text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: Cybersecurity Governance While our board of directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.

companyName: Fortress Biotech, Inc.

ticker: FBIO

secItem: Item 1C


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.

stage1Category: Management Role

stage1Method: unanimous


text: Orchestra BioMed, ("Orchestra" or "Company") maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology environment including systems, hardware, software, data, people, and processes.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Cybersecurity Risk Management The underlying processes and controls of cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Orchestra has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: Board Governance and Management Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy," above.

companyName: Traws Pharma, Inc.

ticker: TRAW

stage1Method: majority


text: In addition, Orchestra maintains policies over areas such as information security, IT change and configuration management, acceptable use, access on/offboarding, and data backup and recovery to help govern the processes put in place by management designed to protect Orchestra's IT assets, data, and services from threats and vulnerabilities. Orchestra partners with industry recognized cybersecurity providers leveraging third-party technology and expertise. Cybersecurity partners to the Company, including consultants and other third-party service providers, are a key part of Orchestra's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability testing, identity access management controls, including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and traffic monitoring and automated alerting, ongoing cybersecurity user awareness training, remote monitoring and management, capacity management, industry-standard encryption protocols, formalized processes over asset and data destruction, formalized change management processes, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, and assessment. In the event of an incident, the Cyber Risk Committee would be notified and appropriate action would be taken to resolve the incident, including notifying senior management and, as appropriate, the Board.


text: Orchestra has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls and security standards of vendors, compliance with service level agreements, review of SOC 1 reports on an annual basis and a regular review of vendor contracts.


text: Orchestra's Cyber Risk Committee, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of Orchestra's cyber risk management program, and for informing senior management, the Board, and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes via selection of strategic third-party partners (such as the Company's virtual Chief Information Security Officer), and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Orchestra for strategic cyber risk management, advisory and decision making.


text: The Audit Committee of the Board of Directors oversees Orchestra's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Members of the Cyber Risk Committee brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Orchestra's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes reporting cybersecurity incidents and updates on Orchestra's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by Orchestra's Board of Directors, at least annually, as part of the Company's corporate risk oversight processes.


text: Orchestra faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Orchestra acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Orchestra's business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the Company's service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See "Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations" in Item 1A (Risk Factors) for more information on cybersecurity risks.


text: Risk Management and Strategy Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to protect, detect, monitor, mitigate and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our audit committee or board of directors to discuss if deemed necessary or appropriate. We also alert employees to significant new cybersecurity issues on a regular basis.

stage1Category: Risk Management Process


text: We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. We do not currently have a formal process in place for evaluating or reviewing third party vendor cybersecurity risks and procedures and rely on such third parties to implement adequate protectionary and detection measures.

stage1Category: Third-Party Risk


text: The audit committee assists the board of directors by overseeing the steps management has taken to monitor and mitigate cybersecurity threats and risks. The audit committee receives reports annually from management on our cybersecurity strategy and program. Significant changes are reported to the audit committee from time to time. Cybersecurity incidents which are determined by management to be material will be reported immediately to the audit committee.

stage1Category: Board Governance


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for us to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. See "Part I —Item 1A. Risk Factors" for further discussion of these risks.


text: Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion. Our internal auditors perform audit engagements to assess our strategies, policies, procedures, and controls to reduce the risk of a cybersecurity incident.

companyName: BATTALION OIL CORP

ticker: BATL


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. With the assistance and advice of our expert consultants, responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our Director of Information Technology, who reports to our Chief Executive Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into our compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee of the Board having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cybersecurity, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.


text: In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The Audit Committee receives periodic reports from Company management regarding cybersecurity risk factors.


text: The Board routinely receives information and updates from Company management and the Audit Committee with respect to the effectiveness of the Company's information systems' security framework, which may include cybersecurity assessments, risk management, and mitigation measures. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts.


text: We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A. Risk Factors above.

