our cybersecurity, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks. From time to time, members of our executive management team and our directors of Information Technology and Internal Audit provide updates to the Audit Committee and the Board of Directors regarding cybersecurity incidents and cybersecurity planning.


text: Governance and oversight of cybersecurity risks and strategies form a core component of our risk management framework. Recognizing the critical importance of cybersecurity in protecting our operations and preserving shareholder value, we have established a governance structure that emphasizes proactive risk identification, management, and mitigation across the entirety of our organization.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Central to our governance approach is the active involvement of our Audit Committee, which plays a vital role in overseeing the Company's cybersecurity strategy. Alta's Audit Committee is a subset of our Board of Directors, which maintains oversight of our strategic direction regarding cybersecurity.


text: Key to the Audit Committee's effectiveness is its regular engagement with our cybersecurity team, as further described below, a practice that provides direct communication and alignment on cybersecurity matters. During these critical meetings, several pivotal areas are reviewed to assess the adequacy and effectiveness of our cybersecurity measures: • Incident Response: Evaluation of our readiness and response strategies to cybersecurity incidents, positioning us to quickly and effectively mitigate any potential impacts. • Cybersecurity Industry Updates: Review of recent industry developments (i.e., new threats/tactics, industry news) to comply and adapt our strategies accordingly. • Acquisition Security Integration: Discussion on the security aspects of recent or upcoming acquisitions, focusing on the integration of their cybersecurity frameworks into our broader security posture. • Key Initiatives: Reflection on the major cybersecurity initiatives undertaken in the past year, assessing their outcomes and lessons learned. • Goals: Setting forth our cybersecurity objectives for the coming year, aligning them with our overall business strategy and risk management framework. • Employee Security Awareness and Training: Results from our regular testing and training of employees is presented and discussed. • Penetration Test Results: Analysis of the findings from our regular penetration testing exercises, which help identify vulnerabilities and strengthen our defenses. • Questions and Answers: An open forum for the Audit Committee to seek clarifications and provide guidance on cybersecurity matters, fostering a culture of transparency and continuous improvement.


text: This structured approach to governance and oversight, with a clear emphasis on receiving feedback allows us to align with the entire Alta organization. By prioritizing the identification and management of cybersecurity risks at the highest levels, we aim to safeguard our assets, protect shareholder interests, and maintain the continuity of our business operations in the face of evolving cyber threats.


text: Our Senior Director of IT and Director of Security and Compliance have primary responsibility for assessing and managing cybersecurity risks. An internal team of cybersecurity experts execute our cybersecurity program while our VP of Information Services provides executive oversight. Combined, our experts bring multiple decades of cybersecurity experience and have earned cybersecurity-related certifications. Our internal team is bolstered by strategic third-party security partners leveraged to provide 24x7 monitoring and response. Third parties routinely assess our security practices providing tactical assistance or strategic guidance through audits and penetration tests. All members of the team routinely discuss emerging security threats and ways to mitigate risk.


text: We utilize an in-depth layered approach to security. This allows us to respond and proactively mitigate cybersecurity risks, underscoring our commitment to the confidentiality, integrity, and availability of our data and systems. The Company has processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. Our strategy includes the deployment of advanced security products and rigorous penetration testing to identify and mitigate vulnerabilities by continuous vulnerability scanning and round-the-clock monitoring by both internal and external teams. This proactive stance is further bolstered by backup and recovery protocols, ensuring data resilience, and enhanced by email security measures and endpoint detection and response systems to thwart malicious activities.


text: Additionally, our commitment to security best practices is evident in our implementation of privileged access management, security awareness training for all employees, dark web monitoring, and 24x7 threat monitoring.


text: Our incident response plan is designed to address security incidents promptly and effectively, supported by stringent information security policies and the implementation of a Security Information and Event Manager (SIEM) system for real-time analysis and reporting of security events and incidents. Furthermore, identity management and mobile device management extend our security perimeter, safeguarding against both external and internal threats. As part of our annual security commitment, we undergo annual penetration testing to assess whether our necessary security controls are maintained.


text: The Company faces risks from cybersecurity threats that could potentially have an adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Security breaches and other disruptions in the Company's IT systems, including the Company's ERP system, could limit the Company's capacity to effectively monitor and control our operations, compromise ours or our employees', customers' and suppliers' confidential information, or otherwise adversely affect the Company's operating results or business reputation" in Item 1A. Risk Factors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AGENUS INC

ticker: AGEN


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.


text: Our cybersecurity risk management program is aligned to our business strategy and has been incorporated into our enterprise risk management process.


