text: Cybersecurity Risk Management and Strategy Our process for managing cybersecurity risk is comprised of technologies, controls, and procedures designed to detect, assess, and manage threats and control access. We utilize a variety of systems, software, and services including firewalls, network and endpoint monitoring, anti-malware, detection and response, patch management, and backups to mitigate, identify, analyze, and respond to identified vulnerabilities and incidents in a timely manner.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: We evaluate our security posture on an ongoing basis via vulnerability scans, penetration testing, and threat intelligence monitoring. We periodically conduct third-party security assessments and regularly evaluate our processes against industry standard security frameworks. We conduct regular security training to elevate awareness and foster a security conscious culture among all employees.

secItem: Item 1C


text: We leverage third party service providers and solutions in many aspects of our operations. Our vendor management and oversight procedures include assessment of cyber security risk.


text: We do not believe there are any currently known cybersecurity risks that are reasonably likely to materially impact our business strategy, operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Our internal computer systems, or those of our third-party collaborators or other service providers, may fail or suffer security breaches and cyber-attacks, which could result in a material disruption of our development programs."


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors, or Board, and management.


text: The Audit Committee of our Board, or Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Potential material cybersecurity threat risks are also considered during Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of Information Technology who has served in various roles managing information technology and information security for over twenty-five years and reports directly to the Chief Financial Officer.

stage1Category: Management Role

stage1Method: unanimous


text: Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures. Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents.


text: To address risks associated with third parties, Prudential has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU

stage1Category: Third-Party Risk

stage1Method: majority


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, and engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: We face various cybersecurity threats, including unauthorized access, malware, ransomware, and phishing attacks. These threats could compromise the security of our information systems and the data we store and process. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS

stage1Category: Strategy Integration


text: We have established an information security third party risk management program to identify and manage these risks. This program includes regular risk assessments, third party risk provider reviews, and implementation of security measures such as encryption and firewalls, and ongoing monitoring of our systems for potential threats. We also engage with industry consultants to assist with our risk assessments.


text: On a regular basis, the technology steering committee, led by management, receives comprehensive reports summarizing cybersecurity threat monitoring and incident management activities. These reports also include details about remediation efforts to address identified threats and incidents. Additionally, both internal and external assessments of our company's cybersecurity threat monitoring capabilities are shared with the committee. Meeting minutes from these committee sessions are diligently maintained and provided to the Board of Directors.


text: The Board of Directors has responsibility for approving and overseeing management's policies related to information system security and cybersecurity threats and incidents. They also supervise management's overall approach to securing the company's information systems. The Board of Directors delegates the oversight of cybersecurity risk management to the Information Technology Committee of the Board.


text: The Information Technology Committee, in turn, reviews reports on our cybersecurity risk management processes. These reports cover assessments of management's handling of cybersecurity threats and incident management functions. The committee receives periodic updates from the Chief Information Officer, including information on social engineering risks, the effectiveness of cybersecurity training, and results from vulnerability and penetration assessments conducted both internally and by external parties. Audit reports related to information systems and cybersecurity threat monitoring are also part of this reporting process.


text: ChoiceOne recognizes the importance of cybersecurity and has established a comprehensive framework to assess and manage material risks from cybersecurity threats. The Company's cybersecurity risk management program is overseen by the Information Technology Committee, which is responsible for developing and implementing policies and procedures to protect the Company's information assets. Key members of ChoiceOne's cybersecurity team include:

stage1Category: Board Governance


text: Chief Information Officer ("CIO") has extensive experience in managing complex IT environments and mitigating cybersecurity risks. The CIO is responsible for overseeing cybersecurity and technology vendors, assessing risks in these areas, and ensuring the effective execution of the information security program.


text: Vice President of Network Security is a Certified Information System Security Professional (CISSP) with over 10 years of experience in managing IT and cybersecurity operations.


text: The cybersecurity team has several other members with expertise in network security, technology, and administration. The cybersecurity team meets regularly to review and assess the Company's cybersecurity posture, identify potential threats, and implement appropriate measures to mitigate risks. The committee also collaborates with external cybersecurity experts to stay informed about the latest threats and best practices in the industry.

stage1Category: Risk Management Process


text: Risk Management and Strategy Our policies for Cybersecurity and the Safeguarding of Data, Computing Systems and Confidential Client Information policies establish the administrative, technical, physical safeguards and risk mitigations which are implemented to protect the security and confidentiality of all customer information as set forth by the federal regulatory authorities' interagency guidelines mandated by Section 501 of the Gramm-Leach-Bliley Act of 1999 and Part 364, Appendix B of the FDIC Rules and Regulations. Our objective is to emphasize compliance with all information and cybersecurity requirements, including those detailed in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, FFIEC guidance and regulatory agency guidelines which provide established standards for cybersecurity and the safeguarding customer information and Bank assets.

