text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when an unexpected cybersecurity incident occurs. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our internal procedures dictate that we evaluate and evolve our security measures as appropriate. Identifying, assessing, and managing cybersecurity risk is integrated into our overall internal controls approach. Additionally, we have in place cybersecurity and data privacy policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.

companyName: DUOS TECHNOLOGIES GROUP, INC.


text: During the first quarter of 2024, information security matters reporting, including managing and assessing risks from cybersecurity threats, have been established under the oversight of the Audit Committee of the Board or the "Audit Committee." The Audit Committee also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. Our security efforts are managed by a team of IT professionals who oversee the daily responsibilities of managing cybersecurity identification and threats. Going forward, the Audit Committee receives regular information security updates from management, including our Chief Technology Officer, who the board designated as the Chief Information Security Officer. The management team has established a quarterly rhythm to keep the Board and Audit Committee apprised of identified risks, ongoing risk management and changes in procedure to ensure transparency in the Company's governance over cybersecurity.

ticker: DUOT

secItem: Item 1C


text: Cyber Enviro-Tech, Inc. is committed to protecting its information systems, customer data, and operational infrastructure through a robust cybersecurity framework. Risk Assessments: Continuous monitoring of threats and vulnerabilities. Incident Response: A structured plan for rapid mitigation and resolution. Third-Party Security: Due diligence on vendors and partners. Regulatory Compliance: Adherence to industry standards and legal requirements. Encryption & Access Controls: Secure storage and restricted access. Employee Training: Awareness programs on cyber threats. Breach Response: Rapid containment, forensic analysis, and regulatory notifications. Advanced threat detection systems. Regular penetration testing. Collaboration with cybersecurity experts.

companyName: Cyber Enviro-Tech, Inc.

ticker: CETI

stage1Category: Risk Management Process

stage1Method: unanimous


text: Forward-Looking Statements While CETI implements strong cybersecurity measures, no system is completely immune to threats. The Company remains vigilant in strengthening its security post.

stage1Category: None/Other


text: In addition, BHE's compliance requirements include the North American Electric Reliability Corporation Critical Infrastructure Protection Standards, the Transportation Security Administration Pipeline Security Directives and the United Kingdom Center for the Protection of National Infrastructure Standards as applicable to each of the companies. These requirements are audited and assessed as mandated by applicable government agencies.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: ANVI GLOBAL HOLDINGS, INC.

ticker: ANVI


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risk.


text: yet developed a cybersecurity risk management program, though we are in the process of assessing the potential risks. As of this time, we have determined that risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: ENCISION INC

ticker: ECIA

stage1Category: Strategy Integration


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.

stage1Category: Board Governance


text: We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: WEWARDS, INC.

ticker: WEWA


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.


text: As discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business. Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.


text: Management and strategy The Company currently manages its cybersecurity risk through a variety of practices that are applicable to all users of our information technology and information assets, including our officers and directors, contractors, and vendors. The Company uses a combination of technology and monitoring to promote security awareness and prevent security incidents, including network and passwords protocols, third party firewalls, and antivirus protections.

companyName: OKMIN RESOURCES, INC.

ticker: OKMN


text: We have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.


text: Each Registrant relies on technology in virtually all aspects of its business. Like any business, the Registrants' technology systems are a target for cyber attacks. Each Registrant expects to be subject to attempted attacks in the future and will continue to adapt defensive capabilities as such attacks become more sophisticated and frequent. A significant disruption or failure of its technology systems by cyber or physical attack could result in service interruptions, safety failures, security events, regulatory compliance failures, an inability to protect information and assets against unauthorized users, and other operational difficulties. Attacks perpetrated against each Registrant's systems could result in loss of assets and critical information and expose it to remediation costs and reputational damage.


text: face cybersecurity risks as a result of the variety of networks and systems we must defend against cybersecurity attacks; and the level of harm that could occur if we suffer impacts of a material cybersecurity incident. We are committed to robust oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended June 30, 2025, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, we have experienced two such material breaches in the past (see Form 10-K for the year ended 2023) and there can be no guarantee that we will not experience such incidents in the future. Such incidents could result in us incurring significant costs related to implementing threat protection measures, and the possibility of such incidents could result in additional costs in defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, cybersecurity threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable, we remain potentially vulnerable to known or unknown threats. In some instances, we may be unaware of a threat or incident or its magnitude and effects for some time. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET


text: industry best practices throughout our cybersecurity program to the extent practicable for a company of our size and resources. New leadership is committed to improving our cybersecurity strategy, with the goal of enhancing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program will be aligned with applicable industry standards and maintained by a third-party technology firm. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness advice for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.


text: IT/ cybersecurity firm reports to our Chief Executive Officer ("CEO"). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CEO reports directly to the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Board of Directors will occur at least annually, or more frequently as determined to be necessary or advisable.

stage1Method: majority


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we aim to take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. intend to establish policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We intend to make investments to maintain the security of our data and cybersecurity infrastructure when feasible. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: GHST World Inc.

ticker: GHST


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we intend to take a comprehensive approach to cybersecurity risk management. Our Board and our management oversee our risk management program, including the management of cybersecurity risks. We plan to establish policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We intend to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to make investments to maintain the security of our data and cybersecurity infrastructure when feasible. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We do not believe that risks from prior cybersecurity threats have materially affected our business to-date. We can provide no assurance that there will not be incidents in the future or that future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Zapata Quantum, Inc.

ticker: ZPTA


text: CYBER RISK MANAGEMENT AND STRATEGY BHE and its Subsidiary Registrants recognize that maintaining processes for identifying, assessing and managing cybersecurity threats is important in dealing with their significant business risks. As such, BHE has implemented a framework for cybersecurity and cyber-related information management across its businesses. BHE's Chief Security Office ("CSO") drives collective focus and central coordination of BHE's cyber and physical security programs. The CSO identifies the strategic framework that promotes standardization of business security policies and practices and provides direction in managing security risks. Although the CSO provides oversight, the businesses retain accountability for executing company security objectives, policies and practices within their areas of responsibility.

stage1Category: Management Role


text: BHE manages cybersecurity threats through its proactive risk management program and cybersecurity awareness program. BHE's businesses are certified against the ISO 27001 standard. The standard is authored by the International Organization for Standardization ("ISO") of Geneva, Switzerland. To achieve the certification, each business must sustain an information security management system that includes a risk-based framework to identify and manage information security risks through a continuous improvement cycle. The risks and controls identified in the system must be approved by top management and confirmed through annual internal and external ISO audits prior to certification.


