text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Cybersecurity Processes and Risk Assessment Fortress's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: FORTRESS CREDIT REALTY INCOME TRUST

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Fortress has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Fortress's cybersecurity program is managed by Fortress's Chief Information Security Officer and Fortress's Chief Technology Officer (together, "Fortress IT Management"), who report to Fortress's Chief Financial Officer. Fortress IT Management and their team are responsible for implementing Fortress's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Fortress's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Fortress's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Fortress's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.

stage1Method: majority


text: Fortress's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Fortress's deployment of cybersecurity best practices and industry frameworks and help to identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Fortress IT Management for remediation. When Fortress engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Fortress also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Fortress conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Fortress has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Fortress's Enterprise Security Steering Committee (the "ESSC"), a cross-functional management committee that includes its General Counsel, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Chief Human Resources Officer and Fortress IT Management. The ESSC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Fortress's cybersecurity program, which is overseen by the ESSC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Fortress's Chief Technology Officer, who has over 30 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Fortress's Chief Information Security Officer, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The ESSC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Fortress's cybersecurity program.

stage1Category: Management Role


text: The Company's board of trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to an audit committee of the board of trustees (the "Audit Committee"). The Company's CFO periodically reports to the Audit Committee as well as the full board of trustees as appropriate, on cybersecurity matters. Such reporting includes updates on Fortress's cybersecurity program, the external threat environment and Fortress's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Fortress's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

stage1Category: Board Governance


text: Impact of Cybersecurity Risks W e are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Our business and operations could suffer in the event of system failures or cybersecurity breaches."

stage1Category: Strategy Integration


text: Risk Management and Strategy At December 31, 2024, we have implemented thorough cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are often assessed as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors are required to complete annual cybersecurity awareness trainings, including specific topics related to browser safety, data protection, and email fraud. We have competent employees and consultants with a firm understanding of cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as notify management of such attacks in a timely manner.

companyName: International Stem Cell CORP

ticker: ISCO


text: Our Information Technology General Controls are firmly established based on recognized industry standards and addresses matters such as risk management, data backup, and disaster recovery. We also engage an outsourced information technology consultant to actively monitor and mitigate security threats, as well as identify vulnerabilities and respond to all cybersecurity incidents affecting us, including timely communication of significant security incidents to senior business leadership and our Board of Directors.


text: Our Board of Directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Principal Financial Officer, frequently meets with and provides informative updates to our Board of Directors regarding our cybersecurity risks and activities, including any recent cyber security incidents and related responses, cybersecurity systems testing, and activities of third parties.


text: Our Information Security Team is outsourced to two separate service providers, one of which oversees all aspects of IT and facilities to ensure the Company's infrastructure, including intellectual property, is protected. Specifically, this service provider is tasked with communicating any issues or updates necessary and possesses the appropriate level of expertise to assess and manage the Company's cyber security risk. This service provider reports to our Principal Financial Officer, who oversees prevention, detection, mitigation, and remediation efforts through regular communication and reporting channels within our organization and with service providers.


text: Cybersecurity Threat Disclosure While we have not, at the date of this Annual Report, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. Refer to Part I, Item 1A. Risk Factors for further discussion of cybersecurity risks.

stage1Category: None/Other


text: We have implemented and maintain processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data").

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: Our information technology consultants help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology consultants identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans and; vulnerability testing.


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training; access controls; data encryption; systems monitoring; regular patching of operating systems and software; and a password policy.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information technology consultants work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: As of December 31, 2024, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a comprehensive cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Beachbody Company, Inc.

ticker: BODI


text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract manufacturing and research organizations. We evaluate the cybersecurity posture of such third-party service providers, including whether such providers maintain appropriate security measures and, where appropriate, require them to implement and maintain reasonable security measures in connection with their work with us. Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: We are increasingly dependent on sophisticated software applications, computing, and cloud infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, including contracted 24/7/365 Security Operating Center monitoring services and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and conduct ongoing cybersecurity awareness testing for our employees. Our program leverages industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use various means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors and ongoing due diligence with key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available where applicable as part of our oversight of third-party providers.

