text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. The Board has delegated primary responsibility for the oversight of cybersecurity matters to members of management who are responsible for implementing and maintaining our cybersecurity and data protection practices. Management reports to the Board at least annually on data protection and cybersecurity matters and reviews, and more frequently as needed. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NORTHWEST BIOTHERAPEUTICS INC

ticker: NWBO


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any material cybersecurity incidents since our IPO.

companyName: Israel Acquisitions Corp

ticker: ISRLF

secItem: Item 1C


text: Cybersecurity Risk Management We maintain written policies and procedures that outline the Company's comprehensive information security program (CISP). The Chief Information Security Officer (CISO) has the responsibility for implementation and maintenance of the CISP. In addition to SEC and FINRA regulatory requirements, we leverage established security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as guides to continually improve our policies and procedures. In addition, our employees are required to complete a cybersecurity training program each year, which is supplemented with additional awareness efforts, including phishing campaigns and informational notifications.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: We employ a variety of security tools and components to monitor, identify and block cybersecurity threats. In the event of a cybersecurity incident, the Company has an incident response team (IRT) whose role is to respond quickly and effectively. The IRT utilizes an incident response plan for the implementation of the its incident response capabilities that provides (i) a definition of "reportable incidents/events", and (ii) "metrics" for evaluating the IRT's response capabilities and effectiveness. The checklist is periodically reviewed by the IT Department for lessons learned from both mock and actual incidents, and to assure compliance with most current industry best practices and latest regulatory developments. The incident response plan includes processes through which cybersecurity incidents are escalated to the Company's executive officers. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel.

stage1Category: Risk Management Process

stage1Method: majority


text: Cybersecurity Committee The mission of the Cyber Security Committee is to be responsible for the cultivation of a corporate culture that recognizes risk awareness and the development of the Company's cyber security solutions, utilizing thought leadership, technology and systems, and development of applicable policies and procedures. Through its cyber security policy and procedures, the Committee will ensure effective collaboration and coordination between affected departments and staff in identifying and responding to both privacy and cyber security risks and events. The Committee will oversee the development and implementation of an enterprise-wide strategic framework related to the identification and prevention of cyber security threats as an integral part of the Firm's risk management process, otherwise known as CISP. The Firm's cyber security framework is intended to be "evolutionary", requiring (i) periodic reviews, and (ii) testing of systems, that result in changes to Company policy and procedures, as cyber security issues and developments require. The Committee shall be composed of specified members of senior management, department heads and staff, who have been selected based upon their backgrounds and experience involving IT, Risk Management, Operations, Compliance, and Legal. The Committee shall have the discretion to engage and utilize the services of independent vendors, computer service providers (eSP's) and consultants having expertise in the area of cyber security and IT. The Committee shall determine its meeting agendas and frequency of meetings which shall be reported through minutes prepared by the designated secretary.


text: Engagement of Third Parties We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, auditing of our CISP or consulting on our response to cyber security threats and breaches. Results of these evaluations are used to help determine priorities and initiatives to improve the overall CISP. As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.


text: The Company will conduct initial and ongoing due diligence of each current or prospective third-party service provider to evaluate whether the third-party service provider will have access, maintain, or store any client private information. Vendor cybersecurity controls are then assessed to determine if the vendor's control environment meets the Company's standards. Vendors are also assessed on a periodic ongoing basis according to their risk classification.


text: We do not currently engage third parties with respect to our cybersecurity risk management processes due to our limited resources and operations.

companyName: EXICURE, INC.

ticker: XCUR


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Nabors Energy Transition Corp. II


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: IX Acquisition Corp.

ticker: IXAQF


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our Initial Public Offering.


text: Cybersecurity Risk Management and Strategy Entero Therapeutics, Inc. has established a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information. Central to our cybersecurity efforts is a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: GridAI Technologies Corp.

ticker: GRDX

stage1Method: unanimous


text: In designing and evaluating our cybersecurity initiatives, we have adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) as a guiding principle. It's important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment, and management processes and does not equate to compliance with any specific technical standards or requirements.


text: Our cybersecurity framework is integrated into Entero's broader enterprise risk management strategy, sharing methodologies, reporting mechanisms, and governance structures with other risk domains including legal, compliance, strategic, operational, and financial risks. Conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;


text: A dedicated security consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents; Engagement with external service providers to evaluate, enhance, or support our security measures; Comprehensive cybersecurity training programs for employees, incident responders, and senior management to foster a culture of security awareness;


text: An incident response plan outlining specific procedures for managing cybersecurity incidents; and A thorough third-party risk management process to evaluate and manage risks associated with service providers, suppliers, and vendors.


