text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) our information security team works with management, including our Chief Technology Officer ("CTO"), to prioritize our risk management processes and mitigate cybersecurity threats that could more likely lead to a material impact to our business; (3) our senior management/committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the cybersecurity subcommittee of the audit committee of the board of directors, with the cybersecurity subcommittee reporting to the audit committee of the board of directors which evaluates and oversees our cybersecurity risk as part of our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; and cybersecurity software and managed cybersecurity service providers.

companyName: Rigetti Computing, Inc.

ticker: RGTI

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and public cloud providers, as well as various third-party suppliers that support our manufacturing and development processes. We use certain vendor management processes to manage cybersecurity risks associated with our use of these providers, which includes reviewing the written information security programs of certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

stage1Category: Third-Party Risk


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk-based approach to identifying and overseeing third party cybersecurity risks, including evaluating the cybersecurity processes of service providers and other vendors, and reviewing available security certifications and independent audit reports.

companyName: MeiraGTx Holdings plc

ticker: MGTX

stage1Method: unanimous


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences, which may adversely affect our business.

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee, and specifically the subcommittee for cybersecurity, is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

stage1Category: Board Governance


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director for IT, who has 25 years of leadership experience in information security, and various IT and security certifications, including certified information systems security professional (CISSP).

stage1Category: Management Role


text: The Senior Director for IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for potential cybersecurity incidents, approving technical cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including the CTO, CFO, CEO, and others. Our information security function, together with our CTO, works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the cybersecurity subcommittee of the board of directors' audit committee for certain cybersecurity incidents.


text: The cybersecurity subcommittee receives periodic reports from the Senior Director for IT or the CTO concerning the Company's risk profile, including significant cybersecurity threats and risk and the processes the Company has implemented to address them. The cybersecurity subcommittee of the audit committee also receives/has access to various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.


text: The Partnership's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems, and those that are offered to residents and tenants, are integral to the operation of the business. The Partnership utilizes these systems, among others, for financial analysis, management, and reporting, for facilitation of operations, including for the initiation, generation, and completion of resident leasing, for internal communications, and for various other aspects of the business.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: The Partnership's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Partnership has implemented or is in the process of continuously evaluating, testing and updating various information security processes and policies designed to identify, assess and manage material risks from cybersecurity threats to the Partnership's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Partnership's residents' and employees' personal data.


text: To operate its business, the Partnership engages certain third-party vendors to perform a variety of functions. The Partnership seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Partnership's vendor management procedures include reviewing the cybersecurity procedures, imposing contractual requirements, and conducting as needed periodic reassessments. The Partnership seeks to further enhance this review to expand the scope and depth of this analysis.


text: Cybersecurity is a critical component of our risk management process. We recognize that no single technology, process, or business control can effectively prevent or mitigate all risks, thus we use a variety of tools including multi-factor authentication and antivirus and firewall protection, to help identify, protect, detect, respond to, and recover from cyber threats. These individual technologies work together as part of our strategy to minimize risk. This strategy is tested through audits and independent program assessments, as well as through additional exercises with our Managed Service Provider, designed to assess effectiveness. The Managed Service Provider actively manages our firewalls, multi-factor authentication, antivirus, and Azure environment. Our Managed Service Provider also reviews our cybersecurity program on a quarterly basis and provides recommendations toward best industry practice. Our cybersecurity program is continually evolving to align with NIST standards, and we regularly monitor our progression toward these standards.


text: Our Audit Committee is responsible for overseeing our cybersecurity and data privacy risks. Our cybersecurity program is led by the Hamilton Company's Chief Financial Officer, who, along with the Hamilton Company's Director of Information Technology who has been with Hamilton for 38 years, provide regular updates each quarter to the Audit Committee regarding this program, including information about the cybersecurity threat landscape, investments in infrastructure and opportunities to protect and enhance the Company's systems and security of products and operations. The also Board receives periodic briefings from management regarding cybersecurity activities and initiatives.


text: The Partnership's cybersecurity program is designed to safeguard the confidentiality, integrity and availability of data and systems within the Company's environment to effectively support our business objectives and customer needs. Our commitment to cybersecurity focuses on enhancing our prevention, monitoring, and detection response capabilities to identify and respond to evolving threats. We believe cybersecurity is the responsibility of every employee of the Hamilton Company, and it is prioritized each year. We regularly test, educate, and share best practices with employees of the Hamilton Company to raise awareness of cyber threats through a comprehensive security awareness training program. Our Managed Service Provider is responsible for testing our ability to restore our critical infrastructure on a quarterly basis. Additionally, our incident response and disaster recovery plans are reviewed and updated annually. During 2023, we have not encountered cybersecurity challenges that have materially impaired our operations, business strategy or financial condition.