text: In certain circumstances, BHE relies on third-party service providers for a variety of products and services to run its information systems. This dependence exposes BHE, along with others who use these service providers, to the impact of a cyber attack on its service providers. Cyber attacks at a third-party service provider could have a significant financial, operational, or reputational impact. BHE continuously monitors the risks associated with its service providers. BHE's Board of Directors has responsibility for oversight of BHE's cybersecurity risk management program.

stage1Category: Third-Party Risk


text: BHE's CSO is responsible for cyber and physical security across BHE and its Subsidiary Registrants. The CSO reports directly to the Chief Executive Officer of BHE. The CSO is responsible for identifying, assessing and managing cyber risk for BHE and its Subsidiary Registrants. Management has evaluated the expertise of the CSO and determined that it possesses the knowledge and expertise necessary to oversee BHE's cybersecurity risk management processes.


text: The CSO provides, at least annually, updates to the Chief Executive Officer and BHE's Board of Directors on: • Updates on strategic cyber and physical security initiatives • Current threat and risk landscape impacting the organization • Security compliance with regulatory requirements • Compliance with ISO 27001 framework • Number and impact of incidents reported through the BHE cybersecurity incident reporting process A BHE Cybersecurity Reporting Framework has been adopted so that BHE has a repeatable and timely process to identify, assess and manage any security incidents for materiality reporting. Each BHE business is required to report significant cybersecurity events to BHE. BHE's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.


text: In addition, BHE's compliance requirements include the North American Electric Reliability Corporation Critical Infrastructure Protection Standards, the Transportation Security Administration Pipeline Security Directives and the United Kingdom Center for the Protection of National Infrastructure Standards as applicable to each of the companies. These requirements are audited and assessed as mandated by applicable government agencies.


text: In certain circumstances, BHE relies on third-party service providers for a variety of products and services to run its information systems. This dependence exposes BHE, along with others who use these service providers, to the impact of a cyber attack on these providers. Cyber attacks at a third-party service provider could have a significant financial, operational, or reputational impact. BHE continuously monitors the risks associated with its service providers.


text: BHE's Board of Directors has delegated responsibility for oversight of BHE's cybersecurity risk management program to its Executive Committee, consisting of BHE's Chief Executive Officer, who is a management member of the BHE Board of Directors, and the BHE Chief Financial Officer and General Counsel, who are not management members of the BHE Board of Directors.


text: BHE's CSO is responsible for cyber and physical security across BHE and its Subsidiary Registrants. The CSO is responsible for identifying, assessing and managing cyber risk for BHE and its Subsidiary Registrants. The Executive Committee has evaluated the expertise of the CSO and determined that it possesses the knowledge and expertise necessary to oversee BHE's cybersecurity risk management processes.


text: The CSO provides, at least annually, updates to the Executive Committee on: • Strategic cyber and physical security initiatives • Current threat and risk landscape impacting the organization • Security compliance with regulatory requirements • Compliance with ISO 27001 framework • Number and impact of incidents reported through the BHE cybersecurity incident reporting process BHE's Cybersecurity Reporting Framework enables BHE to use a repeatable and timely process to identify, assess and manage any security incidents for materiality reporting. Each BHE business is required to report significant cybersecurity events to BHE. The Executive Committee and CSO together review incident reports to determine whether a cyber incident report should be filed with the SEC.


text: We have implemented a cybersecurity program consistent with industry practices to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our networks, systems, and data.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee risks related to cybersecurity matters to our Audit Committee. Our Audit Committee regularly receives reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as customers, service providers, and suppliers, and the current threat environment. These reports and presentations are provided by senior personnel with responsibility for IT security, including our Security, Risk and Compliance Director (SRC Director) and our Chief Information Officer. Our board, through its interactions with our Audit Committee chair and our SRC Director and Chief Information Officer receives periodic updates regarding cybersecurity risk matters and prompt and timely information regarding significant cybersecurity incidents and our response to such incidents.


text: At the management level, our Corporate Crisis Management Team (CCMT) is comprised of senior representatives from all key business functions, including finance, operations, and legal, and has broad oversight of our risk management processes. The CCMT has global responsibility for corporate crisis management, policy guidance, and training for employees involved in crisis management at all levels. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A—Risk Factors, which should be read in conjunction with this Item 1C—Cybersecurity.


text: Internal Cybersecurity Team Our Incident Management Team (IMT) is led by our SRC Director, who serves as the point of contact for all IT security related matters within our Company, and also includes our Chief Information Officer. Our IMT is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across our Company. Our SRC Director is responsible for ensuring the regular review and maintenance of the Computer Security Incident Response Plan (CSIRP) and the execution of all procedures within it. Our SRC Director has technical leadership experience and cybersecurity expertise gained from over 25 years of experience, including security leadership, program development, strategy formulation, data protection, and IT risk management within the health care, pharmaceutical, and biotechnology industries. The security professionals in the IMT have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications. In addition to our internal cybersecurity capabilities, we also have engaged outside experts to assist with assessing, identifying, and managing cybersecurity risks. The IMT meets as necessary to discuss, investigate, and respond to any cybersecurity incidents, to allocate resources to respond to incidents, and to confirm incidents are appropriately documented. We have protocols by which the IMT escalates certain cybersecurity incidents within our Company and, where appropriate, the IMT will notify appropriate stakeholders and our Audit Committee and provide updates on the status of the incident. A number of experienced employees responsible for various parts of our business and a team of trained cybersecurity professionals assist our SRC Director and the IMT. A number of internal teams, including our Operations Infrastructure Team, Operations End User Computer Team, Operations Engineering Team, Security, Risk and Compliance Team, Operational Technology Team, and Application Administrators and certain external vendors (together, the Incident Response Team Members), collectively with the IMT, form the Incident Response Team (IRT), which investigates and responds to privacy or cybersecurity incidents.


text: Risk Management and Strategy We manage cybersecurity risks through a robust enterprise risk management process. These policies and practices follow the National Institute of Standards and Technology (NIST) cybersecurity framework. Our cybersecurity program encompasses the IMT and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. Our program includes various policies, procedures, and plans related to cybersecurity, including the CSIRP, Corporate Crisis Management Plan, Crisis Communications Response Plan, Organizational Resiliency Governance Policy and Framework, and Business Continuity Plans. These plans outline a coordinated approach for protecting information security, managing vulnerabilities, and assessing, identifying, and managing risks from cybersecurity threats, including identifying and responding to cybersecurity incidents, and processes for categorizing incidents, reporting findings, and keeping senior management, our Audit Committee, and other key stakeholders informed and involved as appropriate.