companyName: River Financial Corp

ticker: RVRF


text: Security Operation and Governance Our Board Chartered, IT Committee oversees implementation, monitoring, and assessment of cybersecurity risks as it relates to the comprehensive Information Systems Security Program (ISSP). In fulfilling its duties, the Committee ensures the development of appropriate policies. The Committee reviews and discusses policies, procedures, and projects with management and after taking into consideration any matters that the Committee may deem advisable, the Committee annually recommends such policies to the Board of Directors for review and ultimately approval.


text: The Board of Directors receives cybersecurity status updates, training and is encouraged to engage with questions. Frequency of these cybersecurity updates are driven by the events in the world, cyber threats, and alerts received by the Bank's ISO, Management, or Technology Administrator.


text: Information Technology and Cybersecurity Management Our Information Security Officer (ISO) is responsible for overseeing the Bank's strategies necessary to ensure the confidentiality, integrity, and availability of electronic information by communicating risk to senior administration, creating, and maintaining enforceable policies and procedures, and ensuring compliance with regulatory requirements.


text: Under the oversight and guidance of the IT Committee, the Board of Directors, and the HR Department's ISO Job Description, the ISO is responsible for the following: • Overall security/control of the network and computing systems. • For coordinating the education and training of new and existing employees on Network and Physical Security Policies as outlined in the Information Systems Security Policy. • Management of all detection systems directly connected to the Internet/network and subjected to on-going review of generated reports and risk assessments performed by independent auditors and vulnerability identification software. • Management of the audit function, which will periodically review the information security policies, standards, and procedures and ensure the adequacy of information system controls and compliance. • Provide reports to the IT Committee, Senior Management, and the Board of Directors, as needed or required, concerning the Bank's security posture. • Oversight and management of technology vendors and suppliers.


text: Security Competencies The Information Security Program oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. This level of competency is attained through regulatory examination, scheduled audits, internal risk assessments, security scanning of assets, and annual testing. We participate in annual programs including the FFIEC Cybersecurity Assessment Program which measures and defines our inherent risks and the maturity of our preparedness. This process is overseen by our IT Committee and presented to the Board of Directors.


text: Third-Party Risk Management Any new organization or party that we show interest in establishing a relationship with the Bank will/may require the potential to share or access confidential client information must go through a series of guidelines for qualification prior to releasing information or implementing services. These procedures are in place in order to demonstrate our commitment to safeguarding confidential information while documenting due diligence. New third parties are assessed through our pre- engage ment process. The next level of engagement involves a Risk Dependency Assessment, to determine the vendor's Tier Level and a full due-diligence review of policies and independent audits of Critical Vendors as defined in policy.


text: Security Awareness and Education The Bank provides annual, mandatory, onsite training for personnel regarding security awareness to equip personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Bank's information security policies, standards, processes, and practices. Staff IT training process is monitored, tracked and reported to the IT Committee and Board of Directors. We have also employed a program of staff phishing tests with staff response evaluated and reported to the IT Committee and the Board of Directors. Incident Response Program (IRP)


text: The Bank's ability to respond to security incidents in a planned and coordinated fashion is important to the success of its information systems security program. The IRP has been developed to provide protections for both the Bank and the Bank's customers and to mitigate the negative effects of cybersecurity events or security breaches on the Bank itself. Program also identifies the Bank's Information Security Incident Response Team (ISIRT) Policy and program procedures which are tested annually.


text: A 24/7 monitored intrusion prevention system, internal intrusion detection system, and firewalls to assist in the identification of unauthorized system access is in place. Network and application security reports are reviewed by Bank personnel and used to help in the detection process.


text: Our ISO and Management Committees are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our Information Security Team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our ISO oversees the implementation of and the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the Information Security Incident Response Plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To that end, we rely on a multidisciplinary team (including from our IT function, senior management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: S enior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 18 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.


text: Cybersecurity risks are identified and processed in a Risk Register by an information security team that includes the vCISO and internal management. We conduct risk assessments, penetration testing, vulnerability scanning, receive alerts from security tools, and engage in an ongoing discussion of business processes and policy management. We use advanced tools to track governance, risk, and compliance tied to a security framework tailored from industry standards and best practices, and we test our tools and policies regularly.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.