text: In the ordinary course of our business, we and our third-party service providers, such as contract research organizations, contract manufacturing organizations, and managed service providers collect, maintain and transmit sensitive data on our networks and systems, including our intellectual property and proprietary or confidential business information (such as research and development data and personal information). The secure maintenance of this confidentiality, availability and integrity of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology applications and services to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Verastem, Inc.

ticker: VSTM


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include assessment of, and response to internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations.


text: Our risk management team collaborates with our Chief Information Officer ("CIO"), our internal information technology ("IT") department, our Compliance team and our third-party IT managed service providers to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents. Our CIO and IT Department implement processes around security monitoring and vulnerability testing. We also have in place an incident response process for responding to and escalating cybersecurity events and incidents.


text: As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing of our systems, networks and web properties. We also employ internal security testing solutions and security awareness training for all employees.


text: We engage a security operations platform provider to assist us in monitoring, assessing and managing potential cyber events. We also perform periodic cyber maturity assessments to measure our cybersecurity profile against industry peers and standards.


text: We rely on third parties, including software-as-a-service and platform-as-a-services cloud vendors, for various business functions. Our third-party services providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business. We oversee these third-party service providers by conducting vendor diligence during contracting and onboarding and through ongoing monitoring. Vendors are assessed for risk based on the nature of their service, access to data and systems, and the level to which those systems and data impact our business. Based on that assessment, we conduct diligence that may include completing security questionnaires, onsite audits, and other technical and data security evaluations. Governance.


text: Our Board of Directors provides oversight of the Company's cybersecurity risk management program and integrates this oversight into its overall evaluation of enterprise risk. Our Audit Committee has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once each year and following any material cybersecurity incidents.


text: At the management level, our cybersecurity program is managed by our CIO, reporting into the executive leadership team. Our CIO has over 30 years of experience managing IT operations and cybersecurity within the pharmaceutical, biotechnology and high-tech industries.


text: Our CIO reports at least annually to the Audit Committee and such reporting will include an overall assessment of our compliance with our cybersecurity policies and procedures as well as topics that may include risk assessments, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures. In the event of a cybersecurity incident, the CIO reports the incident to the executive leadership team. If the cybersecurity incident is determined to be material the executive leadership team will report the incident to the Audit Committee or Board of Directors as appropriate.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or government investigations, litigation, fines or damages. For more information, see "Our business and operations may be materially adversely affected in the event of computer system breaches or failures" in Item 1A. Risk Factors in this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: As discussed earlier under General Risk Factors, we have become increasingly dependent upon technology, including information systems as well as infrastructure and cloud applications and services. These technologies are used to operate our businesses, process and record financial and operating data, communicate with our business partners, analyze mining information, estimate quantities of coal reserves, and perform other activities related to our business.

companyName: Ramaco Resources, Inc.

ticker: METC


text: Ramaco uses third parties to manage its information technology ("IT") infrastructure. The Company's process for assessing, identifying, and managing material cybersecurity risks includes the following activities, all of which are performed or assisted by third parties with considerable experience providing managed IT and security services or IT assurance services:


text: Assessment of cybersecurity risks, using the National Institute of Standards and Technology Cybersecurity Framework as a guide, as part of the overall IT risk assessment performed annually; Network operations center monitoring to establish baseline metrics and assist with anomaly detection; Periodic vulnerability scanning; Configuration of firewall, antivirus, and malware protection as well as alert thresholds; Generation of system audit logs and recovery backups; Preparation of an incident response plan and assignment of team members;


text: Logical access security reviews for applications and data protection; and Awareness training for employees on cybersecurity threats and safe practices.


text: The Company also uses applications hosted by a reputable third party that are critical to managing Ramaco's business and financial records. The process to oversee and identify cyber risks associated with the third-party service provider involves reviewing its annual System and Organization Controls 2 ("SOC 2"), Type 2 Report as well as conducting recurring status meetings with the third party.


text: The responsibility for managing and assessing material risks from cybersecurity threats lies with the Company's IT Steering Committee, which is made up of five members of senior management having legal or corporate finance backgrounds. The committee also includes one lead representative of the third-party IT management and security service providers utilized by the Company to mitigate cybersecurity risks as discussed above. The IT Steering Committee met at least on a quarterly basis during 2023 and intends to meet monthly going forward. Information regarding cybersecurity risks and mitigation efforts is reported periodically by the IT Steering Committee to the Company's chief executive officer, chief financial officer, and Audit Committee. The Audit Committee is primarily responsible for the Board of Directors' oversight of cybersecurity risks.