text: To date, we have not identified any cybersecurity threats or past incidents that have had, or are likely to have, a material impact on our Company's operations, business strategy, financial performance, or results of operations.


text: Our external security expert has over thirty years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.


text: Cybersecurity Governance The governance of cybersecurity risks is a critical function of our Board of Directors, with the Audit Committee playing a key role in the oversight of cybersecurity and related technology risks. The Audit Committee is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer. This team is at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach includes regular updates from our external security expert, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.


text: As a blank check company, we have no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Report. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Spring Valley Acquisition Corp. II

ticker: SVIIF


text: We have no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Papaya Growth Opportunity Corp. I


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of the data we use in our business, as well as our employee and clinical data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies.


text: The Company's Chief Operating Officer (COO) assumes a pivotal role in overseeing the cybersecurity risk management program. The COO collaborates with business leaders on the matters of cybersecurity across the Company.


text: Cybersecurity risks fall within the purview of the Audit Committee and, ultimately, the Board of Directors. Regular oversight and reviews occur at established intervals. The Audit Committee engages in discussions with the COO and Company management at least once a year, covering various aspects of cybersecurity risk management, including recent developments, evolving standards, vulnerability assessments, and the threat environment.


text: We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.


text: We have a comprehensive incident response plan to address cybersecurity incidents. Our incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting our information technology. To date, we believe that our cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We engage external parties, including consultants, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.


text: The key processes, or components, of our cybersecurity risk management include: conducting periodic risk assessments to assist in identifying cybersecurity threats or risks; cybersecurity strategic roadmap;

companyName: Avinger Inc


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, we have not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

stage1Category: Strategy Integration


text: Risk Management and Strategy Our company recognizes cybersecurity as a critical component of its risk management strategy. We are committed to protecting our digital assets, customer data, and intellectual property from cyber threats. Our approach is guided by industry best practices and compliance with relevant cybersecurity standards and regulations including SOC 2, ISO 27001, and ISO 27701. We conduct regular assessments to identify potential cybersecurity threats and vulnerabilities that are then reviewed by external auditors as part of our annual SOC 2 Type 2 Review and ISO 27001 audit. This process includes evaluating external threat landscapes, internal systems, and processes for susceptibility to cyber-attacks. We utilize both in-house expertise and external consultants to ensure a comprehensive assessment. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Moatable, Inc.

ticker: MTBLY


text: Our information technology department collaborates with our security and compliance team (a cross-functional team), product development department and the legal department to help identify, assess and manage the company's cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile, using various methods including, among others, manual and automated tools, internal and external audits, third-party threat assessments and external intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including but not limited to IT policies (incident management plan, stake-holder engagement, incident response plan, DR plan, etc.) incident detection and response, and vulnerability detection and management, preventative controls including firewalls, secure coding practices and IDS, annual disaster recovery testing, data segregation and encryption (at rest and in-transit), network security controls and access controls, asset management, tracking and disposal, vendor management, employee training and awareness and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the information technology department, security and compliance team and product development department work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and our senior management, such as our chief executive officer, evaluates material risks from cybersecurity threats against our overall business objectives and reports to our board of directors, which evaluates our overall enterprise risk.


text: Additionally, we use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such third-party service providers include professional service firms including outside legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services providers, and forensic investigators. These third-party service providers perform a variety of functions for our company, and we maintain a robust vendor management program to manage cybersecurity risks associated with our use of these providers. For example, we conduct risk and security assessment for potential vendors and their programs and periodically review such assessments; and we require our vendors to complete security questionnaires and conduct audits and vulnerability scans related to them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect our company, see "Item 1A. Risk Factors—Risks Related to Our Business and Industry—Cyber-attacks, computer viruses, physical or electronic break-ins or other unauthorized access to our or our business partners' computer systems could result in misuse of confidential information and misappropriation of funds of our customers, subject us to liabilities, cause reputational harm and adversely impact our results of operations and financial condition.," and "—We rely on sophisticated information systems and third-party cloud infrastructure to run our business. The failure of these systems, any service disruptions or outages, or the inability to enhance our capabilities, could have a material adverse effect on our business, sales, and results of operations."