stage1Category: Third-Party Risk


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain a cybersecurity incident response program, which includes a set of protocols and procedures that we would follow in the event of a cybersecurity incident. Pursuant to the program and its escalation protocols, designated personnel are responsible for handling and managing potential cybersecurity incidents. We have relationships with a number of third-party service providers to assist with cybersecurity incident containment and remediation efforts.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Vice President of Information Technology (VP of IT) in conjunction with our managed service provider. The current VP of IT brings over 25 years of experience in IT, having held senior positions in technology management and cybersecurity at publicly traded biotechnology companies. This experience includes spearheading large-scale IT transformations, overseeing the implementation of security frameworks, such as NIST CSF, and developing and maintaining tools and processes to safeguard confidential data. Additionally, the VP of IT has directed comprehensive cybersecurity strategies tailored to the unique challenges of the pharmaceutical industry.


text: Our managed service provider is a System and Organization Controls (SOC) 2 accredited IT services firm that completed an annual audit, providing evidence of ongoing compliance to obtain the SOC 2 designation. This managed service provider has over a decade of experience delivering services and consulting related to regulatory security requirements. Our managed service provider is responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engage d to ensure that our cybersecurity program is designed to function effectively in the face of evolving cybersecurity threats. The managed service provider provides regular briefings to members of our management team on cybersecurity matters, including threats, events and program enhancements.


text: The Board of Directors (Board), acting through the Audit Committee of the Board (Audit Committee), has overall responsibility for risk oversight and oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures. On a regular basis, the VP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, the Company's information governance and cybersecurity policies and programs, and significant legal and regulatory developments that could materially impact the Company's cybersecurity risk exposure.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security methods and controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurances that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or are effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any notable incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President ("SVP") Enterprise Technology and Security, as part of the Board's continuing education on topics that impact public companies. Regular briefings ensure the Board remains informed about evolving threats and the organization's security posture.


text: Our management team, which includes the SVP Enterprise Technology & Security, Chief Operating Officer (COO), Chief Financial Officer (CFO), and General Counsel, collectively assesses and manages material cybersecurity threats. This team oversees the organization's cybersecurity risk management program and works closely with the SVP Enterprise Technology and Security, who oversees both enterprise IT and Security functions, ensuring alignment of technology and security strategies. With over 30 years of experience, the SVP Enterprise Technology and Security has served as Chief Information Officer and Vice President of IT for leading companies across Consumer Products, Energy and Media sectors on a global scale, with a strong focus in IT and operational technology security governance, compliance, and operations.


text: The dedicated Security function, led by the SVP Enterprise Technology and Security, effectively manages cyber risks while enabling business innovation and technology solutions. The team employs a multifaceted approach to cybersecurity, including prevention, detection, mitigation, and remediation of risks and incidents. Relevant efforts leverage internal security expertise, external consulting services, threat intelligence, alerts from advanced security tools deployed across our technical environments, other information obtained from government, public or private sources, and our security service providers.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data (Information Systems and Data).

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Our information security function is led by our Head of Information Technology, and is supported by the Chief Financial Officer and Vice President of Legal and Business Develop (the Information Security Team). Our Information Security Team works with other members of our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, and utilizing third-party assessments to identify vulnerabilities.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, distributors, supply chain resources and other consultants. We have vendor management processes to manage cybersecurity risks associated with our use of these providers. The processes include security assessment calls with certain vendor security personnel, conducting risk assessments for certain vendors and reviewing of security assessments. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in the section under Part I. Item 1A. "Risk Factors" of this Annual Report, including in the subsection titled "Risks Related to Our Business, Strategy and Industry."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Head of Information Technology and includes our Chief Financial Officer, Vice President of Legal and Business Development, and relevant business departments (the "Incident Management Team"). Our Head of Technology brings extensive experience in software development, IT, and cyber security, gained in over two decades in the consumer product and healthcare sectors.


text: As the leader of our Information Security Team, our Head of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, requesting and allocating budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policies and procedures are designed to escalate certain cybersecurity incidents to members of management who are part of the Incident Management Team. The Incident Management Team works to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the cybersecurity incident response policy and security incident handling procedure include escalating certain cybersecurity incidents to our disclosure committee and, if appropriate, to the Audit Committee.


text: The Audit Committee meets periodically, and receives regular reports from our Head of Information Technology and, as appropriate, other members of the Information Security Team concerning any significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, generally. The Head of Information Technology also provides regular reports to the Board of Directors of significant matters related to the Audit Committee's responsibilities.