text: Information from the risk management process is managed by the Information Security Team and is reported to the Board of Directors on a regular basis. We provide cybersecurity updates to our Audit Committee on a quarterly basis. In the case of an incident, relevant members of the Information Security Team are involved to assess and oversee incident response operations as needed, including adequate reporting of material incidents if/when appropriate.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Risk Management and Strategy We have certain processes for assessing, identifying and managing cybersecurity risks, which are included in our overall risk management program and designed to protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Cybersecurity risks are also periodically reevaluated in additional detail based on our experience and on external information regarding emerging risks. To protect our information systems from cybersecurity threats, we use various security tools, tracking procedures and investigational procedures to identify, investigate, and resolve potential security incidents in a timely manner. We also engage third-party vendors to assist with security management, incident detection and response.

companyName: Mural Oncology plc


text: We have adopted guidelines and processes, led by our information technology ("IT") department, for preventing cybersecurity incidents and for assessing and responding to such incidents should they occur. These guidelines and processes, as well as our overall cybersecurity risk management, include consideration of cybersecurity threats associated with our use of third-party service providers. We also consider the internal risk oversight programs of our third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company.


text: Our Vice President, Information Technology ("VP IT") is responsible for developing, implementing, and maintaining our processes and procedures for cybersecurity risk management and response. Our current VP IT has over thirty years of experience, which includes cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within pharmaceutical and biotechnology companies. Any cybersecurity incidents are evaluated for potential impact and are reported, as appropriate to the severity, to our management, our Information Security Committee, our executive leadership and/or our board of directors. Our Information Security Committee, which is led by our VP IT and includes representatives from our IT, finance, and legal departments, meets regularly to review the incidence, impact assessment, and resolution of cybersecurity incidents, if any, and to assess evolving risks. Our Information Security Committee provides updates on cybersecurity incidents and responses and on cybersecurity risk management as needed and provides updates to executive leadership and to our Board of Directors.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information, or collectively Information Systems and Data.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Our cybersecurity function, which comprises, in part, our Interim Chief Financial Officer and third-party service providers (including our managed security services provider, or MSSP), helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats (including third party threat assessments), using external intelligence feeds, coordinating with law enforcement regarding certain threats, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, network security controls, systems monitoring, and asset management, tracking, and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers. We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations and contract manufacturing organizations. We manage cybersecurity risks associated with our use of these providers by reviewing their conducting audits and imposing contractual obligations on the vendor to protect our information.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Interim Chief Financial Officer, who oversees outsourced IT (including cybersecurity).


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Interim Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Interim Chief Financial Officer. Our Interim Chief Financial Officer and others work with our incident response team (including our MSSP) to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting certain cyber incidents to the audit committee.


text: The audit committee receives periodic reports from our cybersecurity function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our guests, business partners, associates and other stakeholders, and the processes implemented to address the risks related to cybersecurity threats are an important part of our overall risk management efforts. More specifically, we seek to address cybersecurity risks by focusing on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program focuses on the following key areas: • Governance/Board-Level Oversight: Our Audit Committee is briefed on cybersecurity risks as a standing agenda item at each regularly scheduled quarterly meeting. The Chief Information Officer ("CIO") reports quarterly to the Audit Committee and such report typically addresses an overall assessment of our compliance with our cybersecurity policies and includes topics such as risk management and control decisions, updates on our cybersecurity roadmap and self-assessment, training results, security threats, incidents (if any) and responses, and recommendations for changes and updates to our policies and procedures. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, 24x7 monitoring by a third party security operations center, and antimalware functionality and access controls, which are periodically evaluated through vulnerability assessments and cybersecurity threat intelligence. • Business Continuity and Disaster Recovery: We have established and maintain comprehensive business continuity, incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for our associates regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our information security policies, standards, processes and practices.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are shared with executive management and, as needed, the Audit Committee and the Board. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Operational responsibility for assessing and implementing our processes and procedures related to cybersecurity risk is led by our CIO. The CIO leads a team of internal full-time associates and external consultants and vendors that manage all aspects of our risk management tools. The CIO reports directly to the Chief Administrative Officer and General Counsel ("CAO"), who manages legal and insurance coverage matters related to cybersecurity risks. Additionally, our Chief Financial Officer and relevant associates on her staff are involved in the management of cybersecurity threats in relation to our internal controls environment, and, in the event of an incident, relevant investor relations needs. Our policies and procedures provide that the Chief Executive Officer, the Audit Committee, and the Board are to be informed in a prompt, timely manner in the event of any material cybersecurity event.