text: Our board of directors recognizes the critical importance of cybersecurity in safeguarding our company's assets, reputation, and customer trust. Our board of directors addresses our company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

stage1Category: Board Governance


text: Our cybersecurity incident response policy and vulnerability management policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our chief technology officer. These management members work with related incident response functions, including the information technology department, the product development department and the legal department, to help the company mitigate and remediate cybersecurity incidents of which they are notified.


text: Artificial Intelligence AI possesses the potential to transform various work sectors significantly. Currently, we are in the early stages of enhancing and broadening our offerings with AI technologies, aiming to assist our clients in tackling current challenges. Our dedication lies in actualizing AI's potential while ensuring ethical practices. Our approach is underpinned by fundamental values: ensuring equity, dependability, and safety, maintaining privacy and security, promoting inclusiveness, upholding transparency, and embracing accountability.


text: We are a SPAC with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable target businesses. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Angel Studios, Inc.

ticker: ANGX


text: We believe cybersecurity is critical to us because we are conducting material operations. Cybersecurity threats have not affected our business strategy or results of operations. The Board of Directors will continue to assess the potential threat to future operations as such operations develop. The Board of Directors will oversee management's processes for assessing, identifying and mitigating risks, including cybersecurity risks, to facilitate mitigating our risks involved with cybersecurity and help align our risk exposure with our strategic objectives. The Board relies on its executive officers to identify cybersecurity risks and retains oversight of cybersecurity. In the event of an incident, we intend to take appropriate steps from incident detection to mitigation, recovery and notification of appropriate parties. Management is responsible for day-to-day monitoring of cybersecurity, including detection and response and to report risks and incidents to the Board of Directors. We rely on computer software provided by third parties to protect our computer systems against cybersecurity threats.

companyName: SUNRISE REAL ESTATE GROUP INC

ticker: SRRE


text: Organizations are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. The Company maintains general cybersecurity policies and procedures to assess, identify, and manage cyber threats, and has designated personnel to implement and maintain these policies and procedures, subject to oversight by our management.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by industry standards. The Company has established and maintains incident response and recovery plans to address potential cybersecurity incidents. It has implemented a range of technical, physical, and administrative security controls to mitigate cybersecurity threats, including measures specifically focused on network security, data protection, and safeguarding information that, if compromised, could adversely affect the public interest or the Company.


text: The Company's employees are also required to sign confidentiality agreements in an effort to, among other things, help to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.


text: The Company relies on third-party service providers for critical or key infrastructure and solutions across various Company operations. Cybersecurity incidents that impact third-party service providers have significantly increased in recent years and represent a continuing risk to the Company. The Company has sought to mitigate this risk through specific cybersecurity controls, designed to assess the business and security controls implemented by key information services to the Company. The management assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks.

stage1Category: Third-Party Risk


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We work with government, customer, industry and/or supplier partners to gather and develop policies and standards and share information to address cyber threats. We conduct information security assessments of partners before sharing or allowing the hosting of data in computing environments managed by third parties. We require our employees to complete phishing and other awareness training to help identify, avoid and mitigate cybersecurity threats.

companyName: AAR CORP

ticker: AIR


text: We maintain robust and comprehensive processes, procedures and controls to protect and secure our information systems and data infrastructure from cybersecurity threats. Our cybersecurity program is led by our Vice President of Technology, who functions as our chief information security officer (" CISO "). Our CISO has over 20 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies. Our cybersecurity program interfaces with other functional areas within the Company, including but not limited to our business segments and information technology (" IT ") and legal departments, as well as external third-party partners, to identify and understand potential cybersecurity threats, including those associated with any third-party service providers we may use. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments. We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the International Organization for Standardization (" ISO ").

companyName: Reservoir Media, Inc.

ticker: RSVR

stage1Category: Management Role


text: Our cybersecurity risk program is integrated into our overall enterprise risk management assessment, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program. Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate our employees regarding cybersecurity. The CISO also manages our Incident Response Team, which includes a team comprised of executives from various cross - functional management teams, internal technical support roles and external third - party service providers. The Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third - party service providers based on type and severity of the specific incident.


text: We also require cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. The IT team provides regular updates to senior management on various cybersecurity threats, assessments and findings, and the effectiveness of the Company's cyber risk management program. Our Board of Directors through the Audit Committee oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Disclosure Committee and Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect our systems and information may not successfully protect against all cyber incidents. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further action, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors–If we or our service providers do not maintain the security of information relating to our customers, employees and vendors and our music, security information breaches through cyber security attacks or otherwise could damage our reputation with customers, employees, vendors and artists, and we could incur substantial additional costs, become subject to litigation and our results of operations and financial condition could be adversely affected."