text: Cybersecurity Risk Management and Strategy The Company recognizes the risks posed by cybersecurity threats, including the risk of harm to our customers, our financial condition and results of operations, and our reputation. Following a layered defense-in-depth strategy, the Company utilizes a variety of controls and both internal and third-party resources to assess and manage identified risks. The following components of our information security program address cybersecurity risk management, and have been integrated into the Company's overall risk management systems and processes: • Cybersecurity risks are identified and prioritized for resource allocation using two annual risk assessments: an internal risk assessment utilizing the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool, and a formal risk assessment prepared in conjunction with an external consultant. • A comprehensive set of security technologies constantly monitor our information systems and data, including endpoint detection and response services, intrusion detection and prevention, various filtering technologies, and event correlation technologies that alert management to potential cybersecurity threats. • Skilled internal personnel manage and update cyber defense functions including engineering, configuration, data protection, identity and access management, security operations, and threat intelligence. • Training programs continuously educate employees about cybersecurity risks and protection practices. • Periodic social engineering testing assists management in identifying training needs. • An incident response plan outlines the Company's response to a cybersecurity incident. Periodic testing of the plan ensures readiness and identifies refinements. • Reputable third-party assessors are engage d to conduct various assessments on a regular basis.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Supporting the Company's information security program is a third-party risk management program that manages the life cycle of external service providers and ensures that vendors meet the Company's cybersecurity requirements. This includes a periodic risk assessment of vendors and the review of vendor assessment documentation including audit reports and other independent control assessments.


text: The Company's cybersecurity risk management and strategy are regularly reviewed and updated to support our business strategy and objectives, our overall risk management, and address evolving potential cybersecurity threats.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, which we believe equips them to oversee cybersecurity and other risks effectively.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: Material Effects of Cybersecurity Threats Cybersecurity risks have the potential to materially affect the Company's business, financial condition and results of operation. The Company has strengthened its cybersecurity framework in recent years but the sophistication of emerging cyber threats and the utilization of new attack methods continues to evolve. The Company's cybersecurity risk management and strategy may not protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.


text: Board of Directors Oversight The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's enterprise risk management framework, including cybersecurity risk, and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. The Company's Information Security Officer ("ISO") provides the Board Risk Committee with regular updates on information security risk management and an annual comprehensive information security status report, which assesses the effectiveness of the program and updates the Risk Committee on developing trends and emerging threats.


text: Management's Role The Company's ISO has many years of experience appropriate to the role and is supported by skilled internal personnel. The ISO is responsible for identifying, assessing and managing cybersecurity risks and designing, implementing and maintaining the Company's information security program. The ISO reports to the Chief Risk Officer and the Board of Directors. Management's enterprise risk management committee receives regular updates from the ISO on cybersecurity related risks, including trends and emerging threats.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our board of directors.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Risk management and Strategy We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party information technology ("IT") and cybersecurity firm who serves as our dedicated IT and cybersecurity team to help us oversee, implement and manage these processes and controls. This IT and cybersecurity firm is independently audited on an annual basis and has a System and Organization Controls Audit certification.


text: Processes and controls we have implemented with the assistance of our third-part IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third-party IT and cybersecurity firm; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; and • requiring employees, as well as third parties who provide services on our behalf, to treat information and data with care.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to our Incident Response Team. The Incident Response Plan is designed to analyze, contain and remediate any cyber incidents that may circumvent existing safeguards. The Incident Response Plan encompasses a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal and external communication and disclosure protocols. We also maintain data backup procedures in the event of a cybersecurity incident. The Incident Response Plan is evaluated at least annually.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—Risks Related to Our Business and Properties—Cybersecurity incidents or other technology disruptions could negatively impact our business, our relationships, and our reputation."


text: Cybersecurity Governance As described above, we have engaged a third-party IT and cybersecurity firm to which we have delegated primary responsibility to oversee, implement and manage our processes and controls to assess, identify and manage risks from cybersecurity threats. Management receives monthly reports from the third-party IT and cybersecurity firm regarding cybersecurity incidents and any necessary remedial actions, data security posture and cybersecurity risk management processes and strategies. Management also meets quarterly with the third-party IT and cybersecurity firm to discuss technology and cybersecurity policies and procedures and risks and remediation actions.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See “Risk Factors – Cybersecurity Risks.”

companyName: PermRock Royalty Trust

ticker: PRT


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the audit committee. As such, our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. Management is responsible for the day-to-day assessment and management of cybersecurity risks. Management works with the third-party IT and cybersecurity firm to identify, assess and manage cybersecurity risks. Our management team includes the chief executive officer and chief financial officer, each of whom has over twenty years of experience in supervising, managing, underwriting, owning, operating and assessing the risks of commercial real estate investments and commercial real estate operating companies. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic process covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture and the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Additionally, management would notify the chair of the audit committee following any cybersecurity incident meeting specified security levels, and the audit committee would review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC. Members of our board of directors that are not members of the audit committee are also kept apprised of material risks from cybersecurity threats and our related risk management activities.