stage1Category: Strategy Integration


text: RISK MANAGEMENT AND STRATEGY Securing Kroger's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our stakeholders. We have adopted enterprise cybersecurity risk mitigation and governance processes, which are set forth in the Kroger Cybersecurity Risk Management program ("CRM"), the Kroger Third-Party Cybersecurity Risk Management ("TPCRM") program and the Kroger Cyber Incident Response Plan ("IR Plan"). Our approach is guided by the principles of the CRM, which includes monitoring threats and vulnerabilities and assessing and monitoring related controls, supporting the Corporate Information Security function, the Chief Information Security Officer ("CISO") and Chief Digital Officer ("CDO"). Kroger's cybersecurity policies, standards, processes, and practices are integrated into our overarching risk management system in an effort to enhance our ability to safeguard our operations and information, which includes quarterly cybersecurity reporting to the Board, delivered by senior leadership.

companyName: KROGER CO

ticker: KR


text: Information sharing and collaboration – We utilize threat intelligence and security information collected from various sources, including but not limited to partners, suppliers, governments and information sharing and analysis centers, to identify, protect against, detect and respond to potential cybersecurity threats and events.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Kroger Cyber Risk Management Program The CRM was developed in collaboration with third-party consultants and is aligned with the National Institute of Standards and Technology ("NIST"), Risk Management Framework ("RMF"), Cybersecurity Framework ("CSF") and the International Organization for Standardization 27001 ("ISO 27001"). The program includes security and privacy, risk-based controls, and incorporates lessons learned from cybersecurity incidents. Under Kroger's CRM, cyber risks, including cyber threats and cyber events/incidents, are assessed, treated, and monitored on a continuous basis. We integrate lessons learned from incident response and cyber risk mitigation into our cyber risk management strategy, in an effort to improve overall cybersecurity on an ongoing basis. Kroger's CRM program is spearheaded by specific management positions, chosen for their expertise in the field as further discussed below.


text: In line with cyber risk management best practices, we have collaborated with recognized third-party experts as needed to align the CRM's foundational processes, metrics, monitoring, and reporting with common frameworks such as the NIST RMF and the NIST CSF.


text: Third-Party Cyber Risk Management Recognizing the potential vulnerabilities posed by third-party relationships, Kroger has implemented a comprehensive TPCRM program. The TPCRM program is designed to assess third-party cybersecurity risks by employing third-party cyber risk assessments, vendor tiering, and a dedicated team tasked with recommending holistic improvements to strengthen Kroger's cybersecurity posture, sourcing, and contracting processes. Kroger's Information Security Operations Center ("iSOC") responds to known third-party incidents on a continuous basis. The iSOC is a part of the Corporate Information Security ("CIS") department and is responsible for detecting, responding to, and escalating security incidents. We partner directly with business stakeholders and technology custodians to determine an appropriate response to manage incident risk to minimize the effect to the business. This response process is a regular and critical function of the iSOC and is defined in a separate appendix to the IR Plan. Any material risk identified from these incidents is escalated and communicated using formal severity and impact criteria as defined in the IR Plan.


text: Kroger Cyber Incident Response Plan The IR Plan documents the processes by which information security events are detected, identified, prioritized, and analyzed. The Kroger iSOC, CISO, legal counsel, and corporate affairs stakeholders are then engaged depending on the incident's scope, business effect, and potential material risk. This cross-functional team is responsible for assessing an appropriate response and mitigation pathway. Once security events are identified through the enterprise detection and monitoring ecosystem, the IR Plan sets forth an incident prioritization/decision workflow to determine scope, business effect, and potential material risk. This workflow is implemented through collaboration with the iSOC, CISO, legal counsel, and corporate affairs stakeholders and correlates to industry standard severity levels. In addition to the processes outlined above, we have also implemented an information security training program for employees that includes security awareness training related to cyber security risks, simulated phishing emails and regular communication to the enterprise regarding cyber security risks.


text: We experience cybersecurity threats and incidents from time to time. We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, our financial condition, results of operations or cash flows, and we have not experienced a cybersecurity threat or incident that has materially affected Kroger in at least the last three years. There can be no assurance that cybersecurity threats will not have a material effect on us, including our business strategy, our financial condition, results of operations or cash flows. Please see "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Protection of our customers' data is a fundamental priority for our Board and management team. Our risk management team is integrated into our CIS function and is led by our CDO and CISO. The risk management team reports to the CISO and has combined experience in information security, governance, and compliance, including domains such as engineering, architecture, cybersecurity, and privacy. This team is responsible for defining the program, cybersecurity governance, and gathering insights related to assessing, identifying, and managing cybersecurity threat risks, their severity, and mitigations.