text: We face many cybersecurity threats including ransomware, denial-of-service attacks, business email compromise, and persistent threats from state-affiliated groups. We have experienced cyber-attacks in the past and may experience cybersecurity incidents in the future. While prior incidents have not materially affected our business, results of operations or financial condition, there is no guarantee that a future cyber threat or cyber incident would not affect our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for more information on our cybersecurity risks.


text: Risk Management and Strategy We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes multiple complementary elements to mitigate our cybersecurity risks. We utilize multi-layered defenses to help prevent attacks including the use of data analytics to help detect anomalies and search for cyber threats. We have comprehensive cyber threat detection and response capabilities with applied threat intelligence, and continuous monitoring to complement other technology, processes and threat detection techniques we have in place. We subscribe to third-party managed security services that continuously monitor our systems and networks to assist with early cybersecurity threat detection and protection.


text: Through a combination of these technical, procedural, and educational measures, our program is designed to detect and respond to cybersecurity threats effectively and thereby safeguard our business operations and sensitive information.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: While our primary focus is on prevention and detection of cybersecurity threats, we have response and recovery plans in effect, as well as service agreements with outside experts should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The detailed plan defines the roles and responsibilities of all parties included in our cybersecurity incident response team which incorporates our IT team, senior management, and other functional areas.


text: We also have controls and procedures for reporting material cybersecurity incidents, including review of significant cybersecurity incidents by a cross-functional team to determine whether further escalation is necessary. We also periodically conduct practice exercises with management to familiarize the management team with our cyber incident response capabilities and processes. We also conduct internal and third-party assessments or penetration tests to validate our cybersecurity controls and improve our security posture. We also maintain cybersecurity liability insurance coverage.


text: Our Chief Information Security Officer ("CISO") partners with management in internal functions, such as finance, legal, and internal audit, in overseeing information security risks, as well as third-party consultants who perform risk-based assessments with recommendations for designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategies, which helps align our programs and strategies with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee and the Board of Directors.


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated CISO whose team is responsible for managing our information security strategy, policies, standards, and processes. The information security team provides security monitoring and response and provides regular reports to the CISO to inform about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO, who also serves as our data protection officer, reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer.


text: Our CISO and CDTO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. Our CISO has 35 years of experience in information technology systems and is a 25-year military veteran of the U.S. Navy and Navy Reserves with a Top Secret/Sensitive Compartmented Information (TS/SCI) U.S. security clearance and multiple combat deployments in information warfare. Additionally, our CISO holds several certifications, including, among others, the following security certifications: Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Network Defense Analyst (CNDA), Disaster Recovery Institute International (DRII), and CompTIA – Network+ and Security+. Our CDTO has over 25 years of leadership experience across all aspects of technology-enabled digital transformations, including leading multiple transformations at a major airline prior to his role at AAR. He previously advised companies across multiple industries in collaboratively developing and executing their digital and technology roadmaps as a consultant at a major firm.


text: The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.


text: The Company has cybersecurity risk management processes, including physical, technological and administrative controls, intended to protect the confidentiality, integrity and availability of the Company's information technology infrastructure and systems or any information residing therein. The Company relies on third party service providers to operate, maintain and monitor its information technology infrastructure and systems and to assess, identify and manage material risks from cybersecurity threats with respect thereto. The Company's management monitors its service providers. The Company's service providers are tasked with notifying the Company's management of any material cybersecurity incident that negatively impacts the Company's information technology infrastructure and systems or any information residing therein. Material and potentially material cybersecurity incidents would be assessed by the Company's executive officers for remediation and future prevention and detection.

companyName: AMREP CORP.

ticker: AXR


text: Notwithstanding the Company's processes for assessing, identifying and managing risks from cybersecurity threats, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. During 2025 and 2024, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Incident Response Plan: The Company has developed and maintains an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Annual testing is conducted to determine the effectiveness of the incident response plan, and maintenance of backup and protective systems is performed as needed.

companyName: DallasNews Corp


text: The Board of Directors of the Company oversees the Company's risk management program as part of its general oversight function. The Board of Directors has delegated to the Audit Committee of the Board of Directors of the Company the responsibility for reviewing and discussing with management the Company's policies with respect to risk assessment and risk management and for reviewing contingent risks that may be material to the Company, including cybersecurity risks. The Audit Committee engages in regular discussions with the Company's executive officers regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks, including cybersecurity risks. The Audit Committee also reports relevant material information regarding any such risks to the Board of Directors. The Company's executive officers are responsible for identifying and assessing material risks for the business on an ongoing basis, including cybersecurity risks. Although the Company's executive officers do not have cybersecurity expertise, their experience managing the Company, which includes consulting and coordinating as necessary with its service providers, enables them to effectively assess and manage material risks from cybersecurity threats.