text: We have not experienced any cybersecurity incidents to date that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, and we may not be successful in preventing or mitigating a cybersecurity incident despite our efforts to protect against such risks. A successful cyberattack could lead to theft of sensitive information, ransomware, destruction of data, or other issues causing financial, legal, or reputational damage. These events are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, should they occur.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes designed for the identification, assessment and mitigation of cybersecurity risks in order to protect the confidentiality, integrity and availability of our critical systems and information. We have designed and assessed our program based on the Center for Internet Security (CIS) Controls standard and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).


text: Although, to our knowledge, we have not experienced any material cybersecurity breach to date, we may experience cybersecurity incidents and face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see "Item 1A Risk Factors."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other IT risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks at least semi-annually. In addition, management updates the Audit Committee regarding cybersecurity matters, as necessary, including any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities and the full Board periodically receives briefings from management on our cybersecurity risk management program.


text: Our management team is responsible for assessing and managing risks from cybersecurity threats. The Vice President, Global IT and Senior Vice President, Risk and Internal Controls have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. They provide briefings to the management team, including the Chief Financial Officer/Chief Operating Officer and the General Counsel and Secretary, as well as the Board and the Audit Committee. Their briefings include topics such as threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us. The briefings also cover alerts and reports produced by security tools deployed in our IT environment. Our Vice President, Global IT has over 20 years' experience leading teams in cybersecurity, and designing and securing critical IT infrastructure in the healthcare, biotech and sports entertainment sectors. Our Senior Vice President, Risk and Internal Controls has more than 30 years' experience designing, implementing and leading risk management, internal control and compliance programs, including cybersecurity, data privacy and business resilience, in global organizations.


text: Our management team, including the Vice President, Global IT and Senior Vice President, Risk and Internal Controls, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our Vice President, Global IT has more than 15 years' experience leading teams in cybersecurity, designing and securing critical IT infrastructure in the sports entertainment, healthcare and biotech sectors. Our Senior Vice President, Risk and Internal Controls has more than 30 years' experience designing, implementing and leading risk management, internal control and compliance programs including cybersecurity, data privacy and business resilience.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: The Bank's Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recover strategies to help mitigate the impact of a cybersecurity incident across all business lines.


text: Management Role and Board Oversight The cybersecurity programs are supervised by the Bank's Chief Information Security Officer ("CISO") reporting to the Chief Risk Officer ("CRO") and dotted line to the Chief Information Officer. The Chief Risk Officer has reporting responsibility to the Board's Risk and Compliance Committee while the Chief Information Officer has reporting responsibility to the Board's Information Technology Committee. The Risk and Compliance Committee consists of eight directors, seven of whom are independent, while the Information Technology Committee consists of three directors, two of whom are members of the Risk and Compliance Committee. The Company Board includes members who have expertise in cybersecurity, fraud, and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO who has a Ph. D. in Information Technology with a concentration in Information Assurance and experience in the information technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's knowledge and experience in the cybersecurity field are key to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards and disaster recovery, business continuity, and incident response efforts. Additionally, the Bank's CRO who leads the management risk function, has extensive experience in risk management.


text: Individual consent to the use of personal information Collecting the minimum amount of personal information Controls over the use and disclosure of personal information Use and retention of personal information related to a cybersecurity incident Transparency for certain cybersecurity activities

companyName: ATEL 17, LLC


text: The cybersecurity programs include a cross-function team of trained internal and external information security professionals, all of whom are required to maintain industry accredited certifications. We have an Incident Response Team chaired by our Chief Operating Officer that is comprised of executive management and designated managers, including the CISO. The purpose of our incident response plan is to manage incidents, including information security incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, notify customers, as required by law, comply with regulatory requirement and any third-party obligations.


text: The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Risk Management Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, and risk reporting. The CISO and CRO also provide a monthly overview of the cybersecurity landscape to the Board of Directors.


text: Managing Material Risks and Integrated Overall Risk Management The Company maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.


text: Cybersecurity Threats To assess and manage cybersecurity threats, the Company maintains an Incident Response Team comprised of members from the major business areas in the Company to ensure appropriate subject matter specialists are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Company's business strategy, results of operations or financial condition by following implemented processes. The Company has not identified any cybersecurity threats that have materially affected operations or financial position.


text: Oversee Third-Party Risk The Company has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Company's vendor management program requires initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.