text: Governance Related to Cybersecurity Risks Our board of directors holds overall oversight responsibility for the Company's strategy and risk management processes, including in relation to cybersecurity risks. Our board exercises its oversight function through the audit committee, which oversees the assessment and management of risk exposure across various areas, including cybersecurity. Our audit committee receives regular reports from our Chief Financial Officer on significant cybersecurity matters, including, where appropriate, whether any significant incidents have occurred.

companyName: Markforged Holding Corp


text: Our IT Security Steering Committee, which is led by our Chief Financial Officer, is composed of various members of our organization, including our VP of Software Engineering and Director of Information Systems and Security. The IT Security Steering Committee is involved in oversight of cybersecurity risk. The IT Steering Committee exercises this function through our IT Security Team, which includes our Director of Information Systems and Security and our VP of Software Engineering who collectively have over 40 years of experience. The IT Security Team is responsible for the administration of our cyber program and works with various vendors and external providers to test and monitor for vulnerabilities and threats. We also engage our employees in our cybersecurity efforts through a process for employees to complete annual security and awareness training.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is informed by industry standards and includes processes for identification, assessment, and management of cybersecurity risks. With support from external vendors, we conduct internal and external risk assessments to assess our cyber program and develop strategies for the management of cyber risks. We also employ vendors and external partners to monitor for and manage threats, and we engage in testing to identify vulnerabilities and use third-party tools to scan for potential risks.


text: Our IT Security Team is informed about and monitors the prevention, management, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. Our managed security service provider is also tasked with testing, auditing, and monitoring the performance of our cybersecurity processes. We also maintain processes for reviewing and assessing vendor security before new engagements as part of our Vendor Advisory Board's function, which includes the administration of questionnaires and interviews.


text: We maintain processes to inform and update management and, as needed, the audit committee, about security incidents that may pose a significant risk for the business, as applicable. In accordance with our incident response policies, our IT Security Team and Chief Financial Officer are responsible for establishing incident response teams to manage cybersecurity incidents, should any arise. Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: The Trust does not have a board of directors, so the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an external security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data.

companyName: HilleVax, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Our Business Operations and Industry - Our information technology systems, or those of any of our service providers, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Audit Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the General Counsel and Chief Administrative Officer and Vice President, IT, is responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President, IT has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our Vice President, IT, possesses over twenty-five years of experience in the IT industry. Over the past ten years, he has held the position of Senior Director of Information Technology for multiple public biotechnology companies. During his tenure at HilleVax, he has managed both internal and external teams to ensure the seamless support of the Company's IT infrastructure, cybersecurity measures, and day-to-day operations.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Cybersecurity Risk Management and Strategy As a corporation committed to maintaining the integrity, confidentiality, and availability of the Company's digital assets and sensitive information, the Company recognizes the critical importance of cybersecurity in today's interconnected business landscape. The Company's cybersecurity measures are designed to safeguard the Company's systems, networks, data, and information from unauthorized access, disruption, or misuse.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: The Company recognizes that cybersecurity is fundamental to maintaining trust with shareholders, customers, and other stakeholders. By prioritizing cybersecurity as a strategic imperative, the Company strives to safeguard business operations, sensitive information, and integrity which preserves the value delivered to all the Company's constituents.