text: We rely upon internally and externally managed information technology systems and networks for the collection and storage of sensitive data and business information. We approach cybersecurity risks with a comprehensive risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to our business.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: Risk Management and Strategy Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned, or managed by us. Our focus is on protecting sensitive information, such as the personal information of our customers and employees, and confidential business information that a competitor or a malicious actor could leverage. Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices and engaging third-party service providers to conduct security assessments.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We conduct regular risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards.


text: We have implemented technical solutions designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware and endpoint protection functionality, and access and identity controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards.


text: We have not experienced any cybersecurity incidents that have been determined to affect us materially, our business strategy, results of operations, or financial condition. As external events evolve, we will continue to evaluate and address these conditions as needed.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Cybersecurity Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. Our IT staff along with the third-party providers and outsourced IT services monitor and address cybersecurity related risks, including installing software for threat protection and malware. Our IT staff and such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.

companyName: TECHPRECISION CORP

ticker: TPCS


text: We continue to work with outside counsel and third - party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.


text: Our Chief Executive Officer is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff and third-party service providers. Our IT staff at both Ranor and Stadco oversee their respective cybersecurity processes on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above, and escalate matters to our Chief Executive Officer as appropriate.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Our Chief Executive Officer provides periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for an initial business combination. Therefore, we do not believe that we face significant cybersecurity risks and have not adopted any cybersecurity risk management programs or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Relativity Acquisition Corp

ticker: ACQC


text: Once we are operational and have available funding, we will be committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we plan to implement a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets.


text: Risk Management and Strategy We maintain high standards with respect to cybersecurity and our cybersecurity risk management program is integrated into our enterprise risk management framework, overseen by our Information Security Officer ("ISO"), meaning that cyber-risks are identified, evaluated, and managed with the same rigor as other strategic, operational, and financial risks. We have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles as a guide for our security controls and processes, helping us structure our activities around identifying potential threats, protecting systems, detecting incidents, responding to events, and recovering operations. We engage independent third-party cybersecurity auditors and testers annually to review our Information Security Management (ISMS) and renew our ISO/IEC 27001 certification. Key elements of our program include:


text: Preventive Controls and Monitoring: We employ multiple layers of technical controls (firewalls, intrusion detection systems, encryption, and multi-factor authentication) to proactively monitor IT controls to ensure compliance with security policies, legal regulations, contractual obligations and industry best practices. Our Global Security Operations Center operates 24/7 with real-time monitoring capabilities to rapidly investigate alerts and trigger containment measures, which helps us minimize exposure or damage if a cybersecurity incident occurs.


text: Vulnerability Management and Testing: We conduct regular vulnerability assessments and annual external penetration testing of our systems and applications to probe for weaknesses. We also perform periodic exercises simulating cybersecurity incidents to test our defenses and response procedures. Findings from these tests are used to strengthen our security posture on an ongoing basis.


text: Incident Response Planning: We maintain a cybersecurity incident response plan that defines procedures for addressing security events. This plan is updated and tested regularly (including through tabletop drills and simulated breach exercises) so that our teams remain practiced in incident handling. In the event of an incident, our aim is to respond swiftly to contain the issue, notify appropriate stakeholders, investigate the root cause, and recover normal operations as soon as practicable.


text: Third-Party Risk Management: We carefully manage cybersecurity risks arising from our use of third-party software, cloud services, and suppliers. We perform due diligence and security risk assessments on critical third-party service providers, both at onboarding and periodically during the relationship. Our procurement and legal teams work together to incorporate robust cybersecurity requirements into contracts with vendors (for example, data protection standards and incident notification obligations). Where appropriate, we require suppliers to adhere to our security policies or industry standards, and we conduct ongoing monitoring or audits of their security controls. These steps help reduce the risk that a weakness in a partner's systems could compromise our data or operations.


text: Employee Training and Awareness: A strong security culture among our employees is one of our best defenses in relation to cybersecurity events. Our employees are required to complete annual cybersecurity and data protection awareness training. This training educates personnel on topics like phishing prevention, safe computing practices, and how to report potential security issues. We supplement formal training with periodic phishing email simulations and security reminders.