text: Kroger's CDO reports to the CEO and leads technology and digital capabilities for the Kroger Co., including the overall cybersecurity strategy. Kroger's CDO has over 20 years of both leading and transforming technology, digital growth, and e-commerce in the retail and food industry. He graduated with a master's degree in business administration and management from Ecole Sup rieure de Commerce de Chamb ry, Rh ne-Alpes, France. Kroger's interim CISO brings nearly 20 years of experience developing and leading security and risk programs. His experience includes governance, information security, and threat management. He graduated from Miami University with a bachelor's degree in management information systems and marketing.


text: We have adopted an Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third-party vendor on retainer to assist in such incidents.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: The Audit Committee of Kroger's Board of Directors is charged with oversight of data privacy and cybersecurity risks. Kroger's CDO and CISO provide quarterly updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full Board at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the Board on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CDO and CISO discuss and present strategies to address geopolitical threats that may affect operations as well as technological changes, such as AI and quantum computing. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. An independent third party also regularly reports to the Audit Committee and the full Board on cybersecurity, and outside counsel advises the Board on best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.


text: Risk Management and Strategy In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STARTENGINE CROWDFUNDING, INC.


text: Our Board has oversight of our strategic and business risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our Board also oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.


text: Risk Management and Strategy Managing cybersecurity risks is an important component of our approach to enterprise risk management. As part of our overall risk management system, we have established certain procedures to assess, identify, mitigate and respond to risks from cybersecurity threats. We have regular programs to evaluate cybersecurity threats and to assess our systems, procedures and processes in order to identify areas of potential vulnerability and to improve our protection against evolving cybersecurity threats. We use the Center for Internet Security's Critical Security Controls framework in our regular assessment of cybersecurity risks with respect to our information systems, including vulnerability management, access controls, infrastructure hardening, employee training and evaluation of external threats, including in connection with potential data breaches, ransomware and other forms of unauthorized access.

companyName: RH

ticker: RH


text: As part of our overall cybersecurity protection program, we have created a cross-functional cybersecurity team consisting of senior members of information technology, legal, accounting, internal audit and compliance teams (the "Incident Response Team") that contributes to various aspects of our approach to managing cybersecurity risks. Our senior information technology leaders who are members of the Incident Response Team have experience and domain expertise in cybersecurity, including defining and implementing security policies and tools, understanding and evaluating relevant threats to our technology infrastructure as well as developing incident response protocols and security operations workflows. We also incorporate third-party expertise in various aspects of our cybersecurity program, including in the assessment and testing of weaknesses as well as the adoption of software and other solutions to mitigate risks and identify and respond to threats. Our Incident Response Team is involved in all aspects of our program to address cybersecurity matters, including with respect to the design and management of internal controls and procedures governing these matters.


text: Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Incident Response Team. Our information technology team has overall responsibility for our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our Board of Directors on cybersecurity matters. From a governance perspective, (i) we have an executive response team consisting of various senior executives, including our Chief Financial Officer, as well as members of our Incident Response Team (the "Executive Response Team") that oversees the recommendations, actions and responses of the Incident Response Team in connection with specific cybersecurity incidents, and (ii) the Audit Committee as well as our Chief Executive Officer are provided with updates from the Executive Response Team and the Incident Response Team regarding incidents as well as the policies, standards, processes and practices that we implement to address risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity matters that address a wide range of topics, including recent developments, evolving standards, vulnerability assessments and third-party reviews.


text: Risk Management and Strategy The Company has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into its overall risk management systems and processes. The Company routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through its information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: Incident Response We have a written information security incident response plan (the "Incident Response Plan") that we use to assist in our response to cybersecurity incidents. The Incident Response Plan provides a framework and process for our Incident Response Team. While our Incident Response Team identifies our initial response to potential or actual cybersecurity incidents, the Executive Response Team oversees the actions and recommendations of the Incident Response Team in connection with specific cybersecurity events. In addition, we have various processes to escalate matters based upon the threat level severity. The Incident Response Team and Executive Response Team (i) make ongoing assessments of the severity of incidents, (ii) escalate these matters based upon the severity of the threat level, (iii) depending on the level of severity of an incident, also involve our Chief Executive Officer or Audit Committee and Board of Directors in assessing specific cybersecurity incidents, (iv) determine the appropriate level of response to specific incidents taking into account the nature of the incident, and (v) take overall responsibility for leading and coordinating response efforts, involving additional response team participants and retaining third-party assistance, including legal counsel and other third-party cybersecurity experts, and assessing materiality of an incident.