text: Management's Role Managing Risk The Senior Director of IT plays a pivotal role in informing the Audit Committee on cybersecurity risks. This role provides briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: Key components of the Company's cybersecurity program: • Risk Management: The Company continuously assesses and mitigates cybersecurity risks across the organization by leveraging industry best practices and frameworks such as NIST Cybersecurity Framework. • Governance and Oversight: The Company's Board of Directors (the Board) regularly reviews cybersecurity matters, ensuring alignment with business objectives and regulatory requirements. A designated Information Technology Strategic Committee, which includes many subject matter experts from the Board and Executive Management, meets quarterly to provide additional focus and expertise in this area. • Security Controls: The Company has implemented robust technical and procedural controls to protect information assets, including firewalls, intrusion detection systems, encryption, access controls, and multifactor authentication. These controls are tested periodically by external technology audit firms with penetration tests and security audits. • Policy Controls: Annually all employees sign off on the Company's data and device controls. The Company ensures that all information access points are the Company's assets and all data passing through these access points are accessible by the Company and can be deleted whenever the Company deems necessary. • Employee Training and Awareness: Ongoing cybersecurity training and awareness programs are implemented to educate employees about potential threats, phishing attacks, social engineering tactics, and best practices for safeguarding company information. • Incident Response: The Company maintains a comprehensive incident response plan to promptly detect, contain, and recover from cybersecurity incidents. Regular testing and simulation exercises ensure readiness and effectiveness of response capabilities. • Third-Party Risk Management: The Company regularly evaluates and monitors the cybersecurity posture of third-party vendors and partners with whom data is shared or relied upon for critical services, to ensure they meet the Company's security standards. • Continuous Improvement: The Company regularly reviews and makes enhancements to the cybersecurity program to adapt to emerging threats, technological advancements, and changes in regulatory requirements. Implementation of new technologies, practices, and infrastructures to target security vulnerabilities is ongoing. • Compliance and Reporting: The Company adheres to relevant cybersecurity regulations and standards applicable to the Company's industry and maintains transparency by disclosing material cybersecurity incidents or risks in accordance with regulatory obligations. The Company had no material cybersecurity incidents in 2024.


text: Risk Management Approach and Strategy Our corporate information technology, accounting and financial reporting platforms, and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We engage a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management efforts and shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk management.

companyName: GENERATION INCOME PROPERTIES, INC.

ticker: GIPR


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the " Technology Committee ") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms. • The Governance Committee is responsible for cybersecurity oversight, we bring any threat to the committee as needed and they review our cybersecurity insurance, incidences, if any, and responses, if any, on an annual or as needed basis. • The Director of Operations, has provided oversight of technology efforts for the Company since 2021, and is responsible for notifying the Governance Committee upon receiving cybersecurity incidences immediately, via email.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes, and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are integrated into our decision-making processes to monitor and manage risk.


text: Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engaged with a cybersecurity assessment firm as an external expert, to evaluate and test our risk management systems. This partnership enables us to leverage specialized knowledge and insights, of dedicated cybersecurity firms. Our collaborations with this third-party include regular system audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct security assessments of all third-party providers before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Senior Director of IT, who oversees the Company's cybersecurity function.


text: Risks from Cybersecurity Threats The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition. These types of events, which could lead to business disruptions, unplanned downtimes or outages, particularly in critical systems or services, may impact our ability to operate efficiently, affecting business continuity.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Director of IT and department staff. Our IT team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Senior Director of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Under his direction, the IT department implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the IT department is equipped with a well-defined written procedure. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Senior Director of IT consistently communicates with the Audit Committee regarding critical cybersecurity risks and incidents, ensuring that the organization's highest governance bodies remain well-informed about our cybersecurity status and potential vulnerabilities. Moreover, matters of significant cybersecurity importance, along with strategic risk management decisions, are promptly escalated to the Board of Directors. This process ensures that the Board maintains thorough oversight and is equipped to offer informed guidance on critical cybersecurity issues.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Turnstone Biologics Corp.


text: Our information security, security management, and risk management functions help identify, assess and manage the Company's cybersecurity threats and risks. Our information security security management, and risk management functions identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, analyzing reports of cybersecurity threats and threat actors, evaluating our and our industry's risk profile, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan/policy, a vulnerability management policy, data encryption, network security controls, data segregation, asset management, tracking, and disposal, access controls, systems monitoring, employee training, risk assessments, implementation of security standards/certifications, cyber insurance, and a dedicated cybersecurity staff/officer.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), cybersecurity consultants, and cybersecurity software providers.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers. We manage cybersecurity risks associated with our use of these providers using measures including risk assessments, reviewing their security assessments, reviewing their written security program, audits, and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal information technology systems, or those of our third parties with whom we work, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability, and could adversely affect our business, results of operations and financial condition".


text: Our information security function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Principal Financial and Accounting Officer and information security function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Principal Financial and Accounting Officer. Our Principal Financial and Accounting Officer and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.


text: The board committee receives periodic reports from our information security function (including our IT Director) concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Compliance Officer to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures and monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer and Chief Compliance Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and Chief Compliance Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.


text: Our Chief Compliance Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Cyber Risk Management and Strategy We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats. Our risk management is supported by various tools and technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address risks from cybersecurity threats.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: We engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing and assessments. We have a process to assess certain major third-party vendors and service providers, including through a review of responses to compliance questionnaires and contractual requirements, as appropriate.