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. To date, we have not experienced any material cybersecurity incidents.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. Our Chief Information Officer is a member of our Enterprise Risk Management Committee and provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our team of cybersecurity professionals is led by our Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.


text: We, under the oversight of our Audit Committee, have implemented and maintain an enterprise risk management program that encompasses cybersecurity risk management and is designed to identify, assess and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program is informed by, and incorporates elements of, recognized industry standards and frameworks, including elements of the National Institute of Standards and Technology Cybersecurity Framework. Our program includes controls and procedures designed to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents, if any, in a timely manner.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: As part of our cybersecurity risk management program, we implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. Additionally, we have established and maintain processes related to incident response and have been developing processes related to business continuity and disaster recovery designed to address our response to a cybersecurity incident. We leverage third parties and cybersecurity consultants as appropriate, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. Further, we have a risk-based process to assess the cybersecurity practices of certain third parties prior to onboarding, including vendors, service providers and other external users of our systems.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.


text: Our information technology representative, in consultation with our vCISO, is responsible for the day-to-day administration of our cybersecurity policies, processes and practices. The information technology representative and our vCISO meet regularly to review any outstanding cybersecurity risks and to discuss any recommended hardening or remediation measures. The information technology representative reports and provides periodic updates regarding the cybersecurity risk management program to our Chief Financial Officer. The individual currently operating as our information technology representative has 19 years of experience in information technology and information security, including at another public company.


text: The AVROBIO Board has delegated oversight of the Company's cybersecurity risk management program to our Audit Committee, which generally oversees our enterprise risk management program. Our Audit Committee receives periodic updates on the cybersecurity risk management program, including our risk management practices, from our information technology representative. Our Audit Committee reports on cybersecurity risks and risk management to the full AVROBIO Board as appropriate.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Given the increasing reliance on technology and potential cyber threats, information security (and by entailment cybersecurity) is a critical component of this program. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the enterprise risk management organization, which is overseen by our Chief Risk Officer. As discussed below, our CISO reports periodically throughout the year on cybersecurity related risks, threats, and our responses, to the Technology Committee and our board of directors.

companyName: GUARANTY BANCSHARES INC /TX/


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, Guaranty has implemented comprehensive cybersecurity practices. Key components of the cybersecurity program include the following: • A dedicated cybersecurity team working closely with our Information Technology team to cover all critical cyber defense functions such as engineering, data protection, vulnerability management, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A risk assessment process that identifies and prioritizes material cybersecurity risks, identifies and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the Board of Directors. • A Managed Detection and Response ("MDR") service, which provides an additional layer of around-the-clock security monitoring (including intrusion detection and alerting) for information systems. • A training program that educates employees about cybersecurity risks, how to protect themselves from cyberattacks, and encourages general awareness about cybersecurity threats and how to stay safe online. • An incident response plan, which is tested periodically and outlines the steps that will be taken to respond to a cybersecurity incident. The Bank engages reputable third-parties to conduct various independent assessments on a regular basis, including but not limited to security audits, vulnerability assessments, and various other testing.


text: The Bank leverages in-house resources and third-party service providers to implement and maintain processes and controls to manage identified risks.


text: Our Vendor Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to maintain appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Bank's risk management program and strategy are designed to ensure confidential information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank and customer information. Minimally, these controls include identity and access management, data encryption, data loss prevention, incident response, security monitoring and alerting, third party risk management, and vulnerability management.


text: The Bank's risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives.


text: Risks from Cyber Threats Like many businesses, the Bank faces numerous cybersecurity risks in connection with providing services to our customers. Guaranty does not currently believe that any current or pervious cybersecurity threats have materially affected, or are reasonably likely to materially affect the Bank, including its business strategy, results of operations, or financial condition. Unfortunately, the sophistication of cyber threats continues to increase, and the Bank's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. No cybersecurity program will be able to anticipate all cyber threats and breach attempts, and there may exist limitations to the ability to effectively implement preventive measures against such breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Bank's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: Board of Directors Oversight The Board of Directors is charged with overseeing the establishment and execution of the Bank's risk management framework and monitoring adherence to related policies required by applicable regulations and statutes. Consistent with this responsibility, the Board may delegate some responsibilities to the Audit Committee. The CISO holds the primary day-to-day responsibility for the strategic, operational, and risk management components of cybersecurity. The Audit Committee, and the board through summary reports, receives updates on cybersecurity risks and incidents and the cybersecurity program through direct communication with the CISO. Additionally, awareness and training on cybersecurity topics is provided to the Board at least annually.


text: Management's Role The Information Security department is responsible for implementing and maintaining the Banks's Information Security program, which addresses cybersecurity risk management and cyber threats. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Financial Officer and with dotted-line reporting to the Audit Committee. Additionally, the CISO is a key member of the Technology Committee, which is charged with Bank's managerial oversight and steering organization for all information technology areas (including cybersecurity).