text: Threat Mitigation While we engage in numerous efforts to protect ourselves from cybersecurity risks, we do periodically experience cybersecurity incidents. To date we have not experienced any cybersecurity threat or incident that has materially affected our business, results of operations or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats that are constantly evolving over time, there is no guarantee that we, including our business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.


text: For further discussion of our risks related to cybersecurity, refer to Item 1A—Risk Factors—Material damage to, or interruptions in, information systems as a result of external factors, staffing shortages, cybersecurity breaches or cyber fraud, or difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations, and we may be exposed to risks and costs associated with protecting the integrity and security of our customers' information.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.


text: Primary responsibility for executing our cybersecurity program rests with our Vice President of Corporate Strategy and Planning, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of related work experience. The Vice President of Corporate Strategy and Planning is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Executive Officer. The Vice President of Corporate Strategy and Planning at times attends meetings of the Board to report on any material developments to our risk management practices, including our cybersecurity program.


text: The Vice President of Corporate Strategy and Planning meets regularly with members of our Information Technology team, whose responsibilities are dedicated solely to cybersecurity matters. On a quarterly basis, we hold Information Technology Steering Committee meetings, which are attended by our Information Technology team, Chief Executive Officer and Chief Financial Officer, where we discuss the risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Our Information Technology team also works with our Vice President – General Counsel to oversee compliance with legal, regulatory and contractual cybersecurity requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our Information Technology team. We regularly conduct vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has the primary responsibility to oversee cybersecurity matters. The Board periodically reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board receives reports from the members of our management team responsible for executing our cybersecurity program, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board discusses with such members of our management team our information technology systems and procedures on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We rely on third-party information technology vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our own and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions or statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us nor are they reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the trust and confidence of business partners, employees and patients, toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the UK governments' National Cyber Security Centre and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments' National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: The Company conducts periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor heading " Security incidents, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability " which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any cyber security incident.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer. Our Chief Financial Officer has been responsible for our IT functions for 20 years and has managed the IT function of companies generally for the last 35 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.


text: Risk Management and Strategy Our third party Information and Technology service providers manages the Company's security program, which is focused on assessing, identifying, and managing cyber risk and information security threats. Our management team, including our Chief Executive Officer and Chief Financial Officer, evaluates cybersecurity on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and board of directors, described below under "Governance."

companyName: Vyome Holdings, Inc

ticker: HIND


text: To proactively manage cybersecurity risk in our organization, our management team has instituted a security policy that is available to all employees.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process. We are not aware of any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition as of the date of this Annual Report on Form 10-K.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Executive Officer or Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings.


text: One of the key functions of the Board is informed oversight of the risk management process, including risks from cybersecurity threats. The Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect it or its business strategy, results of operations, or financial condition. For more information regarding the expertise of the Board as it relates to cybersecurity, see the section entitled "Governance" in the Company's definitive proxy statement relating to the 2024 Annual Meeting of Stockholders filed with the SEC on April 29, 2024.


text: Gold Resource Corporation Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks. As part of the overall risk management system, the Company monitors and tests safeguards and trains employees on these safeguards. Personnel at all levels and departments are made aware of the cybersecurity policies through trainings.


text: Cybersecurity Threats As of December 31, 2024, the Company has not identified an indication of a cybersecurity incident that would have a material impact on the Company's business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: Glen Burnie Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Senior Vice President, Director of Information Technology. In addition, the Internal Auditor, Information Security Officer, and Compliance Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: The Senior Vice President of Information Technology ("IT") works with the Managed Service Provider (MSP) information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, standards, and architecture processes. The Director of IT is responsible for the IT-related security policies. The Director of IT, in coordination with compliance, the information security officer, and human resources, conducts at least annual and ongoing company-wide information security awareness training. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the Director of IT, vendor management team and the business department head assessing cybersecurity robustness during vendor review before onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Senior Vice President, Director of IT and the Information Security Officer on Glen Burnie Bancorp's cyber risks and threats, the status of projects to strengthen Glen Burnie Bancorp's information security systems, assessments of Glen Burnie Bancorp's security program, and the emerging threat landscape. Additionally, the Information Technology Committee drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. Glen Burnie Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Information Technology Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Information Technology Committee and Board of Directors.