text: Cybersecurity Risks Management and the Board of Directors acknowledge that technology systems, managed both by the Company and third-party service providers, are critical to business operations and therefore require appropriate risk management.


text: Engagement with Third Parties on Risk Management Cybersecurity is an integral part of the risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Our internal audit function actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. Our external audit results are reviewed and reported in our annual filing and to the Board Audit Committee. Additionally, the Company and the Bank are regulated entities and undergo regulatory reviews to ensure the Company and the Bank are in compliance will all appropriate standards.


text: We assess, identify and manage risks from cybersecurity threats through CNH's Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of CNH's larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors for CNH (the "CNH Audit Committee") and is managed by CNH's Chief Information and Digital Officer (the "CNH CIO") and a dedicated CNH Chief Information Security Officer (the "CNH CISO"). The CNH CISO has over 10 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as a Global Director of Information Security at another global high-tech manufacturing company. The CNH CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CNH CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial Capital LLC


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2023. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to CNHI's global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.


text: CNH's Board of Directors (the "CNH Board") addresses our cybersecurity risk management as part of its general oversight function. The CNH Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The CNH Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the CNH CIO and the CNH CISO. In addition, on at least an annual basis, the CNH Board receives reports, summaries or presentations from the CNH CIO and the CNH CISO related to cybersecurity threats, risk, mitigation and related processes.


text: The CNH CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide for how to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy The current threat environment from phishing emails to cyber-attacks has created an urgent need for increased awareness on cyber and information security. Peoples and Peoples Bank take a risk-based approach to managing these threats. The Bank's leadership team and its Board of Directors engages in the management of this risk by participating in the information security and cybersecurity strategy and review process.

companyName: PEOPLES FINANCIAL SERVICES CORP.

ticker: PFIS


text: Cyber and information security programs are designed around industry best practices. Compliance with these best practices along with federal and state regulatory requirements are examined annually by the Pennsylvania Department of Banking, the FDIC and we regularly engage other third-party external auditors and consultants to assess our compliance.


text: Our cyber defense strategy includes continuous monitoring, integrated risk assessment, identification of vulnerabilities and human risk factors, and employee awareness. Cyber exercises with other financial services companies and government agencies help prepare the Bank for cyber-attacks. Incident response scenarios and business continuity exercises test the organizations preparedness for disaster events. The organization also utilizes several national and global third party advisors to ensure the appropriateness of the Bank's security posture, effective operation of the cyber security discipline and proper assessment of risk.


text: Third-Party Risk Management The Bank has an established third party information security risk management program that reviews and assesses third parties prior to engagement and throughout the third party relationship. This program requires periodic risk assessments to be conducted throughout the term of the engagement. Third parties and their employees are required to adhere to information security standards and best practices. The Bank includes in its contracts with third parties that third parties maintain confidentiality, security provisions and business continuity practices.


text: Education and Awareness Peoples Security Bank and Trust Company employees are required to complete training on customer information protection at least annually. They receive monthly training and testing on phishing emails and other timely information security topics. They are also required to abide by the Bank's Code of Business Conduct and Ethics Policy. Annual review and acknowledgement of the employee's information security responsibilities are required. Information security tips are provided on the Bank's website for all customers to review. We provide additional information security advantages to our customers using our online banking systems and encourage the Bank's digitally active business customers to take advantage of the cyber and phishing training provided free of charge by the Bank.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, have, to date, materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: Board of Director Oversight Our Board of Directors has ultimate oversight of cybersecurity risk. The Board of Directors is assisted by the Board Information Technology Committee ("IT Committee") which regularly provides reports to the Board of Directors. The IT Committee is comprised of members with experience in managing cybersecurity risks. The IT Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Officer ("CIO"), and the Chief Risk Officer ("CRO") through quarterly meetings. Cybersecurity reviews are completed at least twice annually and provided to the Board of Directors Audit Committee. Additionally, awareness and training on cybersecurity topics is provided to the whole Board on an annual basis.


text: Management's Role The CIO along with the Information Security Officer is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department is led by the Information Security Officer, who reports directly to the CIO and the Board of Directors with dotted-line reporting to the CRO. The Company's CIO has over 30 years of experience in technology and cybersecurity which includes 24 years in the financial services industry. The Information Security Officer has over 20 years in the financial services industry with the last 14 years as a Risk Analyst and then Information Security Officer.