text: Our CIO has Bachelor of Science degrees in Information Technology and Business Administration and Science and has served in various roles in information technology for over 30 years, including nearly 20 years in roles directly related to implementing and managing cybersecurity measures.


text: For additional information on cybersecurity risks, see the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Vroom, Inc.

ticker: VRM


text: We design and assess our program guided by a number of well-known industry standards, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001, and Center for Internet Security (CIS) Controls V8. This does not imply that we meet all of these standards, specifications, and requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Chief Technology Officer, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy— If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences. "


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Chief Technology Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security program and personnel and certain of our retained external cybersecurity consultants. She has over twenty-five years of experience in the technology industry. In addition, the Vice President of Engineering has involvement in managing cybersecurity risk and has over 30 years of experience in the technology industry.


text: Vroom's Chief Technology Officer reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Chief Technology Officer updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.


text: Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, VP of Human Resources, and Chief Technology Officer, stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company maintains a cybersecurity program to assess, identify and manage cybersecurity threat risks. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, processes, and practices, which are integrated into the Company's overall risk management process. To help protect the Company's information systems from cybersecurity threats, the Company uses various security tools and personnel that help the Company identify, escalate, investigate, resolve, and recover from security incidents.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Managing Material Risks & Integrated Overall Risk Management The Company has incorporated cybersecurity risk management within its Enterprise Risk Management framework. Led by the Company's Senior Vice President of Operations, the Company's risk management team, comprised of senior management team members, integrates the evaluation of cybersecurity risks in accordance with its business objectives, operational needs, and legal requirements.


text: Acknowledging the intricate and dynamic landscape of cybersecurity threats, the Company collaborates with external experts, such as cybersecurity assessors, consultants, and auditors, to assess and test its risk mitigation tools. The Company's engagement with these external entities encompasses routine reviews, threat assessments, and ongoing consultations to enhance the Company's security measures.


text: Prior to engagement, the Company undertakes security assessments of third-party providers that process or store confidential Company information, and monitors their activities for alignment with the Company's cybersecurity standards. This monitoring involves evaluations performed by the Company's team of security analysts, and annual review by the Company's Chief Information Security Officer ("CISO").


text: Risks from Cybersecurity Threats To date, the Company believes that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have no t materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Refer to the risk factor captioned "A failure in the Company's operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company's business, its reputation, and / or cause losses which would have a material effect on the Company's business operations and financial results" in Part I, Item 1A. "Risk Factors" for additional information on cybersecurity risks that could adversely impact the Company's business, results of operations or financial condition.


text: Management's Role Managing Risk The CISO advises the Enterprise Risk Management Committee (the "ERM Committee") of the Board of Directors on cybersecurity risks. The CISO provides the following information to the ERM Committee on a quarterly basis: • Company threat profile and emerging threats; • Status of cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: The Company conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk mitigation strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the CISO. The CISO, has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company's compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.


text: Monitoring Cybersecurity Incidents The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan ("CIRP") supported by a cross-functional cyber incident response team ("CIRT"). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompass detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.


text: Reporting to Board of Directors The ERM Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The CISO, in his capacity, informs the Chief Executive Officer, the Chief Financial Officer, the Chief Audit Executive, the Chief Information Officer, and the Legal Department of aspects related to cybersecurity risks and incidents. Furthermore, the CISO escalates significant cybersecurity matters to the ERM Committee.


text: The Board has established oversight mechanisms to govern risks associated with cybersecurity threats because they recognize the significance of these threats to the Company's operational integrity and stakeholder confidence.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology and cybersecurity functions. By fully outsourcing our IT environment and placing it within expert third-party software-as-a-service, human resource, and clinical providers our primary means of avoiding cyber risk is not having sensitive data within our enterprise. All third parties are managed by our team, and we review our vendors to ensure that they have risk management procedures in place, including physical, procedural, and technical safeguards (such as: response plans, regular tests on the systems, third-party auditing, incident simulations and routine review of appropriate policies and procedures to identify risks and refine security practices). Our Senior Director of IT Operations and Security is responsible for vendor management regarding our vendor risk experience and reports directly to our Chief Financial Officer. We track security risk as a company and review it annually at the senior management level.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. As needed, the audit committee of our board of directors (the "Board") provides oversight over cybersecurity risk and provides updates to the Board regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: To deter and detect cyber threats, we annually provide our employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting security incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: The Audit Committee receives quarterly reports from our Chief Information Officer, or CIO, on our cybersecurity risks. In addition, our CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: Cybersecurity Risk Management and Strategy The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats. Our processes include, but are not limited to, the following: • Engaging cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices; • Providing periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • Employing a variety of preventative and detective tools designed to monitor and block suspicious activity.