text: We, like other companies in our industry, face a number of risks from cybersecurity threats in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the risks from cybersecurity threats we face, please see Item 1A- Risk Factors.


text: Governance Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including risks from cybersecurity threats.


text: The audit committee is responsible for oversight of our cyber risk management program. The day-to-day management of the cyber program is directed by the Director of IT under the direction of the Chief Financial Officer. Currently, the Director of IT reports to the Chief Financial Officer and provides periodic updates to the Chief Financial Officer on cyber matters.


text: The Director of IT meets with the Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company's third-party technology providers, as appropriate. The Chief Financial Officer provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company's risk management process, including risks from cybersecurity threats, as set forth in the audit committee charter. The audit committee periodically reports on cybersecurity risk management to the full board of directors.


text: We recognize the critical importance of cybersecurity in our overall enterprise risk management program. We have developed and implemented a comprehensive and cross-functional cybersecurity risk management program intended to protect the confidentiality, security, and availability of the information we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. Our board of directors and management team monitor and evaluate cybersecurity risk on an ongoing basis.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: 1. Governance: As described under “Governance” below, our board of directors oversees cybersecurity risk management in coordination with the audit committee of our board of directors, which regularly interacts with our management team, including our Chief Executive Officer, our General Counsel, our Senior Vice President, Finance, and our Senior Director, Head of IT (“Head of IT”).


text: 2. Cross-Functional Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: 3. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, data security, regular maintenance and patching and access controls which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: 4. Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: 5. Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We have implemented communication channels with our key third-party vendors to communicate regarding potential cybersecurity risks and incidents.


text: 6. Training and Awareness: We provide regular training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Additionally, we regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats, that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the “Risk Factors” disclosures in Item 1A of this Annual Report on Form 10-K.


text: Our board of directors, in coordination with our audit committee, oversees our enterprise risk management program, including cybersecurity risk management. On a regular basis, our audit committee discusses our cybersecurity risk management program with our Head of IT and other senior leaders. Our audit committee receives regular reports from our Head of IT on cybersecurity and information technology, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. Our full board of directors receives reports from our audit committee on its cybersecurity risk management activities and updates from our management team on our cybersecurity risk management.


text: Our management team, including our Head of IT and our Senior Vice President, Finance, has primary responsibility for developing and managing our overall cybersecurity risk management program. Our Head of IT supervises our internal cybersecurity personnel and our third-party cybersecurity vendors and consultants. Our management team has over 20 years of experience managing risks, including cybersecurity risks, at biotechnology companies and interacting with boards, and our Head of IT has served in various roles in information technology and information security for over 20 years.


text: Our Head of IT works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, cross-functional teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of IT monitors the prevention, detection, escalation, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our audit committee when appropriate.


text: Cybersecurity Risk Management and Strategy In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents. While we cannot completely protect against the possibility of a cybersecurity incident occurring, we take measures designed to mitigate risks from cybersecurity threats, including those implemented by our third-party managed services provider.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: As part of our cybersecurity procedures, we leverage a number of security controls, including network and device monitoring and system backup procedures. We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."


text: Cybersecurity Governance Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of the Company's risk management controls, including controls in connection with risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors is primarily responsible for overseeing the Company's compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of the Company's information system and cybersecurity controls.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; penetration testing firms; darkweb monitoring services; and managed detection and response providers.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: On a quarterly basis, the Audit Committee discusses with senior management, and internal audit, if applicable, the Company's processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of the Company's cybersecurity processes. The Audit Committee also receives updates on, and monitors, the Company's prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Risk management and strategy We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information technology ("IT") systems and protect the confidentiality, integrity, and availability of our data.

companyName: FTC Solar, Inc.

ticker: FTCI


text: We have integrated cybersecurity risk management into our overall risk management and internal control framework and have established policies and controls that we believe are appropriate in light of the risks of damage to our reputation and financial condition from unauthorized access to our key digital assets and systems.


text: Many of our key IT systems are "software as a service" solutions provided by third parties with extensive experience and knowledge in addressing cybersecurity risks involving those systems and have their own robust system of controls regarding their software products, which we monitor on a recurring basis through review of independent reports on their systems of internal controls provided to us. Such IT systems include our primary accounting, financial reporting, payroll and employee benefits, document storage, email and video communication, employee expense reporting and our internal IT ticketing and asset control systems. Our internal IT team holds regular weekly meetings to discuss cybersecurity-related items such as (i) operating and application system patching, (ii) phishing attempts, (iii) malware, (iv) non-compliant devices, (v) third-party secure scorecard results, and (vi) alerts provided through our Security Operations Center.