text: The Company's Information Security department measures and reports on the quality of information and cyber risk management across all functions. Information security risk is reported by both the Information Security and Enterprise Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board. The risk committees include the Executive Risk Management Committee, the Management Information Technology Steering Committee and the Information Technology Committee of the Board of Directors. In addition, we have an escalation process in place to inform senior management and Board of Directors of material cybersecurity issues


text: Cybersecurity Risk Management and Strategy We have invested time and resources with a goal to define, implement and further develop the maturity of our cybersecurity risk management and strategy program. During this time, we have developed a common cybersecurity incident response plan across our businesses and jurisdictions that while unique to the risk profile of each business, allows us to utilize common response and decision-making protocols in an effort to react quickly to a potential cybersecurity threat and manage risk to our overall Company.

companyName: ATN International, Inc.

ticker: ATNI


text: In developing our cybersecurity incident response plan and assessing the maturity of our cybersecurity threat program, we utilize the National Institute of Standards and Technology Cybersecurity Framework (NIST). We use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We make it a practice to continually review the maturity of our program, utilizing the NIST standards and leveraging the feedback of both external advisors and third party threat intelligence tools in an effort to continuously improve our program in relation to evolving cybersecurity threats in our industry.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Risk Council, composed of professionals across a variety of departments and jurisdictions in our organization. Our cybersecurity program utilizes methodologies, reporting channels and governance processes across our subsidiaries that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that are assessed and reviewed when onboarding new vendors, customers, product lines or shifts in our service delivery models.


text: Our cybersecurity risk management program includes: risk assessments performed internally and with the help of third party vendors that are designed to help identify material cybersecurity risks to our critical systems, information, products, services, equipment, and our broader enterprise IT and customer-facing network environments;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents, and (4) our assessment of new products and business processes;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with the analysis of our security controls and those of our key vendors;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: To date, we have not experienced any prior cybersecurity incidents that have materially affected our operations, business strategy, results of operations, or financial condition. For a discussion of risks that could in the future impact our operations, business strategy or financial condition, please see " Cybersecurity breaches could have an adverse effect on our business " in our Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity in connection with its general risk assessment and oversight. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives frequent, and typically no less than quarterly reports from management on our cybersecurity risks, assessment of our cybersecurity program, and development of our information security incident response plan. In addition, management updates the Committee, pursuant to an agreed upon timetable and escalation matrix regarding any material cybersecurity incidents, as well as providing the Committee with periodic reports on any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management from time to time on our cyber risk management program. Board members receive presentations and training on cybersecurity topics from our Chief Information Officer (CIO), Vice President of Architecture and Security, or external experts as part of the Board's continuing education on topics that impact public companies. Our CIO is an experienced information technology professional with just under 30 years of experience in the networking and communications industries. His extensive experience extends to all facets of information technology, including enterprise applications, cloud and SaaS systems, network infrastructure, and network management. For the past decade, he has been at the forefront of cloud security through partnerships with leading identity and access management providers and other leading security technology providers. He is a certified Sarbanes-Oxley-trained professional. Our VP of Architecture and Security has over 30 years of experience in IT and Security and has the Certified Information System Security Professional (CISSP) certification as well as various technology vendor certifications.


text: As referenced above, our Risk Council is responsible for day-to-day cyber risk management, and reports to the Audit Committee on these matters. Our management team, including our General Counsel, who serves as the lead of our Risk Council, and our CIO are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal security team is made up of experienced professionals that have an average of 27 years of IT and security experience, including certifications such as CISSP and CCSP from ISC2. We also have developed an internal training program to develop new talent within our organization and work with vendor and third-party training programs to mentor and educate these team members to expand and enhance the capabilities of our team.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative ("CSI") committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization. The Information Security Officer reports directly to the Chief Operating Officer and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Cyber Risk Institute's cybersecurity profile designed specifically for the financial services industry, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, along with key members of our risk team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employe an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Management Director of Information Technology and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned "A disruption, breach, or failure in the operational systems or infrastructure of our third party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business" in Item 1A. Risk Factors.


text: Our Information Security Officer is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line's activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as Information Technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management commitess including the CSI Committee, which focuses on technology impact, and the Management Risk Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Risk and Compliance Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CSI Committee provides quarterly reports to the Risk and Compliance Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Risk and Compliance Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk and Compliance Committee of our board of directors reviews our cyber security risk profile on a regular basis. The Risk and Compliance Committee our board of directors provides a report of their activities to the full board of directors at board meetings.


text: We have developed and implemented a cybersecurity framework intended to identify, assess, monitor and manage risks from cybersecurity threats to the security of our information, systems and network using a risk-based approach. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although our framework takes into account the particulars of our business and our diverse network of terminal operations and does not meet all the technical standards, specifications or requirements under the NIST. Additionally, the Company follows IT General Controls that were implemented to adhere to Sarbanes-Oxley internal controls.

companyName: TransMontaigne Partners LLC


text: We contract with external firms to assess the Company's cybersecurity framework. In connection therewith, such firms conduct cybersecurity risk assessments, cybersecurity incident response, provide internal and external penetration testing and ongoing training to our Cybersecurity Group. The Company maintains a cybersecurity insurance policy. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems and third-party service providers.