companyName: Velocity Financial, Inc.

ticker: VEL


text: Our Chief Information Officer (the "CIO") is primarily responsible for this cybersecurity component, reporting directly to the Chief Executive Officer, who periodically reports to our Board of Directors. To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents.


text: Cybersecurity Risk Management and Strategy We recognize the importance of maintaining the safety and security of our critical systems, information, products, services, and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Cybersecurity risks are addressed as a component of our overall enterprise risk management program. As such, our information security team works with management to prioritize our risk management processes and to mitigate those cybersecurity threats that are more likely to lead to a material impact on our business. Features of our cybersecurity risk management program include: • Periodic risk assessments designed to help identify cybersecurity risks that could materially impact our Information Systems and Data; • A security incident response team that is principally responsible for managing our cybersecurity risk assessment processes, information security controls, and response to any cybersecurity incident; • A cyber and data security incident response plan that establishes policies and procedures for identifying, managing, and recovering from a cybersecurity incident, including escalating tiers of notification depending on an incident's nature and severity; • Periodic tabletop exercises with management and other employees to discuss, prepare for, and simulate our responses to potential cybersecurity incidents; • The use of third-party service providers, as appropriate, to assess, test, and assist with aspects of our information security controls; • The use of a third-party risk management process for our service providers, suppliers, and partners; • Cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents; • Cybersecurity policies and procedures, including those governing encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices; and • Required annual privacy and cybersecurity training (including spear phishing and other awareness exercises) for employees.


text: Because the techniques used to obtain unauthorized access, disable/degrade service, or sabotage systems change frequently, we have invested and continue to invest in the security and resiliency of our systems and networks to help protect our Information Systems and Data. For a discussion of cybersecurity-related risks that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Information Technology, Cybersecurity, and Intellectual Property" section of this Report.

stage1Category: None/Other


text: Cybersecurity Governance Our Board is responsible for overseeing our overall enterprise risk management program, and each of its committees assists in this risk oversight role. Our Board has delegated the monitoring and oversight of risks relating to data privacy, technology, information security, and cybersecurity to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to the management of these risks. Our Board also receives periodic briefings from management regarding our cybersecurity risk management program, including presentations on cybersecurity topics from our CTO, our information security team, and other third-party experts.


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. It receives regular updates from our CTO and other members of management on cybersecurity trends and developments, the cybersecurity risks that are most relevant to our business, and our cybersecurity strategy, as well as other updates, as appropriate, regarding certain cybersecurity incidents.


text: A cross-functional management team, including members of our information security, technical infrastructure, engineering, and legal departments, is responsible for identifying, assessing, and managing the risks from cybersecurity threats that are relevant to our business, as well as managing our response to any cybersecurity incident (and, depending on an incident's potential nature and severity, reporting it to our Audit Committee and considering with management whether public disclosure is appropriate or required). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers, and communicates our cybersecurity risk management processes to management, our Board, and our Audit Committee. This team reports to our CTO, who has more than 15 years of experience in the technology sector, and possesses nearly 60 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics, and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager and Certified Information Systems Auditor) and ISC2 (Certified Information Systems Security Professional). This team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.


text: Governance Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and we have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.

companyName: Upstream Bio, Inc.

ticker: UPB


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats which prioritizes detection and analysis of and response to known, anticipated, or unexpected threats, effective management of security risks and resilience against cyber incidents. The Manager's cybersecurity program is aligned to the National Institute of Standards of Technology (NIST) Cybersecurity Framework. Our Manager's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risk from cybersecurity. Our Manager has implemented and continues to implement procedures to address internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations and information of our shareholders and other third parties who entrust us with their sensitive information.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of our Manager. Our Manager also has annual certification requirements for employees, including employees who provide services to us pursuant to our Management Agreement with respect to certain policies supporting the cybersecurity program including Chicago Atlantic's Information Security and Electronic Communications policy, Data Protection Policy and Privacy Policy. Our Manager undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Manager and our critical third-party vendors and other partners. Our Manager also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: Material Impact of Risks from Cybersecurity Threats As of the date of this report, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."


text: Governance and Oversight of Cybersecurity Risks Our cybersecurity program is managed by IT Manager and our IT consultant, which together, are responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by our Manager's IT Manager who has a bachelor's degree in Information Systems from Xavier University and over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures for financial services companies.