text: The Bank's CISO has over 20 years of experience in cybersecurity across various verticals. Our CISO brings a wealth of expertise to his role. His background includes extensive experience and certifications in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The Bank's CISO remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist the Information Security team in such knowledge acquisition, we subscribe to services that provide Bank personnel with alerts on security incidents and threats. Our CISO oversees the implementation and processes for regular monitoring of our information systems. This includes the deployment of advanced security measures and regular internal/external assessments to identify potential vulnerabilities. In a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our Company's risk management, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the Committee of Sponsoring Organizations of the Treadway Commission 2013 Framework. In general, our Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: STORE CAPITAL LLC


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance" below, our board of directors' oversight of cybersecurity risk management is supported by our Senior Vice President of Information Technology, who leads our cybersecurity team, which is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and ensuring our compliance.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that would provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments, audits and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. Further, we perform ongoing phishing simulations to help employees recognize, avoid and report potential threats that could compromise critical business data and systems. Additional mandatory training is provided to employees who engage in potentially compromising activities during these simulations.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We may engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to those charged with governance by our Senior Vice President of Information Technology, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these activities.


text: Our board of directors oversees our risk management approach, including the management of risks arising from cybersecurity threats. Our board of directors receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our board of directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our board of directors discusses our Company's approach to cybersecurity risk management with management.


text: Our board of directors, in connection with management led by our Senior Vice President of Information Technology, work collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our Company are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our board of directors monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our Senior Vice President of Information Technology has served in his role since January 2020 and has managed STORE's Information Technology department since joining the Company in January of 2015. In these roles, he has been instrumental in the evolution and implementation of our business systems and technical infrastructure as well as the development and enforcement of Sarbanes-Oxley (SOX) compliance processes and reporting. Prior to joining STORE, he was the Chief Information Officer for Southwest Network, a non-profit organization for mental and behavioral health services serving the greater Phoenix, Arizona community. He has over 35 years of experience in the information technology industry serving in several technical and leadership positions.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have had or are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Identiv, Inc.

ticker: INVE


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize using tools such as a SIEM (Network and Cloud Platform Log Collector), Network Vulnerability Scanner, and other utilities for monitoring all Company assets. We conduct these risk assessments directly and also engage security product platform support teams as needed.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, IT team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our Company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such threats or incidents in the future. Like any technology provider, we have experienced cybersecurity incidents in the past which were remediated on a case-by-case basis. See "Risk Factors" for more information on our cybersecurity risks.


text: Cybersecurity Governance One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has been responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and, going forward, the audit committee of our board of directors will oversee management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CEO has over 30 years of experience in information technology and cybersecurity risk management at the Company and at similar companies, and our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. As part of our continued investment in developing our overall risk management process, going forward, our Global Director of IT will provide periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee will provide periodic reports to the board of directors on such matters.


text: As a company, we devote significant resources to cybersecurity and risk management processes in order to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is led primarily by our Vice President - Cybersecurity & DevOps, who has over 15 years' experience in cybersecurity, information technology, and related compliance and holds a Certified Information Systems Security Professional certification. The information security team works cross-functionally, with significant involvement from other members of senior management and oversight by the Board.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: The information security team is responsible for, among other matters: • designing, implementing and periodically assessing our cybersecurity safeguards and related policies and procedures, including those pertaining to encryption standards, antivirus protection, remote access, multi-factor authentication, data classification, device management, and the use of the internet, social media, email and wireless devices; • monitoring current and emerging cybersecurity threats to which the business may become exposed; and • providing oversight of risks of cybersecurity threats associated with our use of third-party service providers, including reviewing such engagements when proposed in order to identify and assess risks potentially arising therefrom.


text: In addition, the information security team is responsible for obtaining and maintaining Service Organization Control Type 2 ("SOC-2") certification for the Company's product portfolio. The Company has obtained SOC-2 certification for many of its products, which subjects those products to an annual compliance audit conducted by a third party, and we work to include progressively more products within the scope of the audit year over year.


text: We view cybersecurity as a shared responsibility throughout the Company. At a management level, we periodically perform tabletop exercises incorporating external resources, advisors and relevant members of the Board as needed. The Company requires all employees to participate in an annual cybersecurity training reviewed by the information security function, and management regularly communicates with employees about potential cybersecurity risks and methods for reporting incidents. The Company has adopted and maintains an Incident Response Plan, which provides for various methods of reporting and escalation of incidents, activation of an incident response team consisting of relevant cross-functional leaders (e.g., legal, information security, operations), assessment of the severity of incidents, processes for investigating and remediating incidents and compliance with related legal and regulatory obligations, among other matters. The Incident Response Plan provides for the involvement of the Company's Disclosure Review Committee to assess the materiality of cybersecurity incidents and any disclosure obligations required in respect thereof. Management periodically reviews the Company's cybersecurity risk management strategy and processes - including the Incident Response Plan - to assess their efficacy in light of current and emerging threats.