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. The Company maintains a variety of incident response plans that would be deployed in the event that a cybersecurity incident were detected. We require all of our employees to undertake data protection and cybersecurity training and compliance programs on an annual basis, which are administered and tracked through online learning modules.


text: Our critical business systems are fully redundant and backed up at separate locations. Separate business and SCADA networks allow for isolation of potential threats and enhance the security of these systems. We maintain a dedicated SCADA department, staffed around the clock, to evaluate and respond to significant events and incidents that may impact our pipeline operations. Anti-virus solutions are deployed on our SCADA systems and workstations in our data centers and control centers.


text: Our Cybersecurity Group oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. Our Director of IT Infrastructure, who has extensive cybersecurity knowledge, training and skills gained from over 30 years of work experience on cybersecurity and from technology leadership roles in the energy industry, heads the Cybersecurity Group responsible for implementing and maintaining our cybersecurity and data protection practices. The Director of IT Infrastructure reports directly to our Chief Financial Officer.


text: Significant threats are reviewed by the Cybersecurity Group to determine whether further escalation is appropriate. Any cybersecurity threat or incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to designated members of our executive management team; namely our Chief Financial Officer, Chief Operating Officer and General Counsel, who, in addition to the Director of IT Infrastructure, are responsible for overseeing and managing material risks from cybersecurity threats. Further, the Company provides an annual cybersecurity assessment to ArcLight.


text: To date, our business strategy, results of operations and financial condition have not been materially affected, nor are they reasonably likely to be affected by risks from cybersecurity incidents or threats. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy Our technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to maintain stakeholder trust. Our Chief Financial Officer is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CFO has over eight years of information technology, information technology audit, and cybersecurity experience, and is involved in following the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our personnel responsible for cybersecurity proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: A formal enterprise-wide cybersecurity policy and related standards; Cybersecurity training and employee phishing simulations; Scheduled and ad hoc internal and external penetration tests; Cyber incident response, IT disaster recovery, and business continuity plans; Cybersecurity assessments and remediation planning as part of our due diligence process; Identity and access management controls;


text: Third-party risk assessment and management for vendors and third-party service providers; and Cyber incident exercises for our Board of Directors and management.


text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including to monitor compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Board of Directors on an annual basis.


text: For control efficacy, the cybersecurity program leverages a variety of metrics and measurements to demonstrate whether the control objectives are being consistently achieved within the target range. Monthly security operation ("SecOps") reviews are utilized to monitor metric trends and root causes to determine potential capability improvements. The monthly SecOps reviews and related actions are aggregated into a subset of key metrics reviewed quarterly by the Board of Directors.


text: Cyber Risk Management and Strategy We have processes for assessing, identifying and managing cybersecurity risks, which are informed by industry standards and built into our overall enterprise risk management function and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: Cybersecurity Governance Our Board of Directors oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Board of Directors receives an update from our CFO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, penetration testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our CFO and our third-party cybersecurity consultant to review our cybersecurity strategy and the results of our NIST CSF assessment. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future. For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect us, see our risk factors, including the risk factors titled "Our strategy includes an increasing dependence on technology in our operations. If any of our key technology fails, our business could be adversely affected." and "A cybersecurity incident could negatively impact our business and our relationships with employees, service providers, patients, clinical study sites and government agencies." in Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: AXT INC

ticker: AXTI


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, VP of Finance, and Controller to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with finance, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and email notifications.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test and audit our safeguards. We maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and on the information and systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Cyber-attacks, system security risks and data protection issues could disrupt our internal operations and cause a reduction in revenue, increase in expenses, negatively impact our results of operation or result in other adverse consequences."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The chair of our Audit Committee has experience in assessing and managing cybersecurity risk.


text: The Audit & Finance Committee regularly reviews our cybersecurity program with our CIO and management and reports to the Board of Directors. Cybersecurity reviews by the Audit & Finance Committee generally occur annually, or more frequently as determined to be necessary or advisable. Additionally, on a quarterly basis, members of the Audit & Finance Committee receive updates from our CIO regarding matters of cybersecurity, including, but not limited to, information on new and/or existing cybersecurity risks and management's response to such risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.