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors (the "Board"), primarily through its audit committee of the Board (the "Audit Committee"). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Our Board of Director's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks. The Board conducts its risk oversight by receiving reports from our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report on Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors, "We are reliant on information technology systems and may be subject to damaging cyber-attacks or security breaches" and "We are subject to data privacy laws, rules and regulations and any non-compliance with such laws, rules and regulations, could adversely affect our business, financial condition and operating results" in this Annual Report on Form 10-K.


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Head of Information Technology ("Head of IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.


text: Under the oversight of the Audit Committee, and as directed by the Head of IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.


text: The Head of IT brings over a decade of extensive experience in global technology organizations spanning various industries. With a background encompassing more than a decade of expertise in information security, risk management, and compliance, The Head of IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as the Health Insurance Portability and Accountability Act and The Telephone Consumer Protection Act. The Head of IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training and has the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. The IRT Security Officer enhances the Company's cybersecurity posture and readiness with expertise in threat detection, incident coordination, and remediation.


text: All dollar amounts expressed in thousands, except per share amounts The Head of IT oversees the Company's cybersecurity incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Head of IT also coordinates with the Company's General Counsel and interim Chief Financial Officer (the "Interim CFO") to assess and manage material risks from cybersecurity threats. The Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO, Head of IT, General Counsel, Corporate Controller, and IRT Security Officer.


text: The Head of IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO regarding cybersecurity disclosures in public filings. The Head of IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.


text: Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues which may arise in the most timely and aggressive fashion.

companyName: UR-ENERGY INC

ticker: URG


text: Risk Management and Strategy Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks.

companyName: Citi Trends Inc

ticker: CTRN


text: As potential new threats to security are identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our IT Manager and expert consultants who report to our Chief Financial Officer. Our Chief Financial Officer has relevant expertise gained from nearly 20 years' experience overseeing our information technology matters, including cybersecurity concerns. With respect to cybersecurity, our consultants support our risk assessment and scoring, securing devices and networks, vulnerability management, proactive monitoring, responding to cyber threats and more. They act as our security operations center, as well as a seamless extension of our IT department.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and HSE & Technical Committee of the Board each having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the HSE & Technical Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.


text: Members of our Board each have a practical understanding of information systems, and the technology used in our business operations, as well as a recognition of the risk management aspect of cyber risks and cybersecurity; members of the Board are encouraged to review materials on these issues or attend informational sessions. The HSE & Technical Committee and/or the full Board receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. Management and our Board recognize that this is an evolving environment and therefore our analyses of the risks and risk management are also evolving. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.


text: Cybersecurity Risk Management and Strategy We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Certain cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party computer support firm to assist with network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: Since July 2021, we have no knowledge of any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our third-party CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our current or future therapeutic candidates' development programs," and "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," for additional discussion about cybersecurity-related risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes. Our Chief Financial Officer is the primary person in our company responsible for overseeing the cybersecurity risk management program. He has had oversight of our cybersecurity and risk management programs since the second half of 2021. This is not a full-time function for our Chief Financial Officer and because he is not an experienced computer professional, he relies to a large degree on our outside information technology, or IT, support firm. He is also immediately alerted of any cybersecurity breaches that occurs by our third-party vendors or by others so that appropriate measures may be taken timely.


text: We designed a multi-faceted risk-management approach based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and informed by other industry standards and industry-recognized practices to identify and address cybersecurity risks. Our key cybersecurity processes include the following:


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.


text: We provide routine awareness training for associates regarding cybersecurity best practices and their role in protecting the Company from cybersecurity attacks and testing to measure the effectiveness of our information security program.