text: The CSIRP applies to all Company employees and workforce members and provides processes and procedures to properly identify and handle incidents that may affect the safety and/or security of Company resources. The CSIRP covers all potential or realized privacy or security incidents, and is applicable to all Company campuses, divisions, business units, systems, devices, and materials.


text: For the response phase of an incident, after the SRC Director or the designated alternate IRT leader receives notification of any potential or realized privacy or security incident, the SRC Director or the designated alternate IRT leader makes an initial severity classification and determines if it is appropriate to convene the IRT, the members of which will be based on the nature and severity of the incident. The IMT has general authority and responsibility for incident response, which includes allocating resources to respond to incidents and providing the appropriate reports and statuses to senior management through the office of the CIO. The Incident Response Team Members support the IMT in these efforts.


text: In general, our incident response process involves five phases: • Identify— in which we gather an understanding of how to manage our cybersecurity risks to our systems, assets, data and capabilities, including through threat modeling, cybersecurity threat intelligence from industry-recognized forums and sources, internal audits, third-party reviews and assessments, vulnerability scans and penetration tests; • Protect— in which we implement controls and safeguards to protect or deter cybersecurity threats, including through firewalls, VPNs, identity and access management and intrusion prevention systems; • Detect— in which we engage in continuous monitoring to provide proactive and real-time alerts of cybersecurity-related events; • Respond— in which any threats are timely reported to responsible teams, and triaged for purposes of preliminary classification and escalation, and assessment for possible notification and disclosure requirements; and • Recover— in which business continuity plans are implemented, vulnerabilities are identified and mitigated, legal obligations and risks are identified, and our systems are returned to operational readiness.


text: We have developed a Testing, Training, & Exercise (TT&E) program in accordance with NIST Special Publication 800-84, in which all members of the IRT are required to participate, to sustain and refine our ability to handle computer security incidents in accordance with best practices. The TT&E program includes testing of procedures, systems, and plans, training for the IRT, and tabletop exercises. We also conduct required periodic phishing simulation tests for all employees.


text: We also employ processes designed to identify and reduce the potential impact of a security incident at a third-party vendor or otherwise implicating the third-party technology and systems we use.


text: We maintain a cyber liability insurance plan underwritten by multiple insurance companies, which provides protection against certain potential losses arising from cybersecurity incidents.


text: Impact of Cybersecurity Risk To date, we have not been subject to any cybersecurity incidents that, individually or in the aggregate, have had a material impact to our operations or financial condition, although we recognize that cyberattacks impacting our networks or systems may have a material adverse effect on our operations in the future, as discussed in our Part I, Item 1A—Risk Factors. We do not have reason to believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our business, reputation, operations, or revenue over the long term.


text: Board of Directors Our board of directors exercises its oversight role through its Audit Committee, which has primary responsibility for overseeing risks related to cybersecurity matters. Our Audit Committee regularly receives reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as customers, service providers, and suppliers, and the current threat environment. These reports and presentations are provided by senior personnel with responsibility for IT security, including our Security, Risk and Compliance Director ( SRC Director) and our Chief Information Officer. Our board, through its interactions with our Audit Committee chair and our SRC Director and Chief Information Officer receives periodic updates regarding cybersecurity risk matters and prompt and timely information regarding significant cybersecurity incidents and our response to such incidents.


text: At the management level, our Corporate Crisis Management Team (CCMT) is comprised of senior representatives from all key business functions, including finance, operations, and legal, and has broad oversight of our risk management processes, including management of cybersecurity risks. The CCMT has global responsibility for corporate crisis management, policy guidance, and training for employees involved in crisis management at all levels. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A—Risk Factors, which should be read in conjunction with this Item 1C—Cybersecurity.


text: Internal Cybersecurity Team Our Incident Management Team (IMT) is led by our SRC Director, who serves as the point of contact for all IT security related matters within our company, and also includes our Chief Information Officer. Our IMT is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across our company. Our SRC Director is responsible for ensuring the regular review and maintenance of the Computer Security Incident Response Plan (CSIRP) and the execution of all procedures within it. Our SRC Director has technical leadership experience and cybersecurity expertise gained from over 25 years of experience, including security leadership, program development, strategy formulation, data protection, and IT risk management within the health care, pharmaceutical, and biotechnology industries. Our Chief Information Officer has nearly ten years of experience with our company, and an extensive background in security technology and operations, compliance, data privacy, business continuity, and disaster recovery.


text: The security professionals in the IMT have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications. In addition to our internal cybersecurity capabilities, we also have engaged outside experts to assist with assessing, identifying, and managing cybersecurity risks. The IMT meets as necessary to discuss, investigate, and respond to any cybersecurity incidents, to allocate resources to respond to incidents, and to confirm incidents are appropriately documented. We have protocols by which the IMT escalates certain cybersecurity incidents within our company and, where appropriate, the IMT will notify appropriate stakeholders and our Audit Committee and provide updates on the status of the incident. Experienced employees responsible for various parts of our business and a team of trained cybersecurity professionals assist our SRC Director and the IMT. Internal teams, including our Operations Infrastructure Team, Operations End User Computer Team, Operations Engineering Team, Security, Risk and Compliance Team, Operational Technology Team, and Application Administrators and certain external vendors (together, the Incident Response Team Members), collectively with the IMT, form the Incident Response Team (IRT), which investigates and responds to privacy or cybersecurity incidents.


text: Risk Management and Strategy We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely impact our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees, patients, or healthcare providers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we manage cybersecurity risks through a robust enterprise risk management process. These policies and practices are aligned with industry best practices and standards, such as the National Institute of Standards and Technology ( NIST) cybersecurity framework. Our cybersecurity program encompasses the IMT and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. Our program includes various policies, procedures, and plans related to cybersecurity, including the CSIRP, Corporate Crisis Management Plan, Crisis Communications Response Plan, Organizational Resiliency Governance Policy and Framework, and Business Continuity Plans. These plans outline a coordinated approach for protecting information security, managing vulnerabilities, and assessing, identifying, and managing risks from cybersecurity threats, including identifying and responding to cybersecurity incidents, and processes for categorizing incidents, reporting findings, and keeping senior management, our Audit Committee, and other key stakeholders informed and involved as appropriate.


text: The CSIRP applies to all company employees and workforce members and provides processes and procedures to properly identify and handle incidents that may affect the safety and/or security of company resources. The CSIRP covers all potential or realized privacy or security incidents, and is applicable to all company campuses, divisions, business units, systems, devices, and materials.