companyName: Westrock Coffee Co

ticker: WEST


text: Our management committee on cybersecurity, which includes our Chief Financial Officer and members from finance and IT, is primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Financial Officer has had supervisory responsibilities over IT for over 30 years and personally engages our employees in training for cybersecurity. Our lead IT Senior System Engineer has over 20 years of direct IT employment and is a Microsoft Certified System Engineer, a Cisco Certified Network Associate and a Sun Certified System Administrator. One of our Controllers has over 15 years of Sarbanes Oxley compliance training and auditing, including auditing compliance regarding IT. Our VP Finance and Corporate Controller has over 20 years as an employee of AXT and has a thorough understanding of our specific IT systems.


text: Our management committee on cybersecurity oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which o ur management committee on cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular communication and reporting from our IT manager, alerts and warnings through the use of technological tools and software and the results of cybersecurity systems testing from a third-party consultant.


text: Our Chief Financial Officer provides briefings to our Board of Directors and the Audit Committee regarding the Company's cybersecurity risks and activities, including cybersecurity systems testing, activities of third parties, and the like.


text: Risk Management and Strategy Material risks of cybersecurity threats are integrated into the Company's overall risk management program and managed across the Company, utilizing internal and third-party expertise. To protect our information systems from a cybersecurity threat, certain tools have been implemented within our IT network to help prevent, identify, detect, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. The Company also leverages the services and tools of a third-party cybersecurity firm to identify, prioritize, assess, mitigate and remediate reasonably foreseeable cybersecurity risks and threats.


text: To identify, detect and respond to a cybersecurity incident, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing, perform incident response capability reviews and exercises, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including intellectual property) and implement appropriate changes. The Company has implemented a cybersecurity incident response plan that outlines the Company's process for preparing for a cybersecurity incident, detecting, analyzing, containing, eradicating and recovering from such incident, and provides guidance for post-incident analysis. Additionally, we have established a Cyber Incident Committee that is comprised of leadership across the Company's finance, legal, accounting, internal audit and IT organizations to provide guidance and monitor overall company cybersecurity.


text: When a cybersecurity incident occurs, the Company prioritizes responding to and containing the threat and minimizing any business impact as appropriate. Each incident is evaluated, to determine the operational and financial significance, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact. An incident that reaches a specific level of severity is reported to the Cyber Incident Committee within pre-determined time frames. In such instance, the Cyber Incident Committee monitors the incident through resolution and post-incident analysis.


text: For a discussion of cybersecurity risks or the impact of previous cybersecurity incidents and how they have materially affected us or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors " Risks Related to Our Business", which are incorporated by reference into this Item 1C.


text: The Company's board of directors is responsible for overseeing the Company's risk management program and has designated its Audit & Finance Committee with specific responsibility for overseeing cybersecurity risks, among other risks. The Company's cybersecurity organization is led by our Director of Information Security ("DOIS"), who is responsible for assessing and managing material risks that result from cybersecurity threats, and reports to the Senior Vice President and Chief Information Officer ("CIO"). The CIO and the Audit & Finance Committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including regular communication with our DOIS and regular communication with and reporting from an outsourced third party cybersecurity firm and operation of the Company's cybersecurity incident response plan, which includes escalation to the Cyber Incident Committee.


text: Our DOIS has nearly a decade of experience within cybersecurity functions and his skillset includes security architecture and engineering, incident response and penetration testing. Our CIO joined the Company in 2023 and most recently served as CIO and VP at another large organization where he built a high-performing, global, collaborative IT team to focus on digitization, M&A, analytics and cybersecurity and has held other vital IT positions over the course of his career.


text: IT Management uses a risk-based framework core consisting of cybersecurity activities, outcomes, and references that provide guidance for developing individual organizational profiles. IT Management is tasked with and shall:

companyName: ATEL 14, LLC


text: Risk Management and Strategy We have established processes and policies for assessing, identifying and managing material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework and include a Cybersecurity Incident Response Plan ("CIRP"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: Our cybersecurity risk management processes, policies and CIRP are focused on (1) developing organizational understanding to manage cybersecurity risks, (2) applying safeguards to protect our systems, (3) detecting the occurrence of a cybersecurity incident, (4) responding to a cybersecurity incident and (5) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. Our processes and policies include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. For additional information concerning cybersecurity risks we face, see Item lA Risk Factors - Information Technology and Cybersecurity Failures or Data Security Breaches Could Harm Our Business.