text: We have not experienced any material cybersecurity incidents in fiscal 2024, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Management's Role Management is responsible for implementing our cybersecurity program on an ongoing basis to identify, assess and manage cybersecurity risks. Our cybersecurity program is led by our Vice President of Information Systems with support from our Senior Manager of IT Security & Compliance and various other team members. Our Vice President of Information Systems has over 25 years of industry experience, including more than 10 years as the leader of the Company's technology function. On a bi-annual basis, or more frequently as needed, management informs the audit committee of material aspects of our cybersecurity program, including updates on key strategic and operational goals, assessments of cybersecurity risks, updates to any incidents, and the status of our ongoing investments in cybersecurity governance.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Our audit committee oversees management's policies, programs and procedures related to cybersecurity risk management and reports to the board regarding these efforts. In addition, the audit committee receives briefings from management bi-annually, or more frequently as needed, on material aspects of our cybersecurity program.


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's focus, financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management policy intended to protect the confidentiality, integrity and availability of our critical systems and information. Our policy establishes the framework for managing cybersecurity risks and outlines the measures and protocols to protect our information systems. Our risk management and strategy is managed by our third-party IT Management Service Provider, Network Center, Inc. ("Network Center") with oversight by our VP of Operations. Our policy applies to all employees, contractors, and all third-party partners who have access to our information systems. Our cybersecurity risk management policy is integrated into our overall enterprise risk management processes.

companyName: Lodging Fund REIT III, Inc.


text: Our risk management policy includes continual monitoring by Network Center, as they manage our technical defenses. Risk assessments and penetration testing are performed on a quarterly basis to identify and mitigate potential threats. Procedures have been implemented for identifying, evaluating and addressing vulnerabilities. Additionally, vulnerability assessments are performed monthly by Network Center. An additional part of our risk management strategy is having a clear process for reporting cybersecurity incidents and the development and maintenance of an incident response plan to address and mitigate the impact of cybersecurity incidents.


text: A key component of our risk management and strategy surrounds data protection. We have implemented strict access controls for each individual employee to ensure only authorized personnel can access sensitive and confidential data. All digital communication is pre-screened for potentially malicious actions through a dedicated email security provider. For additional protection, we have implemented multi-factor authentication along with email encryption to ensure data is protected while at rest and in transit. We are also protected through a multilayered approach to security through the ESET Protection Platform, which provides formidable defense through cyber threat prevention, detection and response.


text: In addition, we provide regular cybersecurity training to all employees on a quarterly basis and conduct ongoing awareness programs to keep employees informed about cybersecurity best practices. Employees have been trained, enabling them to detect and report on any malicious intrusions or social engineering attempts to infiltrate our systems. They are also regularly trained, tested and reported on through KnowB4 spear-phishing email campaigns to ensure our training is effective. We are fully insured for cyber risk through our insurance provider.


text: Our board of directors is responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On an annual basis, management receives a report from Operations Management on our cybersecurity threat risk, management processes, and strategies. In addition to annual meetings, our board of directors, management and Audit Committee are notified of any cybersecurity incident, its threat level and the response. The threat level and response are evaluated and documented in a report by Operations leadership and our IT Services Provider. Based on our board of directors and Audit Committee review of the incident report, they determine if the findings require disclosure to the SEC.


text: Our cyber security policies and procedures are reviewed and updated annually or as needed to address any emerging threats and changes in regulatory requirements.


text: To date, there have been no confirmed cyber security breaches, unauthorized intrusions or threats detected within our mainframe operating systems, our encrypted e-mail servers, or our advanced firewall protections, and we have not identified risks from known cybersecurity threats, that have materially affected or that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors – We and our hotel managers and franchisors rely on information technology in our operations, and any material failure, inadequacy, interruption, cyber-attack or security failure of that technology could harm our business."


text: Cybersecurity Risk Management and Strategy The Bank's information security program is designed to protect sensitive, confidential, and non-public personal information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public personal information, financial data, and internal operational information. Our Chief Information Officer ("CIO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: Primis Financial Corp.

ticker: FRST


text: The Bank's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products, and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.


text: The Bank's Network Team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Network Team also actively monitors the Bank's networks and systems to detect suspicious or malicious events, and contracts with third-party consultants to perform penetration testing and routine vulnerability scans. A third-party managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.


text: We maintain policies and procedures for the safe storage, handling, and secure disposal of customer and employee information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could place sensitive customer or employee information at risk. We employ a number of technical controls to mitigate the risk of phishing emails targeting employees.