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements.


text: With respect to cybersecurity, the audit committee engages in discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, employees of our Manager and/or the IT Consultant will brief the audit committee on the Manager's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by employees of the Manager and/or the IT Consultant may include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cybersecurity threat landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: In order to inform the Audit Committee of the planning and execution of our cybersecurity program, several different reports are provided from management.

companyName: Zumiez Inc

ticker: ZUMZ


text: Overview of Cybersecurity Risk Management and Strategy Based on our business model, we rely on the outsourcing of certain key business functions, including laboratory work, clinical research, and the manufacturing and distribution of our product. We utilize the vetted processes and procedures of these partners and ensure proper cybersecurity and risk mitigation strategies are in place and functioning, which is accessed through our Vendor Risk Assessment process prior to engaging with our partners. Our cybersecurity risk identification, assessment and management response process is a critical part of our overall enterprise risk management, or ERM, program. Within our ERM framework, we adhere to our Global Information Technology Policy, or IT Policy, among a host of other policies and procedures aimed at providing guidelines and standards to ensure the security, integrity, reliability and recoverability of our systems and infrastructure.


text: We employ and manage various third-party partnerships to help protect us from cybersecurity threats. These organizations provide services such as penetration testing, security assessments, as well as 24 hours per day monitoring, alerting and response, including incident responses, all of which adhere to our overall ERM framework. Our partners evaluate and rank our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats. Our digital infrastructure undergoes both internal and external audits as part of our Sarbanes-Oxley audit process and is designed to address the requirements of applicable information security standards and an evolving cyber landscape.


text: Board Oversight of Risks from Cybersecurity Threats Our Board of Directors has delegated to the Audit Committee oversight of risks from cybersecurity threats. The management team provides quarterly reports to the Audit Committee which cover cybersecurity and other information technology-related risks, based on our ERM framework. These quarterly updates keep the Audit Committee apprised of our ongoing cybersecurity enhancements and any emerging global threats. The Audit Committee keeps the remaining Board of Directors apprised of material risks from cybersecurity threats. The Board and management have made cybersecurity education and training a part of our overall corporate objectives, setting the tone for the organization about the importance of cybersecurity.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Technology and Security team is responsible for the management, maintenance, monitoring and response of our critical internal digital assets. This team is led by our Senior Director of Global Information Technology and Security, who has 25 years of cyber and Enterprise IT management experience. This position monitors current cyber risk trends, engages with third party cyber security experts, and meets with the Infrastructure and Security team regularly to stay apprised of internal cyber risks.


text: Our internal cybersecurity testing and reporting processes allow us to rank our overall risk on a periodic basis so as to enable us to identify and respond to internal risk trends. Further, we follow escalation procedures to support the communication of cyber-related events.


text: As of the date of this report, we do not believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition for the reporting period covered by this report. For information regarding cybersecurity risks, see our discussion above in Item 1A. Risk Factors - Risks Related to Our Business - Our internal computer systems, or those of our third party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our commercial, research and development and other programs.


text: Cyber Risk Management and Strategy We have adopted processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cybersecurity threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and periodic review of our procedures in an effort to identify risks and refine our practices. To support our internal resources, we leverage external tools and resources, including a managed service provider that provides ongoing support for the protection of our information technology infrastructure.


text: We have an employee security awareness program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions. As part of this employee training program, we periodically conduct phishing tests. We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems including, as appropriate, through the inclusion of cybersecurity requirements in our contracts.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors–Risks related to our dependence on third parties–Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business."


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our Senior Manager of Information Technology reports to our Chief Financial and Operating Officer and oversees the day-to-day implementation and management of our cybersecurity program. Our Senior Manager of Information Technology has approximately 20 years of experience in information technology and regularly reports to executive management, the company's disclosure committee, and the Audit Committee on cyber matters, as appropriate.


text: Risk Management and Strategy Peapack Private Bank & Trust's risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology, our expansion of Internet and mobile banking tools, an increased level of employees working remotely and the potential of cyber threats. Peapack Private's Information Security Officer is primarily responsible for cybersecurity and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Information Technology Steering Committee and Peapack Private's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse Peapack Private systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage information from certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Bank's Information Security Officer and Chief Information Officer, who reports directly to the Chief Operating Officer, along with other key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of the Bank's efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and the Bank's supply chain. We also actively monitor our email gateways for malicious phishing e-mail campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to the Bank's information security program, to assess their design and operating effectiveness and make recommendations to strengthen the Bank's risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Bank's Information Technology Steering Committee as well as the board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of the Bank's organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. The Bank's internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition.