text: We design and assess our program based on International Organization for Standardization ("ISO") and National Institute of Standards and Technology ("NIST") information security risk management frameworks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the above frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: Impact of Cybersecurity Risk To date, we have not been subject to any cybersecurity incidents that, individually or in the aggregate, have had a material impact to our operations or financial condition, although we recognize that cyberattacks impacting our networks or systems may have a material adverse effect on our operations in the future, as discussed in our Part I, Item 1A—Risk Factors. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. However, we do not have reason to believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our business, reputation, operations, or revenue over the long term.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is one component of our information security program that guides continuous improvement to, and evaluates these security objectives for our critical systems, data, and operations. Additionally, our cybersecurity risk management program includes a cybersecurity incident response plan. Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: TERAWULF INC.

ticker: WULF


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise information technology environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • an Information Security and Cybersecurity policy which establishes administrative, physical, and technical controls and procedures to protect data and systems; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, monitor, respond or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Cyberattacks, data breaches or malware may disrupt our operations and trigger significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President of Information Technology, risk management and internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. In addition, we have newly formed a multifunctional cybersecurity committee comprised of information technology, operations, risk, and finance members who will meet quarterly to assess new vulnerabilities and threats, update risk assessments and assess the implementation of the Company's cybersecurity risk management program. This committee will report periodically to the management team on matters involving cybersecurity risks and incidents.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is one component of our information security program that guides continuous improvement to, and evaluates these security objectives for our critical systems, data, and operations. Additionally, our cybersecurity risk management program includes a cybersecurity incident response plan. Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST frameworks, guidance and recommendations to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President of Information Technology, risk management and internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. In addition, we have a multifunctional cybersecurity committee comprised of information technology, operations, risk, and finance members who will meet quarterly to assess new vulnerabilities and threats, update risk assessments and assess the implementation of the Company's cybersecurity risk management program. This committee will report periodically to the management team on matters involving cybersecurity risks and incidents.


text: Our Vice President of Information Technology also serves as our Chief Information Security Officer and is responsible for managing and implementing the Company's Information Security and Cybersecurity policy, which can be found on the Company's website. In addition, the Vice President of Information Technology sets company-wide control requirements, assesses adherence to controls, identifies and prioritizes cybersecurity risks, and oversees incident protection and response. The Vice President of Information Technology has over three decades of Information Technology experience overseeing cybersecurity as an integral part of the IT function.


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our and our customer's data and information assets. As such, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face cybersecurity risks, threats and attacks that could materially affect our operations, business strategy, results of operations, or financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee the oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including our Chief Technology Officer and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has a primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our current Chief Technology Officer has over 25 years of experience in the field of technology, including cybersecurity. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO has over 25 years of experience in various roles in cybersecurity and information technology.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include receiving briefings from internal security personnel; analyzing threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and reviewing alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program based on International Organization for Standardization ("ISO") and National Institute of Standards and Technology ("NIST") information security risk management frameworks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the above frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have developed an enterprise-wide strategy that we use to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Our enterprise risk management program incorporates risks related to cybersecurity threats alongside other company risks as part of our overall risk assessment process. We also employ a cybersecurity-specific risk assessment process.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: Our cybersecurity risk strategy uses an Information Assurance Program to define the general security policy for our information systems and a Cybersecurity Incident Response Plan for detection, response, recovery, containment, investigation, and analysis following a cybersecurity incident, as well as compliance with legal and regulatory requirements.


text: Our Information Assurance Program addresses the security of information systems and data networks owned or used by us and the information stored, transmitted, or processed by those systems and networks. It defines responsibilities concerning information systems security as well as a uniform approach that promotes information systems security throughout the Company.


text: Our Cybersecurity Incident Response Plan is an enterprise-wide cybersecurity strategy that focuses on detecting and reacting to cybersecurity incidents, determining their scope and risk, responding appropriately, communicating the results and risk to stakeholders, and reducing the likelihood of reoccurrence. To enhance our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and inform and collaborate on an ever-changing landscape.


text: We maintain systems that are designed to preempt, detect and monitor cybersecurity threats, including monitoring unusual network activity. As part of our risk management processes, we also perform penetration testing using third-party vendors, conduct periodic cybersecurity awareness training for employees, deploy phishing test campaigns, maintain containment and incident response tools, and periodically review, update and enhance our Cybersecurity Incident Response Plan.


text: We utilize various methods to assess and manage risks associated with third-party service providers, which may be reevaluated periodically, such as upon detection of an increase in a third-party's risk volume and variability. Further, our Code of Vendor Conduct & Ethics sets forth our expectations for third-party vendors related to data privacy and protection.


text: As of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "Risks Related to Information Technology, Cybersecurity and Data Protection" in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Cybersecurity Incident Response Plan is overseen by our Cybersecurity Incident Response Team ("CSIRT"), which is led by our Chief Information Officer ("CIO"). Our CIO is an information technology executive with over 20 years of CIO and Chief Technology Officer experience at publicly traded and privately held companies. His experience has included cybersecurity leadership throughout his executive career. The CIO, the Vice President of Information Technology, the virtual Chief Information Security Officer, and other members of the CSIRT, are responsible for the Company's cybersecurity risk management processes described above, including maintaining systems that are designed to preempt, detect and monitor cybersecurity threats, as well as identifying and responding to cybersecurity incidents.


text: We have implemented a cross-functional information security program to assess, identify and manage material risks from cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors ("Audit Committee") and the Board of Directors.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Our Board of Directors, through the Audit Committee, oversees the management of our technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The Audit Committee receives updates from the CIO on a quarterly basis, and more frequently as needed, regarding, among other relevant information, existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our Board of Directors, through the Audit Committee, also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs on a timely basis.


text: Cybersecurity Governance Our Cybersecurity Incident Response Plan is overseen by our Cybersecurity Incident Response Team ("CSIRT"), which is led by our Chief Information Officer ("CIO"). Our CIO is an information technology executive with over 20 years of CIO and Chief Technology Officer experience at publicly traded and privately held companies. His experience has included cybersecurity leadership throughout his executive career. He holds a Bachelor of Science degree in Computer Science and an MBA. The other members of the CSIRT include our Vice President of Information Technology who has over 25 years of experience in IT infrastructure, cybersecurity and compliance. He holds a Bachelor of Sciences degree in Electrical Engineering and an MBA. Our virtual Chief Information Security Officer also serves on the CSRIT and is a seasoned vCISO and Principal Security Consultant. He holds multiple certifications including MIS, CISSP, GSEC, GPEN and GCFE. Our IT Compliance and Security Manager also serves on the CSIRT and has over 20 years of IT experience in compliance, audit and security. She holds a Bachelor of Science degree in Information Technology and a Masters of Science degree in Organizational Leadership. The CSIRT is responsible for the Company's cybersecurity risk management processes described above, including maintaining systems that are designed to preempt, detect and monitor cybersecurity threats, as well as identifying and responding to cybersecurity incidents.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Safehold Inc.