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. The Board has created a Cybersecurity Sub Committee of our Audit Committee for oversight of cybersecurity and other information technology risks. Our Cybersecurity Sub Committee of our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Technology Officer (CTO), provides periodic updates to our Cybersecurity Sub Committee. The Sub Committee reports to the full Board regarding its activities. The full Board also receives briefings from management on our cyber risk management program.


text: The CTO is responsible for managing our information security team to ensure they are assessing and managing cybersecurity risks in accordance with our processes and procedures. Our CTO has approximately 25 years' experience managing enterprise information technology systems.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our CIRP, when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident and outlines the processes for containment, eradication, recovery and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to our Information Technology Steering Committee, Audit Committee and to our board of directors.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, the Federal Financial Institutions Examination Council ("FFIEC"), and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Technology Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: Kiromic Biopharma, Inc.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption or Breach In Security" in Item 1A. Risk Factors.


text: Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact and cyber security awareness. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by department managers and include the Information Security Officer and Chief Technology Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Information Technology Steering and Audit Committees are responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Technology Officer provide quarterly reports to the Information Technology Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee and Audit Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at least quarterly.


text: Risk Management and Strategy The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage third-party cybersecurity firms to assist with network and endpoint monitoring, cloud system monitoring, and assessment of our incident response procedures, risk identification and assessment of material cybersecurity threats.

companyName: McEwen Inc.

ticker: MUX


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws and implement changes to our processes to comply; Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; Update key employees regularly on phishing email and other cybersecurity risks; Employ artificial intelligence assisted cybersecurity monitoring capabilities; and Complete regular updates to key software and infrastructure.


text: Management has not identified any specific risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See " Item 1A. Risk Factors, Our business could be negatively impacted by security threats, including cybersecurity threats, and other disruptions. " above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. The Audit Committee periodically receives an overview of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Global IT Manager. The Global IT Manager is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan.


text: Legacy relies on information technology infrastructure and architecture, including hardware, cloud computing networks, software, people, and processes to manage protected, confidential, and personally identifiable information. Our business is at risk from, and may be impacted by, cybersecurity threats and incidents, including but not limited to attempts to gain unauthorized access to our systems or data. Similar threats and incidents may impact third parties with which we do business. We have invested and continue to invest in cybersecurity and data protection efforts, including technical, administrative, and organizational safeguards designed to protect our systems and data. However, we acknowledge that a future cybersecurity incident could materially harm our business, operating results, and financial condition.

companyName: Legacy Housing Corp

ticker: LEGH


text: The Company's cybersecurity efforts are directly overseen by our Director of Information Technology, who reports directly to our Chief Executive Officer. The Company's Board of Directors is made aware of cybersecurity incidents and threats, as appropriate, pursuant to corporate policy.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed to align with industry standards and incorporates best practices such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: We have also established an interdisciplinary Cybersecurity Incident Response Team ("CIRT"), which is responsible for our incident response plan, our security controls, and for assessing incidents reported by our information technology security team. In addition, our cybersecurity risk management program includes: Monitoring and evaluation of our vulnerability performance.


text: Implementation of processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our critical systems and information. For any agreements with service providers that do not contain acceptable protections, we are working to put them in place on an ongoing basis.


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment. We use a third-party consultant to provide us with advisory, project execution, and operational support in connection with cybersecurity and to conduct NIST assessments and vulnerability evaluations. Cybersecurity awareness training of our employees, incident response personnel, and senior management.


text: Prioritize and scope. Identify organization objectives and priorities and determine the scope of systems and assets that support the selected business line or process.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks."


text: Cybersecurity Governance Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors encourages management to promote a culture that incorporates risk management into our corporate strategy and day-to-day business operations. Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: Management discusses strategic and operational risks at regular management meetings and conducts specific strategic planning and review sessions throughout the year. Throughout the year, senior management reviews these risks, including with respect to cybersecurity, with the Board of Directors at board meetings from time to time as part of management presentations that focus on particular business functions, operations or strategies and presents the steps taken by management to mitigate or eliminate such risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could adversely affect our business, data or information systems that we use or own.


text: Our Vice President of Information Technology, as head of our information technology team, leading our cybersecurity efforts, oversees the day-to-day administration of our cybersecurity program. Our CIRT has members that include our Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology. As key members of our management team, our Chief Executive Officer, Interim Chief Financial Officer, and Vice President of Information Technology have approximately a combined 45 years of risk management experience and are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Key members of our information technology management team collectively possess over 15 years of hands-on experience in implementing a diverse array of cybersecurity initiatives. Their expertise spans both cloud and on-premise IT infrastructure and applications/systems, cultivated through extensive engagement across various regulated environments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.