text: Peapack Private's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.


text: In addition, our Chief Information Officer supports our company by staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: The Bank's board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology and cyber-related business impact. This committee provides oversight and governance of the technology program and the information security program. The committee is chaired by managers within the enterprise information technology department and include the Chief Information Officer, Chief Technology Officer, and Information Security Officer. The committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Bank's board of directors.


text: The Bank's board of directors are responsible for overseeing Peapack Private's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Bank's Information Security Officer, Chief Information Officer, and Chief Technology Officer provide reports to the Bank's board of directors regarding the information security program, technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security program, technology budgets, and strategies annually.


text: Risk Management and Strategy We support a risk-based cybersecurity program with control alignment to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The core functions of the program are designed to manage cyber-related risks and strengthen the overall cybersecurity posture of our organization.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: Annual external cybersecurity and compliance assessments are conducted for the identification, prioritization, and remediation of cyber-related risks to the company's information systems and data. Ongoing internal risk assessments are conducted to ensure protective and detective security controls perform as expected.


text: To mitigate identified cyber-related risks to our organization, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes that includes: • Security Controls: We have implemented industry-standard security controls aligned with the NIST CSF framework such as identity and access control, multi-factor authentication, encryption, and data protection measures. • Security Awareness: We conduct regular cybersecurity awareness training to educate employees about potential threats and best practices for safeguarding company assets and data. In addition, we conduct periodic phishing tests to enhance our security awareness program. • Third-Party Oversight: We evaluate third-party partners' cybersecurity practices through due diligence assessments and contractual obligations. Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. • Continuous Monitoring: We have partnered with a third-party Managed Security Services Provider to provide event logging, monitoring for detection of cybersecurity events, and assistance with investigations into possible cyber-related events, as well as assessment and consultation on security enhancements. • Business Resiliency: We have developed emergency response, business continuity, and disaster recovery plans to respond to a widespread disruption to business operations. • Continuous Improvement: Any previous cybersecurity incidents, whether material or not, have resulted in improvements in the company's cybersecurity program, policies, or technical controls, where applicable.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect our company, including our business strategy, results of operations or financial condition. We and our third-party partners have frequently been the target of cybersecurity threats and expect them to continue. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors - Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, unauthorized access to customer data, or harm to our reputation" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management team. We have established a cybersecurity governance framework that encompasses policies, procedures, and controls designed to support cybersecurity risk management practices. Our Senior Information Systems Administrator is responsible for assessing and managing material risks from cybersecurity threats. This position reports directly to our Senior Vice President of Business Transformation. In addition, we have retained Virtual Chief Information Security Officer services to support our cybersecurity risk management and governance practices. Such individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our Managed Security Services Provider and our Board of Directors on any appropriate items. Our Board of Directors oversees the cybersecurity program and receives program metrics as well as information related to identified cyber-related risks when meeting with the company's management.


text: While we continuously invest in cybersecurity controls, we acknowledge the possibility of cybersecurity incidents despite our efforts. These incidents may include unauthorized access, data breaches, ransomware attacks, and service disruptions. We have contracted with a cyber insurance provider, Incident Response provider, and a Managed Security Services Provider to minimize the impact of such events and support prompt detection, containment, and recovery measures.


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our customers and other stakeholders, as a top priority. Our board of directors (in particular our audit committee) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas:collaboration, risk assessment, technical safeguards, incident response and recovery planning, third-party risk management, education and awareness, and governance.


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, and make recommendations to improve processes. Our board of directors and members of management, as appropriate, are presented with any updates we make due to our risk assessment.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our response to a cybersecurity incident.


text: Third-Party Risk Management We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Our board of directors delegated to our audit committee oversight of cybersecurity and other information technology ("IT") risks. Our audit committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the audit committee as necessary regarding any significant cybersecurity incidents.


text: Our IT team, led by our Chief Information Officer, is responsible for assessing and managing our significant risks from cybersecurity threats and has primary responsibility for our risk management process and overall cybersecurity risk management program. This team includes in-house personnel devoted to these efforts, as well as a third-party IT firm, and they collectively have extensive knowledge of the technologies and applications we have adopted to address our cybersecurity risk.