ticker: SAFE


text: Risk Management and Strategy In the ordinary course of our business, we utilize technology systems to collect, use, store, and transmit information. The confidentiality, integrity, and availability of the information in our systems is important to our operations, business strategy, and maintaining the trust of our customers, employees and partners. As part of our enterprise risk management program, we have processes in place to identify, assess, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our cybersecurity team engages with applicable personnel across the enterprise and utilizes software tools to identify, categorize, and quantify material cybersecurity threat risks. The team meets regularly to consider new, known, and evolving risks and evaluate the measures in place to mitigate these risks.


text: Our strategy for managing cybersecurity risk is multifaceted and includes, without limitation: (i) robust security policies and procedures, designed in part to comply with the Payment Card Industry Data Security Standard (PCI-DSS), (ii) an incident response plan backed with industry-leading incident response support services, (iii) comprehensive system security vulnerability scanning, and oversight by a 24 hours a day, 7 days a week, 365 days a year Securities Operation Center; (iv) periodic cybersecurity awareness training and testing for employees and certain contractors; (v) risk management of our third-party suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that generally allow for periodic auditing, and (vi) security assessments of any businesses that we acquire.


text: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and certify our PCI-DSS compliance.


text: We face ongoing risks that, if realized, could materially impact our business, operations and financial results. See our risk factor disclosures in Item 1A of this Annual Report on Form 10-K under the heading "Information Technology and Systems," which are incorporated by reference herein. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition.


text: The Board of Directors of the Company (the "Board"), as a whole and through its committees, oversees the Company's risk management process, including operational, financial, legal, strategic, marketing and brand reputation risks. The Technology and Cybersecurity Committee of the Board (the "Committee") oversees risk management associated with the Company's information technology use and protection, including data governance, privacy, compliance, and cybersecurity. The Committee comprises Board members with particular expertise in technology and management, equipping them to oversee cybersecurity risks effectively.


text: The Committee is responsible for the oversight of the Company's policies and procedures intended to provide security, confidentiality, availability, and integrity of the Company's information, including with respect to data privacy and the Company's compliance with applicable data privacy and cybersecurity laws and regulations. The Committee also oversees the quality and effectiveness of the Company's policies and procedures with respect to its information technology systems and provides oversight on the Company's policies and procedures in maintaining preparedness for responding to any material incidents. The Committee also periodically coordinates with the Company's Audit Committee, which reviews risks related to the Company's information technology systems, including privacy, network security and data security.


text: The Company's program to identify, assess, and manage cybersecurity risks is currently led by our Senior Vice President, IT Operations, and leverages the expertise of our Chief Financial Officer and General Counsel. Our Senior Vice President, IT Operations holds a Bachelor of Business Administration in Business Computer Information Systems and has over 20 years of work experience, with more than 5 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs. Our Senior Vice President, IT Operations, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company's cybersecurity and data privacy risk mitigation plans.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Senior Vice President, IT Operations, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Senior Vice President, IT Operations, other members of management, the Committee, and the Board, each as needed.


text: Our information technology, software and application systems ("digital technology') has been an important part of our operations and our ability to compete successfully. We continue to invest in technology solutions to improve more inefficient systems, to streamline and automate workflows and to provide digital and mobile applications for our field service personnel. We are committed to maintaining robust cybersecurity measures, continuously evaluating and updating our cybersecurity practices, and being prepared to respond to and recover from cybersecurity incidents. We face ongoing risk from cybersecurity threats. There can be no assurance that our efforts will prevent or mitigate all cybersecurity events, which, if realized, could have a material impact on our operations and financial results. See Part I, Item 1A "Risk Factors" of this Report.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: Cybersecurity Incidents We have not experienced any material cybersecurity incidents nor have we identified risks from known threats that could likely materially impacted our operations or financial results.


text: Management of Cybersecurity Risk During 2023, we adopted a Cybersecurity Event Plan ("Cybersecurity Plan") which outlines how we identify and manage our cybersecurity risk. The Cybersecurity Plan contains the following elements: • Incident Identification and Reporting – outlines the steps used to promptly identify cybersecurity risks and report those through appropriate means; • Incident Assessment –after collecting information about a potential risk or threat, a protocol has been developed and outlined that will allow a cross-functional team to assess the threat; • Incident Containment–provides for action to be taken to isolate and attempt to contain and minimize any potential threat; • Resolution and Recovery– outlines the steps to be taken, based upon the incident and the systems potentially impacted, to mitigate the potential impact of the threat and restore system access and functionality in the minimum amount of time; • Training and Awareness–development of training and awareness programs to allow employees to understand how to promptly respond in the event of a perceived threat.


text: Our Board of Directors has an active role in oversight of our risks and is assisted by management in the exercise of these responsibilities. Our Manager of Information Technology prepares and gives a presentation to the Board at each of its quarterly meetings, which includes updates on cybersecurity. Our IT Manager is responsible for assessing and managing risks from cybersecurity threats and carrying out our formal cybersecurity event plan. Our IT Manager is responsible for reporting material incidents to our Chief Executive Officer, who in turn will report to the Lead Independent Director. Our IT Manager has over 20 years of information technology experience in the energy industry.


text: Our IT systems and digital technology has been an important part of our operations and our ability to compete successfully. We continue to invest in technology solutions to improve inefficient systems, to streamline and automate workflows and to provide digital and mobile applications for our field service personnel. We are committed to maintaining robust cybersecurity measures, continuously evaluating and updating our cybersecurity practices, and being prepared to respond to and recover from cybersecurity incidents. We face ongoing risk from cybersecurity threats. There can be no assurance that our efforts will prevent or mitigate all cybersecurity events, which, if realized, could have a material impact on our operations and financial results. See Part I, Item 1A "Risk Factors" of this Report for additional information.


text: Cybersecurity Incidents We have not experienced any material cybersecurity incidents nor have we identified risks from known threats that could likely materially impact our operations or financial results.


text: Management of Cybersecurity Risk We maintain a Cybersecurity Event Plan ("Cybersecurity Plan") which outlines how we identify and manage our cybersecurity risk. The Cybersecurity Plan contains the following elements: • Incident Identification and Reporting – outlines the steps used to promptly identify cybersecurity risks and report those through appropriate means; • Incident Assessment – after collecting information about a potential risk or threat, a protocol has been developed and outlined that will allow a cross-functional team to assess the threat; • Incident Containment – provides for action to be taken to isolate and attempt to contain and minimize any potential threat; • Resolution and Recovery – outlines the steps to be taken, based upon the incident and the systems potentially impacted, to mitigate the potential impact of the threat and restore system access and functionality in the minimum amount of time; • Training and Awareness – development of training and awareness programs to allow employees to understand how to promptly respond in the event of a perceived threat.