text: We obtain security incident reports from our third-party software and service providers regarding unauthorized attempts to access our systems, when and if they occur, and we work closely with our third-party providers to explore the details of any unauthorized attempts to infiltrate those systems and to assess whether any critical information within those systems was compromised or not. We also evaluate to the extent possible our system of controls in comparison to information obtained from our third-party providers, as well as our independent accountants and other technology consultants, of practices followed by other companies in safeguarding their systems in order to ensure our cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Many of our employees work remotely or in various locations around the world and are provided with company-owned IT equipment. Software and firmware updates to such equipment are managed and controlled by the Company.


text: In order to further protect ourselves financially, we maintain insurance coverage of up to $ 3 million with respect to losses from business interruption, data recovery, cyber-extortion and ransomware, data breach response and crisis management as a result of a cybersecurity incident.


text: As of the date of the filing of this Annual Report, we have not encountered any cybersecurity incidents that have materially impaired our business strategy, operations or financial standing.


text: Board of Directors Oversight Our Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms to ensure effective governance in managing these risks. The Audit Committee is central to the Board's oversight and has been directed to assume primary responsibility for such oversight by the Board. The Audit Committee is comprised of board members with diverse experience including risk management, technology and finance, which, in the judgment of the Board, equips them with the ability to oversee cybersecurity risks effectively. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance to our management and approval of major initiatives.


text: Management's Role Managing Risk We have established a Cybersecurity Governance Committee, which meets monthly or more frequently, if needed, to monitor: • our current cybersecurity controls and our ability to address emerging threats; • the status of our ongoing cybersecurity initiatives and strategy; • incident reports from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: During 2024, members of o ur Cybersecurity Governance Committee included our Chief Financial Officer, Vice President of Software, Senior Manager of IT, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. Our Chief Financial Officer, Corporate Controller, Director of SEC Reporting and Technical Accounting and Director of Internal Audit each have a number of years of experience in auditing internal controls and assessing risk processes of public companies, including controls involving a company's information technology systems. Our Vice President of Software has a number of years of experience leading software development efforts, including ensuring new software has proper safeguards included to minimize the risk of cybersecurity events. Finally, our Senior Manager of IT has a number of years of experience in implementing and monitoring controls and processes in a company's information technology systems environment that are designed to minimize the risk of cybersecurity events. Accordingly, we believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight.


text: Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition, our Chief Financial Officer, Senior Manager of IT and Director of Internal Audit maintain an ongoing dialogue with the Audit Committee during the year regarding emerging or potential cybersecurity risks.


text: The Cybersecurity Governance Committee has the responsibility for determining if a cybersecurity incident is considered to have a material impact on the Company requiring public reporting in accordance with the rules and regulations of the U.S. Securities and Exchange Commission.


text: Under the guidance of the Cybersecurity Governance Company, we have adopted (i) a Security Incident Response Plan, (ii) a Cybersecurity Materiality Assessment Policy, and (iii) a Cybersecurity Register of Events.


text: Our IT management, in conjunction with our Director of Internal Audit, has responsibility for monitoring and testing the effectiveness of our cybersecurity controls and procedures on a recurring basis.


text: Our information technology (IT) systems process, store, and transmit sensitive information, and we are heavily reliant on IT to operate our business. As such, IT security is viewed as a critical aspect of our business and one which we must continually evaluate and optimize in order to ensure ongoing effectiveness across the business in meeting the challenge of evolving cyber threats.

companyName: Loar Holdings Inc.

ticker: LOAR


text: We have incorporated a number of technical, administrative and personnel controls in order to holistically address cybersecurity threats across the business.


text: Cybersecurity Policies and Standards We have a comprehensive collection of documented policies and standards that are leveraged to establish and affirm expectations for security controls, mitigate known cybersecurity risks and provide consistent levels of protection across the Company. Our policies and standards are effective in meeting numerous compliance requirements while simultaneously reducing duplication of controls.


text: Incident Response Our incident response plan provides consistent guidance for preparing for cybersecurity incidents and events, establishes clear ownership of roles and responsibilities during a cyber incident, and has inter-dependent processes for detecting and responding to cyber incidents to include leveraging guidance from the legal team. We have retained a trusted and experienced third-party investigator/negotiator, and also maintain cybersecurity insurance to help mitigate the risk of a catastrophic cyber event.