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, infrastructure, applications, data and cloud solutions and the data that our customers entrust to us.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CIO who closely coordinates with the Bank's Information Technology team. The Incident Response Plan describes the Bank's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Bank's Executive Management, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), and the Board of Directors. We regularly test the Incident Response Plan, including through tabletop exercises, and document lessons learned. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents.


text: The Bank conducts due diligence prior to engaging third-party service providers which have access to the Bank's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Bank's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Primis conducts ongoing monitor of third-party service providers/vendors on a risk-based approach.


text: We continue to optimize our business continuity and disaster recovery plans aligned to the pervasive nature of cybersecurity incidents and threats. We also increased our cyber insurance which aligned to strengthen our internal systems. While the Bank has encountered, and will continue to encounter, cyber incidents in the normal course of business, to date, the Bank has not experienced a cybersecurity incident that has materially impacted our business strategy, financial condition, or results of operation. Despite our ongoing efforts to continually strengthen our cybersecurity program, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in safeguarding our systems and information. We face risks from certain cybersecurity threats that, if realized, could reasonably be expected to materially affect our business strategy, financial condition, or results of operation. See "Item 1A. Risk Factors – Operational Risks" in this 10-K for additional information.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing the Bank's business and affairs, including risks associated with cybersecurity threats. The ERM Committee ("ERMC") of the Board has primary responsibility for overseeing the Bank's comprehensive ERM program, including its cybersecurity program. The ERM program assists the Executive Management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both Audit Committee ("AC") and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CIO. The CIO attends ERMC meetings and provides cybersecurity updates to these Board committees on a quarterly basis. Our CRO, in conjunction with our CIO, facilitates the involvement of the ERMC in oversight of potentially significant cybersecurity incidents.


text: The Bank's CIO directs the Bank's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CIO manages the Bank's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CIO is also responsible for the Bank's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CIO, the Network Team examines risks to the Bank's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. Our CIO has worked in the financial services industry for over 20 years and held similar roles at other financial institutions including four years as a Chief Information Officer. Our CRO has over three decades of experience in risk management, and our Network Team collectively has over 19 years of experience in cybersecurity operations.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our policies over areas such as information security, access on/offboarding, and access and account management help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team;

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Scorpius Holdings' management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries, as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT

stage1Category: None/Other


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Financial Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.


text: Under the oversight of the Audit Committee, our management and the INFOSEC team have established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. We continually evaluate our information technology systems to identify new and monitor existing cybersecurity risks based on observed activity on the systems. We evaluate the nature and severity of identified risks, and whether changes to the system are necessary. We perform annual cybersecurity training for all employees with access to our systems and conduct regular test phishing campaigns. We engage a third-party to assist in monitoring, preventing and detecting potential cybersecurity vulnerabilities and incidents, including performing scans of our information technology systems and penetration testing. We use the results of the various tests to inform our response plan, update our systems, and train employees.


text: Cybersecurity incident response plan and testing – We have a global incident response process and dedicated teams responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, periodically testing our processes and protocols, and regularly communicating and providing reports to our CISO, Security & Resiliency global practice leader and senior executive leadership.

companyName: Kyndryl Holdings, Inc.


text: Upon the identification of a cybersecurity incident, the Incident Response Team ("IRT") initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT reports the incident to the Audit Committee, as well as communicates with other appropriate stakeholders. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.


text: Our third-party business partners also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party business partner risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new third-party business partners and maintain ongoing evaluations to ensure compliance with our security standards.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach that we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."


text: Risk Management and Strategy We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes, which we rely on information technology systems and networks managed and maintained by independent third parties. Our information technology personnel, responsible for cyber security, monitors daily and weekly backups of our system to protect against data loss and minimize disruption to our operations in the event of a cybersecurity incident. Our data is accessible by our assigned personnel and third parties as necessary and appropriate, to perform services or otherwise do business with us, and we have implemented two-factor identification for access to our third party systems to submit relevant data to our IND.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our information technology personnel and our senior management lead the operational oversight of the company -wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.