text: Our customers rely upon Akamai to power and protect the online experiences of their end user customers. We provide security, delivery and compute solutions and services and maintain internal systems and other data associated with running our business. We have implemented cybersecurity risk management programs and procedures designed to identify and address threats to both internal and customer facing data and systems that are subject to ongoing compliance assessments, certifications and testing.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Our Board of Directors has an active role in oversight of our risks and is assisted by our management in the exercise of these responsibilities. Our Manager of Information Technology ("IT Manager") prepares and provides a presentation to the Board of Directors at each of its quarterly meetings, which includes updates on cybersecurity. Our IT Manager is responsible for assessing and managing risks from cybersecurity threats and carrying out our formal cybersecurity event plan. Our IT Manager is also responsible for reporting material incidents to our Chief Executive Officer, who in turn will report to the Lead Independent Director. Our IT Manager has over 20 years of IT experience in the energy industry.


text: PSE maintains a comprehensive business continuity plan that includes the identification, assessment and management of risks arising from various avenues, including cyber. Business continuity includes action plans to respond to and remedy information technology (IT) outages, attacks, and other cyber threats, which are maintained between two specific plans, the IT disaster recovery plan and the cybersecurity incident response plan (CSIRP). The CSIRP specifies guidance for various cyber related risks to ensure business continuity and timely reporting of incidents to various governing bodies, including the SEC. The CSIRP is a perpetually updated plan that is managed by the Chief Information Security Officer (CISO) and Chief Information Officer (CIO). PSE's CIO has served in various roles in IT and IT security for over 15 years, including serving as Chief Operating Officer or Chief Information Officer primarily in the financial services industry. Further, the CIO holds an undergraduate degree in computer science. PSE's CISO has over 15 years of experience managing IT security across different industries and companies. Additionally, the CISO holds an undergraduate degree and has been a Certified Information Systems Security Professional for over 15 years.

companyName: PUGET ENERGY INC /WA


text: As part of the CSIRP, PSE maintains a standalone team of IT security and risk management professionals in the Cyber Defense Center (CDC). The CDC is responsible for implementing the CSIRP, including the identification and ongoing monitoring and response to all cyber events and risks, including risks associated with the Company's use of third-party service providers, which impact the Company. To identify, defend, detect and respond to cyber events, PSE performs various on-going activities, such as, proactive privacy and cybersecurity reviews of systems and applications, monitoring threat intelligence information feeds, penetration testing to test security controls, conducting employee trainings, and monitoring emerging laws and regulations related to data protection and information security. Additionally, the Company conducts tabletop exercises to simulate our response to cybersecurity incidents. Depending on the nature of the incident, PSE may engage consultants, assessors, or other third-parties to assist in the assessment, testing, remediation, and/or management of cyber incidents.


text: Once cyber incidents are identified in the CDC, a risk assessment is performed as part of the CSIRP by the CDC. The risk assessment includes quantitative and qualitative considerations determined by a committee of individuals, including, among others, the Controller, CISO and Chief Ethics and Compliance Officer, that report to the Chief Financial Officer, CIO, and Senior Vice President General Counsel and Chief Sustainability Officer. Any cyber incidents that exceed set thresholds in the CSIRP are then escalated to the aforementioned committee for a materiality assessment and disclosure considerations.


text: The Company's Audit Committee oversees management's process for identifying and mitigating cybersecurity risks. Periodically, the CISO presents cyber incidents and risks to the audit committee as part of the board of directors' oversight of risks from cybersecurity threats. The Audit Committee's oversight includes understanding existing and new cybersecurity risks and status on management's response and mitigation plans.


text: As of December 31, 2023, the Company was not aware of (i) any cybersecurity incidents, or (ii) any specific cybersecurity threats, that, in either case, materially affected or are reasonably likely to materially affect the business, strategy, results of operations, or financial condition of the Company. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect PSE, including our business, strategy, results of operations, or financial condition. For more information regarding risk from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Once cyber incidents are identified, a risk assessment is performed by the CDC, in accordance with the CSIRP. The risk assessment includes quantitative and qualitative considerations determined by a committee of individuals, including, among others, the Controller, CISO and Chief Ethics and Compliance Officer, that report to the Chief Financial Officer, CIO, and Senior Vice President General Counsel and Chief Sustainability Officer. Any cyber incidents that exceed thresholds set in the CSIRP are then escalated to the aforementioned committee for a materiality assessment and disclosure considerations.


text: The Company's Audit Committee oversees management's process for identifying and mitigating cybersecurity risks. Periodically, the CISO presents cyber incidents and risks to the audit committee as part of the board of directors ' oversight of risks from cybersecurity threats. The Audit Committee's oversight includes understanding existing and new cybersecurity risks and status on management's response and mitigation plans.


text: As of December 31, 2024, the Company was not aware of (i) any cybersecurity incidents, or (ii) any specific cybersecurity threats, that, in either case, materially affected or are reasonably likely to materially affect the business, strategy, results of operations, or financial condition of the Company. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect PSE, including our business, strategy, results of operations, or financial condition. For more information regarding risk from cybersecurity threats, see Item 1A, "Risk Factors" included in this report.


text: Risk Management & Strategy Perficient proactively manages its cybersecurity and data privacy risks with organizational and technical controls including a comprehensive set of policies, procedures, required annual and role-based training, cybersecurity insurance, security assessments for vendors with access to Perficient and/or Perficient client networks, and use of technology such as Multi-Factor Authentication (the "Program"). Perficient regularly tests and validates its Program using internal resources, external auditors, and rigorous industry certifications. After maintaining a Systems and Organization Controls 2 (SOC2) certification, Perficient achieved its global ISO 27001:2022 certification, an international standard for information security management systems, in October 2023.

companyName: PERFICIENT INC


text: The Program is supported by a cross-functional team which identifies, assesses, monitors, tracks and pro-actively mitigates general and company specific risks, including those related to business continuity and third parties.


text: Perficient's Information Technology, Data Security, Data Privacy, Finance and Communications teams conduct annual tabletop exercises in which various levels of management participate in simulated data security/privacy scenarios that Perficient, its clients and/or its personnel may face in the future. Perficient engages external resources to refresh the subject matter of these exercises and to continually challenge Perficient's management in these exercises. Annual formal training using an online platform is required for all Perficient employees and subcontractors. Topics include how to identify suspicious activities and occurrences related to social engineering, phishing, viruses, and insider threats. Certain employees complete additional role-based training. Perficient's formal training is supplemented throughout the year by regular "Securing Perficient" emails which reinforce relevant cybersecurity policies and procedures and cover topics such as emerging cybersecurity risks.