text: Technical Controls We have implemented a technical security architecture consisting of a multitude of controls to identify, protect, detect, and respond to cybersecurity events. Continually evaluating common and best practices for deploying these controls, as well as determining when new or alternative controls may be more appropriate or effective, aids in our ability to counter actions from evolving threat actors. We also leverage various sources of cyber intelligence to ensure that technical controls maintain optimal configuration and deployment models to increase control effectiveness.


text: Third Party Security Monitoring Leveraging an industry recognized expert in cybersecurity monitoring, we have incorporated cybersecurity monitoring to increase visibility, awareness and responsiveness to cyber threat actors. Our monitoring partner is able to quickly analyze and alert us to suspicious activity, as well as take part in any active cyber investigation when necessary. The monitoring expertise provided allows us to focus on other aspects of cybersecurity while simultaneously ensuring that we are prepared to detect and respond appropriately to security incidents.


text: Testing and Validation We have incorporated multiple avenues of control and process testing and validation across the company. Our internal audit team regularly tests controls against established policies and standards. We leverage a trusted partner for performing regular penetration tests, to include phishing simulation exercises. Our IT and security team regularly conduct control validation exercises for each of the business units. We conduct regular incident response tabletop exercises to test and validate awareness of roles and responsibilities of incident responders across the organization and to educate individuals as to real world security incident scenarios.


text: Security Awareness All employees are required to undertake security awareness training on a number of topics to include phishing awareness, importance of cybersecurity and proper cyber hygiene, insider threat awareness and roles and responsibilities. Our IT and security teams regularly update training modules being leveraged in order to provide timely and relevant awareness, as well as to aid in better individual engagement with the training.


text: Management of Third-Party Risks We manage third-party risks from vendors and service providers by requiring that providers comply with our cybersecurity requirements and employ appropriate security controls in accordance with local, state and Federal laws. We evaluate applicable security controls of vendors and providers prior to contracting and at least annually thereafter. We evaluate the impact of any control deficiencies or exceptions identified during the review process and consider the effectiveness of the service provider's remediation plans and their commitment to addressing identified issues when determining continued engagement with the service provider.


text: Board Oversight and Management's Role Our cybersecurity program is led by our Chief Information Security Officer (CISO) at the direction of the CFO in coordination with our Director of IT. Our CISO has over 30 years of experience in cybersecurity and cyber risk management. His role includes assessing enterprise cybersecurity risks, developing policies and standards for the cybersecurity program, developing strategies for mitigating cybersecurity risks and informing senior leadership on cybersecurity related issues and activities affecting the organization. The CISO works with the IT and security team to implement cybersecurity controls across the organization.


text: Our Board of Directors is ultimately responsible for cybersecurity risk and has delegated its oversight to the Audit Committee. The Audit Committee considers cybersecurity risks in connection with its financial and compliance risk oversight role. The Audit Committee receives updates on cybersecurity risks and key initiatives for mitigating those risks from the CISO and CFO. For more information about the potential impact of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. The Company takes very seriously the responsibilities to protect sensitive client information, technology resources, and shareholder value from the risk of cyber threats and incidents. The Company has not identified risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operation. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Cybersecurity Risk Management and Strategy The Company maintains an enterprise-wide and Board-approved Information Security Program (the "Program"), which includes policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards that include National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the Financial Services Sector Cybersecurity Risk ("CRI") Profile, and the Federal Financial Institutions Examination Council Cyber Security Assessment. Core activities supporting the Company's strategy include leveraging people, technology and processes to manage and maintain cybersecurity controls.


text: People play a significant role in our defense against cybersecurity threats. We have established policies, training, and client education to mitigate cyber risk.


text: Additionally, we employ innovative technology solutions designed to identify, protect, detect, and mitigate cybersecurity threats through the use of firewalls, intrusion detection systems, patching, endpoint detection and response, encryption, multi factor authentication, and data backups to immutable storage.


text: We regularly engage third-party assessors, auditors, and solutions to test and evaluate our controls for managing cybersecurity threats. These engagements include penetration testing, vulnerability assessments, internal and external audits, security framework maturity assessments for continued focus and improvement, and social engineering tests of the effectiveness of our employee training to monitor our security posture. We leverage a managed security service provider to monitor users, application, infrastructure, and network activity on a 24/7/365 basis to detect and alert the cyber security operation team of cyber threats and potential cybersecurity events of concern.