text: to records containing client's personal information shall be limited to those persons who are reasonably required to know such information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Cybersecurity threats are endemic to the modern business environment, and attempts to penetrate our network security are frequent and on-going. However, to date, no cybersecurity threats (including incidents) have resulted in a material impact on our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident, that we will not experience a cybersecurity incident in the future, or that a past cybersecurity incident will not result in a future material impact. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Governance and Oversight We have established strong governance practices to oversee cybersecurity and IT risks. The Board of Directors has delegated primary oversight responsibility for cybersecurity to the Risk Management Committee (RMC) of the Board, which is composed of several Board members. Our Chief Information Officer (CIO) and Information Security Officer (ISO) receive security reports and threat intelligence from the Security Operations Center, which apprises the CIO and ISO of any potential incidents and the status of ongoing preventive measures and they share this information at least quarterly with the RMC. They also brief the full Board as needed on cybersecurity matters.


text: We have a multi-disciplinary Cybersecurity Council that connects our Information Security, IT, Corporate Audit, Finance, Legal, Compliance, and Investor Relations teams. This Council facilitates coordination of cybersecurity risk management across our organization and a unified response to incidents. In the event of a cybersecurity incident, the ISO will lead our incident response efforts and convene the Cybersecurity Council to evaluate the situation and determine appropriate next steps (for example, engaging law enforcement or cyber-experts, and considering disclosure obligations). This integrated governance structure – from the operational teams up through senior management and the Board – helps drive accountability and visibility for cybersecurity throughout our organization.


text: Our leadership team includes seasoned professionals with deep expertise in technology and security. Our CIO, Todd Weathersby, has more than 25 years of experience in global IT and cybersecurity management, and our ISO has more than 25 years of experience in cybersecurity, risk, and compliance (with certifications such as CISSP and CISM). The knowledge and experience of our CIO and ISO, along with the Board's active engagement, provides a strong oversight of our cybersecurity strategy. The Board and management also receive regular briefings and training sessions regarding emerging cybersecurity threats and regulatory developments in order to be positioned to adapt to new challenges in the cybersecurity landscape.


text: The Company's Cybersecurity Program The Company's cybersecurity program is an integral part of the long-term sustainability and effectiveness of the Company's operational and technology environment. To protect the integrity of its data and operational and technology systems, the Company employs a "defense-in-depth" strategy that uses multiple security measures. This strategy aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. The Company periodically reviews and modifies the implementation of its cybersecurity strategy based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants.

companyName: American Water Works Company, Inc.

ticker: AWK


text: The Company's cybersecurity program includes the following areas of focus: • Technology that includes, among other things, encryption, threat management, monitoring, investigation support and backups for physical devices, such as mobile phones and computers, connected to the Company network; • Identity and access management controls that include, among other things, multi-factor authentication and safeguards associated with granting elevated privileges; • Proactive cybersecurity processes, including vulnerability scanning, penetration testing and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that are regularly evaluated using various incident response and disaster recovery exercises; • Employee cyber risk awareness and training, including regular simulation exercises with employees, that covers cybersecurity threats and actions to prevent and report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring and contractual obligations, and periodic review of third-party control environments to align the Company's risk exposure with its business requirements and risk tolerances.


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations and has implemented a third-party risk management program to understand the cybersecurity risks to the Company that may arise out of these third-party relationships. The Company categorizes third-party relationships by risk level, which is determined primarily by the service provided by the third-party and its level of access to the Company's data. Each category has specific cybersecurity controls, data privacy and documentation requirements, which are outlined in the agreement between the Company and the third-party service provider. In addition, the Company evaluates the online security footprint for its service providers at the time of agreement, and on a regular basis, thereafter, depending on the provider's risk level. The Company reviews its agreements with third-party service providers periodically related to terms and conditions governing cybersecurity controls and data privacy. The Company also monitors, as appropriate, risks relating to potential compromises of sensitive Company information through third parties and reevaluates these risks periodically. In addition, the Company obtains annual attestation reports related to data security and privacy from certain third-party providers to further support compliance with industry-standard cybersecurity protocols.


text: Cybersecurity Risks The Company believes that its current preventative actions and response activities provide reasonable measures of protection against security breaches and serve generally to reduce the Company's overall cybersecurity risk. However, cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In addition, the Company has obtained insurance to provide coverage for a portion of the losses and damages that may result from a cyber attack or a security breach, but such insurance is subject to exclusions, limitations and exceptions, and may not cover the total loss or damage caused by an attack or breach. To date, management has determined that no cybersecurity incident experienced by the Company has resulted in a material impact on its financial condition, results of operations or business strategy. For additional information concerning cybersecurity-related risks, see Item 1A—Risk Factors—We may be subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured.


text: Cybersecurity Risk Management and Strategy The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Security Officer ("CSO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The Company's CSO has 23 years of work experience in the cybersecurity field throughout various industries, including the utility sector, and has obtained several professional certifications, including from the International Information System Security Certification Consortium. The CSO reports directly to the Company's Chief Information Officer ("CIO"), who is responsible for the Company's information technology program. The CIO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's CSO, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CIO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CIO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CIO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council.