text: Perficient's senior management are members of the Security and Compliance Executive Committee ("SCEC") which meets at least semi-annually to review Perficient's current cybersecurity risks, the effectiveness of current controls, policies and training. Any security-related policy violations or incidents involving Perficient or client data would be included in the SCEC briefing. Perficient senior management also regularly considers the impact of cybersecurity risks when developing its business strategy, financial planning, and capital allocation. Perficient is not aware of any current or past cyber related risks which have or are reasonably likely to materially affect its strategy, operations, or financial condition.


text: We also incorporate security practices into employee training. We have a process for employees to formally acknowledge their review and understanding of security obligations, and the information security and legal teams conduct periodic security and data protection training aimed to emphasize the importance of security and data protection. In addition, we have implemented a review process to assess the security profile and data protection practices of certain third-party service providers that have exposure to Akamai's systems, including, as appropriate, review of vendor security policies and procedures and contractually required security commitments.


text: Perficient's Vice President of Information Technology and General Counsel are active members of the cross-functional team managing the Program. Perficient's Vice President of Information Technology is responsible for Perficient's internally facing technology solutions, infrastructure, and data security team. He has served in similar leadership roles prior to joining Perficient. Perficient's General Counsel is responsible for Perficient's legal and privacy teams. He has over 10 years of experience in the technology sector which includes substantial experience in cybersecurity-related matters. These members of Perficient's senior management team oversee day to day risk management activities performed by the Company's IT Infrastructure, Data Security, and Data Privacy colleagues and participate in annual simulated data security/privacy exercises. The VP of Information Technology and General Counsel also regularly brief other members of the Company's senior management team and the Board, either as a whole or through its Audit Committee, which is charged with oversight of the Program. These briefings occur at least quarterly and address the Program's operations, management of cybersecurity risks, and any potential impact on Perficient's operations and financial stability.


text: Our customers rely upon Akamai to power and protect the online experiences of their end user customers. We provide security, content delivery and compute services through Akamai Connected Cloud and maintain internal systems and other data associated with running our business. We have implemented cybersecurity risk management programs and procedures designed to identify and address threats to both internal and customer facing data and systems that are subject to ongoing compliance assessments, certifications and testing.


text: Under the oversight and direction of the Akamai executive management team and the Audit Committee of Akamai's board of directors, the Chief Security Officer (the "CSO") has primary responsibility for overseeing Akamai's management of cybersecurity risks. Reporting to the Chief Executive Officer through the Company's Executive Vice President and General Manager of the Security Technology Group, the CSO leads Akamai's Information Security Committee, which works cross-functionally with other Akamai departments, including legal, business, policy and technical functions, as appropriate, to exchange information related to cybersecurity. Our current CSO is an accomplished security professional with 15 years of experience in building and leading information security teams at both public and private companies. Akamai's information security team is comprised of senior ranking staff who have experience in a broad range of security domains, including security operations, software security, risk management and auditing.


text: The CSO and Akamai's information security team regularly communicate the nature and state of security risks to senior business leaders across the organization. In addition, the CSO meets on a regular basis with the Information Security Committee to provide cybersecurity program updates and to discuss potential risks and changes in the cyber threat landscape in which we operate. On a quarterly basis and as needed, the CSO reports to the Audit Committee to provide information on, as applicable and appropriate, cybersecurity risk management programs, risk mitigation, cybersecurity incidents and related disclosure obligations, if any, information on new or changing threats and other cybersecurity matters. The Audit Committee Chair reports to our board at least quarterly on our cybersecurity risk management program, including risk mitigation, cybersecurity incidents and other relevant developments in our cyber threat landscape. In addition to formal reporting, the CSO takes part in informal meetings as needed and requested with Akamai's management, including the Chief Executive Officer and the board of directors.


text: The information security team, under the authority of the CSO, has developed a cybersecurity risk management program that addresses four primary operational pillars: • researching, monitoring and identifying significant cybersecurity threats and risks across Akamai Connected Cloud and the larger internet ecosystem taking into account malicious actors, software vulnerabilities and other threat sources; • assessing designated risks applicable to Akamai's assets and systems, including those associated with third-party vendors and suppliers, and planning and tracking efforts to address significant risks; • managing cybersecurity incidents and associated reporting and communications obligations; and • ongoing compliance assessments through internal and external audits and assessments, certifications and the penetration and vulnerability testing of certain systems. These operational pillars and the programs established from them are informed by cybersecurity industry standards.


text: Our programs are designed to identify and categorize cybersecurity threats and risks through different sources. We conduct assessments of threat models to determine which risks are most likely to impact us. Akamai's information security team gathers threat and risk data and updates through various sources, such as systems reviews, security research activities, product development processes, diligence efforts in acquisitions and internal and external security scans and alerts, as appropriate. As applicable, in certain circumstances, we also collaborate with industry partners in the security community, our peers and law enforcement agencies, to support our cybersecurity threat intelligence capabilities. This information is collected, categorized and assessed to identify, prioritize and manage significant cybersecurity risks. As a result, our process is continually evaluated and evolves as the threat landscape changes. In addition to ongoing risk management procedures, we have implemented a cybersecurity incident procedure designed to identify and address security incidents through various channels. As part of this process, cybersecurity incidents are evaluated, as appropriate, by a cross-functional team to assess the impact of the incident or threat to Akamai from a financial, reputational and operational perspective, and to determine notification obligations to customers and regulators and disclosure obligations to investors, as applicable. The results of such evaluation are discussed with the board of directors as appropriate. On a regular basis, our cybersecurity professionals conduct internal assessments of this process. Additionally, we have implemented an incident response plan that is reviewed by the Audit Committee and the board of directors from time to time.


text: Under the oversight and direction of the Akamai executive management team and the Audit Committee of Akamai's board of directors, the Chief Security Officer (the "CSO") has primary responsibility for overseeing Akamai's management of cybersecurity risks. Reporting to the Chief Executive Officer through the Company's Executive Vice President and General Manager of the Security Technology Group, the CSO leads Akamai's Information Security Committee, which works cross-functionally with other Akamai departments, including legal, business, policy and technical functions, as appropriate, to exchange information related to cybersecurity. Our current CSO is an accomplished security professional with over 15 years of experience in building and leading information security teams at both public and private companies. Akamai's information security team is comprised of senior ranking staff who have experience in a broad range of security domains, including security operations, software security, risk management and auditing.