text: Risk Management and Strategy Based on the complex and continuously evolving cybersecurity threat landscape, we established, manage and continually enhance an enterprise-wide Information Security Program ("ISP"). The ISP is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The CSF provides guidance for organizations to better manage and reduce cybersecurity risk while helping organizations understand, assess, prioritize, and communicate cybersecurity risks and mitigation. The ISP encompasses critical management components such as risk management, asset management, access controls, cyber awareness training, data security, detection and response, incident response, and business continuity.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: The ISP, which is part of our Enterprise Risk Management Program, is organized in an operating framework that is supported by policies, standards, procedures, and guidelines that establish the information security control environment. The Information Security team collaborates with additional areas of our Enterprise Risk Management Program to ensure comprehensive risk oversight and reporting. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with its policies, controls, and regulatory requirements.


text: The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets. Recent investments have ensured the use of innovative technology and services with best-in-class providers.


text: We have a Third-Party Risk Management ("TPRM") Program that includes the comprehensive evaluation of the cybersecurity risks of prospective and existing third-party relationships. The TPRM Program utilizes a risk-based approach to perform third-party onboarding and ongoing due diligence reviews of existing third-party relationships. Third-party risks are identified and evaluated in coordination with period reviews, although threat intelligence monitoring and sound vendor relationships are leveraged to identify third-party risks as announced. TPRM is a function of our Risk Organization overseen by our Chief Risk Officer ("CRO").


text: We have not experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.


text: We have established a dedicated team to manage and execute the ISP. A Chief Information Security Officer ("CISO") has been appointed as a Senior Vice President of the Company. The CISO leads the strategy and execution of the program while ensuring clear lines of communication with executive management, committees, the Board of Directors, and external stakeholders such as regulators and insurance carriers. Our present CISO, Scott Bader, was appointed in August 2023 after serving the Company as a senior officer and technology leader for over 15 years and leads a team of Information Security professionals with diverse security backgrounds including relevant certifications (e.g., CISSP, GSEC, GCTI). As a member of our risk organization, the CISO reports to the CRO, who is a member of the Executive Management Committee. Our CRO, Gary Pacos, joined the Company in February 2023 with over 30 years of progressive risk management experience.


text: The Company Risk Committee ("CRC") serves as the management committee responsible for Information Security oversight and the CISO is a member of the committee. The Risk Oversight Committee ("ROC") is a sub-committee of the Board of Directors (the "Board") and provides direct oversight of Information Security on behalf of the Board. Director Kim E. VanGelder, the current Chair of the ROC, has served as a member of our Board since 2016, and has held progressive information technology leadership roles at the Eastman Kodak Company, with responsibilities including cybersecurity, global applications, and global technology infrastructure, and has served as its Chief Information Officer since 2004.


text: The CISO reports on the status of the ISP including relevant risks, cybersecurity threats, program updates, and program reporting to the CRC and the ROC no less than four times per year. Any material cybersecurity information, including strategic program development, is reported by the CISO to appropriate management and Board representatives to ensure timely awareness and escalation as necessary. Should there be a cybersecurity incident, we have a formal Incident Response plan including escalation processes designed to keep relevant management and committees informed of the mitigation and remediation efforts. The identification of incidents may come through internal monitoring and detection resources, external threat intelligence, third-party risk management efforts or various other event escalation methods. We leverage a Managed Security Services Provider ("MSSP") for supplemental expertise and resources with the management and enhancement of critical threat monitoring solutions. The MSSP also provides industry-leading Security Operations Center services that serve as a critical source for event and incident detection.


text: The Board is actively engaged in the oversight and prudent management of risk, including those relating to cybersecurity and regulatory compliance. A comprehensive program update is delivered to the Board annually by the CISO. The Board annually reviews and approves the ISP and related Information Security policies to ensure alignment with the Company's risk appetite and strategic defense amidst the evolving cybersecurity risk landscape.


text: Key elements of our cybersecurity risk management program include: • overall risk assessment; • a technology team leveraging a third-party Security Operations Center (SOC) partner to monitor, manage and respond to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and regular phishing campaigns; • a cybersecurity incident response policy that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: CARGO Therapeutics, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks related to our business—Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including the Vice President of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats. The Vice President of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of experience leading technology management functions within biotech companies as well as interacting with the Board. Specifically, the Vice President of IT has been leading IT, compliance and security in various biotech companies including presenting and delivering cybersecurity roadmaps and risk management to executive teams and boards.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Allakos Inc.