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2023, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.


text: The Company's cybersecurity risk assessment process involves considering risks associated with the nature of its business, receiving and processing inputs from internal and external stakeholders, monitoring industry trends and risks and engaging external advisors, to assist in aligning the Company's cybersecurity processes with industry best practices. Risk assessments are conducted quarterly and annually to evaluate the effectiveness of the Company's existing security controls and serve as the basis for additional safeguards, security controls and measures. Operational and technical security controls are deployed and integrated as safeguards against unauthorized access to the Company's information systems. These controls are aimed at (i) assuring the continuity of business processes that are dependent upon automation, (ii) maintaining the integrity of the Company's data, (iii) supporting regulatory and legislative compliance requirements, and (iv) maintaining safe and reliable service to the Company's customers.


text: The Company has also implemented a vulnerability assessment program that is conducted at least annually and more frequently, depending on the nature of the risk. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.


text: Incident Response The Company utilizes an established internal framework designed to assess promptly the severity and materiality of cybersecurity incidents based on predefined quantitative and qualitative criteria and to determine the appropriate level of response. Incidents are escalated to the relevant management teams based on their severity and materiality for prompt response and mitigation. The Company maintains a standing crisis response team comprised of individuals from various functional units, including without limitation Information Technology, Legal, Finance, Enterprise Risk Management, Operations and Communications, to respond to cybersecurity and physical security incidents, environmental incidents and health and safety emergencies, among others.


text: Ellington's cybersecurity processes and practices are integrated into Ellington's risk management and oversight program. In general, Ellington seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Ellington collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.

companyName: Ellington Financial Inc.

ticker: EFC


text: If a cybersecurity incident were to occur, the Company would establish a cross-functional incident response team to respond to the specific cybersecurity incident. The incident response team would consist of a subset of members from the standing crisis response team, including personnel with the most relevant experience related to the specific incident. This collaborative approach is intended to enable the Company to leverage expertise throughout the business to address cybersecurity events and to evaluate the potential financial, legal, operational and reputational implications of an incident, or series of related incidents. In considering the materiality of an event, related attacks, whether in terms of quantity or impact, are reviewed individually and in the aggregate to determine whether they may have a significant impact on the Company's financial condition, results of operations or business strategy, either quantitatively or qualitatively.


text: Cybersecurity Governance The Board of Directors is responsible for oversight of the Company's cybersecurity program and the Company's responses to cybersecurity risk. The Board of Directors has delegated to the Safety, Environmental, Technology and Operations ("SETO") Committee of the Board of Directors responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company's operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports from the CIO and CSO related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company's cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee of the Board of Directors, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company's system of internal controls and the Company's risk assessment and management strategy, including with respect to cybersecurity risks.


text: When a cybersecurity incident occurs, the Company establishes a cross-functional incident response team to respond to the specific cybersecurity incident. The incident response team consists of a subset of members from the standing crisis response team, including personnel with the most relevant experience related to the specific incident. This collaborative approach is intended to enable the Company to leverage expertise throughout the business to address cybersecurity events and to evaluate the potential financial, legal, operational and reputational implications of an incident, or series of related incidents. In considering the materiality of an event, related attacks, whether in terms of quantity or impact, are reviewed individually and in the aggregate to determine whether they may have a significant impact on the Company's financial condition, results of operations or business strategy, either quantitatively or qualitatively.


text: Cybersecurity Risks Cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and information technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving and increasingly complex nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. By way of example, as previously disclosed, on October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems, which was determined to be the result of a cybersecurity incident. To date, the Company has determined that it has not experienced a cybersecurity incident that has resulted in a material impact to the Company's financial condition, results of operations, cash flows, or business strategy. For additional information concerning the October 3, 2024, cybersecurity incident, and cybersecurity-related risks, see Item 1A—Risk Factors—Risks Related to Our Industry and Business Operations—We are, and may in the future be, subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured; and Item 7—Management's Discussion and Analysis of Financial Condition and Results of Operations—Other Matters—Cybersecurity Incident.

stage1Category: Incident Disclosure


text: Cybersecurity Risk Management and Strategy The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Information Security Officer ("CISO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The CISO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's Chief Security Officer, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CISO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CISO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CISO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council. The CISO reports directly to the Company's Chief Technology and Information Officer, who is responsible for the Company's information technology program.