text: The information security team, under the authority of the CSO, has developed a cybersecurity risk management program that addresses four primary operational pillars: • researching, monitoring and identifying significant cybersecurity threats and risks across Akamai and the larger internet ecosystem taking into account malicious actors, software vulnerabilities and other threat sources; • assessing designated risks applicable to Akamai's assets and systems, including those associated with third-party vendors and suppliers, and planning and tracking efforts to address significant risks; • managing cybersecurity incidents and associated reporting and communications obligations; and • ongoing compliance assessments through internal and external audits and assessments, certifications and the penetration and vulnerability testing of certain systems. These operational pillars and the programs established from them are informed by cybersecurity industry standards.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see "Risk Factors" included elsewhere in this annual report on Form 10-K.


text: Risk Management/Strategy The protection of our data, including athlete and teammate data, is critical to the Company's strategy of being a trusted advisor throughout the athlete and teammate experience. Cybersecurity is integrated into the Company's Enterprise Risk Management framework and is overseen by management and the Audit Committee.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: Company acknowledges the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition, and reputation.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: The Company's Cybersecurity team, led by the Company's Chief Information Security Officer ("CISO"), works in close partnership with multiple internal constituencies to monitor and focus on current and emerging data security matters across the Company and with third parties while implementing and enabling industry-accepted cybersecurity risk management and compliance frameworks and programming, including the NIST Cybersecurity Framework. Internal and third-party risks are reviewed, monitored, and managed by the Company's Cybersecurity and Privacy teams, audited by an Internal Audit team and various external parties. The Company regularly engages third-party experts to assess the effectiveness of its cybersecurity programs. Additionally, the Company continually invests in skilled personnel; recurring training, processes, and procedures; insurance coverages; and numerous technologies to keep pace with current threats; trends; and an ever-evolving legal, regulatory, compliance, and risk landscape with respect to cybersecurity.


text: The Company has implemented a Cybersecurity Incident Response Plan (the "IR Plan") and framework to appropriately detect, contain and respond to cybersecurity incidents. The IR Plan identifies protocols for incident classification, the use of third-party service providers where applicable, processes for notification and internal escalation of information to senior management and the Audit Committee, and processes for materiality review. The IR Plan is reviewed and updated, as necessary, under the leadership of the Company's CISO. Additionally, the Company maintains processes to assess the risks associated with third parties that store, transmit, or process sensitive Company data.


text: While we have no knowledge of any material data security breaches to date, any compromise of our data security could result in a violation of applicable privacy and other laws or standards, significant legal and financial exposure beyond the scope or limits of our insurance coverage, interruption of our operations, increased operating costs associated with remediation, equipment acquisitions or disposal, added personnel, and a loss of confidence in our security measures, which could harm our business, athlete experience, reputation or investor confidence. See Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.


text: The Audit Committee provides oversight of our cybersecurity risk management, as the security of athlete and teammate data continue to be Company-wide priorities. Our cybersecurity risk management is led by our CISO, who has more than 24 years of experience leading cybersecurity capabilities and management of cybersecurity risk. The CISO reports to the Company's Chief Technology Officer, who reports directly to the Company's Chief Executive Officer. The CISO provides quarterly (or more often, if necessary) updates to the Audit Committee and periodic updates to the full Board, regarding existing and new cybersecurity risks, including how management is mitigating those risks. The CISO and the broader cybersecurity team is responsible for detecting, containing, and responding to cybersecurity incidents as documented within the IR Plan.


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations or financial condition. While we have no knowledge of any material data security breaches to date, any compromise of our data security could result in a violation of applicable privacy and other laws or standards, significant legal and financial exposure beyond the scope or limits of our insurance coverage, interruption of our operations, increased operating costs associated with remediation, equipment acquisitions or disposal, added personnel, and a loss of confidence in our security measures, which could harm our business, athlete experience, reputation or investor confidence. See Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.


text: The Audit Committee provides oversight of our cybersecurity risk management, as the security of athlete and teammate data continue to be Company-wide priorities. Our cybersecurity risk management is led by our CISO, an accomplished leader in cybersecurity capabilities and management of cybersecurity risk with over 25 years of experience who joined the Company in January 2025. The CISO reports to the Company's Chief Technology Officer, who served as the interim CISO for a portion of fiscal 2024 following the departure of our then current CISO in October 2024, and directly reports to the Company's Chief Executive Officer. The CISO provides quarterly (or more often, if necessary) updates to the Audit Committee and periodic updates to the full Board, regarding existing and new cybersecurity risks, including how management is mitigating those risks. The CISO and the broader cybersecurity team is responsible for detecting, containing, and responding to cybersecurity incidents as documented within the IR Plan.


text: Risk Management, Strategy, and Governance Cybersecurity Integration with overall risk management Cleco's business operations rely on complex and evolving operational and information technology systems and network infrastructures. Digital information, information technology, and automation are essential components of Cleco's operations and growth strategy. Cleco continues to assess its cybersecurity tools and processes and has taken a variety of actions to monitor and address cyber-related risks. These cybersecurity tools and assessments are embedded in Cleco's overall enterprise risk management system. Cleco utilizes the following tools, methodologies, and standards to assess, identify, and manage material cybersecurity risks: • NERC CIP standards, which protect Cleco's operational technology, • National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which protects Cleco's operational and information technology, • Sarbanes-Oxley Act (SOX) regulations, which require Cleco to maintain access and security controls for certain systems that are essential to the completeness and accuracy of financial reporting, • internal and third-party assessments to identify and prioritize risks, • Cybersecurity Incident Response Plans (CSIRPs), and • a security operations center managed 24 hours a day by a third party.

companyName: Cleco Corporate Holdings LLC


text: Processes to assess, identify, and manage material risks Cleco has processes and procedures in place to ensure its cybersecurity program is operating effectively and members of Cleco's EMT routinely review its cybersecurity strategy, policy, program effectiveness, standards enforcement, and cybersecurity issue management. Cleco conducts risk assessments and compliance audits against standards including the NIST CSF, NERC CIP, and SOX. Cleco also engages with a variety of independent third parties, such as assessors, consultants, and auditors, for periodic audits and reviews of cybersecurity threats and related controls, including review of periodic penetration tests, regular patch reviews from vendors listing relevant risks, industry alerts and forums, and tabletop exercises. These assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization. Cleco also utilizes its Internal Audit department to review its cybersecurity program, in which findings are reported to the Audit Committee.


text: Cleco's CSIRPs help ensure a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting Cleco. These response plans include detection, analysis, containment, eradication, recovery, post-incident review, and timely notice to relevant stakeholders, including Cleco's Audit Committee, once an incident is deemed to be potentially significant or material.