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2024, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.


text: The Company has also implemented a vulnerability assessment program that is reviewed at least annually and more frequently, depending on changes to the risk environment. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.


text: Longbridge's cybersecurity processes and practices are integrated into Longbridge's operational risk oversight program. In general, Longbridge also seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Longbridge collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur. Longbridge had over 400 employees as of December 31, 2024.


text: Cybersecurity Governance The Board of Directors is responsible for oversight of the Company's cybersecurity program and the Company's responses to cybersecurity risk. The Board of Directors has delegated to its SETO Committee responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company's operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company's cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company's system of internal controls and the Company's risk assessment and management strategy, including with respect to cybersecurity risks.


text: As discussed further in "Item 1. Business—Our Manager and Ellington," we are externally managed and advised by our Manager, an affiliate of Ellington. Our Manager does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. Other than with respect to our majority-owned subsidiary Longbridge's operations, we rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: Longbridge's cybersecurity processes and practices are integrated into Longbridge's operational risk oversight program. In general, Longbridge also seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Longbridge collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur. Longbridge had over 400 employees as of December 31, 2023.


text: Ellington's Risk Management and Strategy Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee of our Board of Directors (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board of Directors, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Longbridge's cybersecurity risk management and strategy is co-led by its Chief Operating Officer ("COO") and its Vice President of Information Technology ("VP of IT"). Longbridge's COO has extensive leadership experience with enterprise information technology in the mortgage banking industry, where he has held various executive roles, including Chief Privacy Officer and Chief Information Officer. Longbridge's COO has developed and executed IT strategy, including cybersecurity programs, and helped achieve and maintain Sarbanes-Oxley compliance and SOC-2 certification. Longbridge's VP of IT has extensive leadership experience with enterprise information technology, both in the banking and manufacturing industries. She has also developed and executed IT strategy, including cybersecurity programs and helped achieve and maintain Sarbanes-Oxley compliance. Longbridge's COO, accompanied by its VP of IT, regularly discusses Longbridge's cybersecurity risks and posture, and its information technology roadmap, with the Audit Committee. In these reviews, Longbridge's COO informs the Audit Committee of what Longbridge believes are the key focus items of Longbridge in its cybersecurity program and the COO and VP of IT provide an overview of their views of emerging threats, and any significant cyber response activities or incidents.


text: Longbridge's Risk Management and Strategy Longbridge's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Directors' oversight of cybersecurity risk management is completed through the Audit Committee, which regularly interacts with both our and Longbridge's management teams who are responsible for assessing and managing material risks from cybersecurity threats at Longbridge. • Collaborative Approach: Longbridge has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows us to make decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Longbridge deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security such as anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Longbridge continuously evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Longbridge has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible such business disruption plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Longbridge maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of Longbridge's systems, as well as the systems of third-parties that could adversely impact Longbridge's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Longbridge to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Longbridge: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via a variety of communication methods; and (iii) conducts phishing tests to assess user alertness, and retains an external cybersecurity vendor to conduct similar tests on an annual basis.


text: Longbridge's technology team, and its operational risk management group, perform regular assessments of the firm's cybersecurity and infrastructure posture. These reviews cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and Longbridge's threat monitoring services. In such continued maintenance of its cybersecurity posture, Longbridge conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has an external firm dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Longbridge also regularly engages third parties to perform assessments of its cybersecurity posture, including cyber risk assessments, penetration testing, user access control reviews and independent reviews of Longbridge's information security control environment and operating effectiveness. The results of such assessments, tests and reviews are reported to our Audit Committee and Board of Directors, and Longbridge adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats from Longbridge have materially affected or are reasonably likely to materially affect our Company.


text: Our Board of Directors, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at both Ellington and Longbridge, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties.


text: Each of Ellington and Longbridge employ internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.


text: Ellington's cybersecurity team is lead by Ellington's outsourced Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has lead large technical efforts such as the development of Ellington's proprietary whole loan management system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has lead several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.